Privacy Policy

Last Updated: 2026-08-08

Company Information

• Company Name: facturillo Inc.
• Tax ID/EIN: 37-2195644
• Registered Address: 169 Madison Avenue STE 38332, New York, NY 10016 US
• Contact Email: info@facturillo.com

“facturillo” (the “App”) is provided by the Company listed above (referred to as “we,” “us,” or “the Company”). We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, process, store, and protect your personal data when you use our App. We comply with Panama’s Personal Data Protection Law (Law 81 of 2019, PDPL) and the EU General Data Protection Regulation (GDPR), as applicable. By using the App, you agree to the practices described in this Privacy Policy. This Policy applies to all users of the App, primarily those located in Panama.

Data Collection

Types of Personal Data Collected

We only collect data that is necessary for providing and improving our services. This includes:

• Full e-Receipt Data: Digital copies of your purchase receipts obtained from Panama’s tax authority (DGI) records. When you scan a receipt’s QR code, we retrieve the official electronic receipt (PDF) from the DGI website (https://dgi-fep.mef.gob.pa/). This e-receipt contains details like the vendor, items purchased, prices, taxes (ITBMS/VAT), and totals.
• Optional Demographic Data: Information you may choose to provide during registration, such as your gender, age group, and region. This data is optional and is used to personalize your experience and for anonymized analytics.
• Usage Data: Information about how you interact with the App, collected via third-party analytics tools (e.g., Google Analytics for Firebase). This may include features you use, screens viewed, time spent, and other usage statistics.
• Crash Logs: Technical information automatically collected if the App crashes or encounters errors, via Google Crashlytics. This helps us diagnose issues and improve the app’s stability.
• Advertising ID (Android devices only): On Android devices, we collect the Google Advertising ID (ADID) to track Meta (Facebook) advertising conversions and measure the effectiveness of our marketing campaigns. This helps us understand which ads brought users to our App. This ID does not directly identify you personally. Android users can opt out of this collection by going to Settings > Google > Ads > Opt out of Ads Personalization on their device. We do not collect advertising identifiers from iOS devices.
• Subscription Data: If you subscribe to an optional paid tier such as facturillo Pro, we store your subscription tier (e.g., "free," "pro"), active status, and billing period metadata (such as purchase and renewal timestamps). We do not collect, receive, or store your payment card or other payment instrument details. Those are handled exclusively by the Apple App Store, Google Play, and our subscription management provider (see "Service Providers" below). For each successful subscription charge, we automatically create a manual receipt in your in-app budget for your own record-keeping, marked as a subscription receipt.

Methods of Collection

• Direct Collection: You provide data directly when you use the App’s features (for example, by scanning a receipt QR code, registering an account, or updating your profile information). Scanning a QR code will trigger the retrieval of the related e-receipt data from DGI’s system.
• Automatic Collection: Certain data is collected automatically as you use the App. For instance, analytics SDKs (Software Development Kits) running in the App automatically gather Usage Data, and Crashlytics automatically logs errors.

Data Processing and Use

Purposes for Processing Personal Data

We process the collected data for the following purposes:

• Core Service Functionality: To enable the App’s primary features, such as scanning receipts, retrieving official digital copies of receipts, processing and enhancing receipt information, categorizing vendors and products, and providing you with detailed spending analytics and reports. For example, we use Google Cloud’s Vertex AI services to analyze and categorize receipt data into meaningful categories.

• Service Improvement: To monitor, analyze, and improve the App’s performance and quality. Usage Data and crash logs help us fix bugs, optimize the user experience, and develop new features.

• Subscription Management: To manage optional paid subscriptions (such as facturillo Pro), including activating, renewing, downgrading, or cancelling your subscription and unlocking the corresponding features. This processing is necessary to perform the subscription contract you enter into when you choose to subscribe.

• Promotional Communications (Opt-In): If you have opted in to the Puntos Facturillo loyalty program (see below), we may use your email address and anonymized purchase data to send you occasional personalized promotional emails. These communications may include special offers, new feature announcements, or partner promotions. We do not share your identity or email with any partners when sending these messages. Such emails are sent at a reasonable frequency, and each will include an option to unsubscribe if you wish to stop receiving them.

• Aggregated Insights: To generate anonymized and aggregated statistics about shopping trends and App usage. Aggregated data (which does not identify any individual) may be used for research or business purposes, or shared with third-party partners for analytics and industry insights.

• Data Monetization and Analytics: In addition to the above, we may further analyze and use receipt data to support our business (always in a privacy-protective way). Some of this activity involves sharing anonymized information with third parties:

  • Aggregated Statistics (default use): We combine and anonymize purchase data from many users to produce general market insights (for example, average spending on groceries in a region or trends over time). This aggregated information contains no personal identifiers and cannot be traced back to you. We may share or sell these irreversibly anonymized statistics with trusted partners or data brokers for research, analytics, or industry purposes. Because this data is fully anonymized, its use is not subject to GDPR/PDPL consent requirements.

  • Anonymous User Profiles (Puntos Facturillo opt-in): If you explicitly opt in by joining the Puntos Facturillo program, we will generate an anonymous user profile of your shopping behavior. This includes assigning a hashed (non-identifying) user ID to you and analyzing your receipt data (along with any demographic details you choose to provide) to identify patterns and trends. We may share these pseudonymous profile insights with trusted third parties (for example, to enable personalized price comparisons, market analysis, or special offers), or use them to personalize promotions and rewards for you. This analysis and sharing is done only with your consent and in an anonymized form that does not reveal your identity. You can withdraw this consent at any time by opting out of the Puntos Facturillo program or by deleting your account (see “Withdrawal of Consent” below for details).

Note: Users who do not opt into the Puntos Facturillo program will not have an anonymous profile created and will not receive personalized offers. We will only use their data for the core service, routine analytics, and aggregated insights as described above.

Legal Bases for Processing

We only process your personal data when we have a valid legal reason to do so, such as:

• Consent (General): By creating an account and accepting this Privacy Policy (and our Terms of Use), you are giving your consent for us to process your data as described herein. This general consent includes retrieving your receipts from the DGI system and using your data for the core functionality, analytics, and other purposes explained in this Policy (except where we specifically request a separate opt-in).

• Consent for Additional Processing (Puntos Facturillo Program): If you choose to opt in to the Puntos Facturillo loyalty program, we will separately obtain your explicit consent to collect, process, and share your data for additional analytics, personalized offers, and market research purposes as described above. Specifically, you agree that:

  • We may generate an internal anonymized user ID for you and use your receipt data (along with aggregated spending information and any demographic details you provide) to build an anonymous usage profile for third-party research, analysis, or personalized services.

  • Your data will be shared only in a fully anonymized or pseudonymized form that prevents any third party from linking the information back to you as an individual.

• Withdrawal of Consent: You may withdraw a consent you have given (for example, the Puntos Facturillo program data-sharing consent) at any time by:

  1. Opting out of the Puntos Facturillo program in the App’s settings (which disables all further collection of new anonymized profile data); or

  2. Deleting your account (see “Data Deletion Process” below).

  Please note that withdrawing consent will not affect the legality of any processing or sharing performed before your withdrawal. Any data that was already processed and irreversibly anonymized based on your consent (including data shared with partners) may continue to be used as part of existing analyses or partnerships, since it cannot be retrieved or linked to you.

• Contractual Necessity: Processing is necessary for the performance of the service contract between you and us. In other words, we must process your data in order to deliver the features you expect from the App (for example, retrieving your e-receipts and maintaining your account). Without this data, we cannot fulfill our obligations to provide the App’s functionality to you. (If you withdraw consent for certain essential processing, we may be unable to continue providing some or all services to you.)

• Other Legal Bases: We may also rely on other legal grounds as required by applicable law (for example, compliance with a legal obligation or our legitimate interests) for certain processing. If we do so, we will ensure it is permissible under the law and, where required, we will inform you or obtain additional consent.

Data Storage and Retention

• Storage Location: Your personal data is stored securely on Google Cloud servers (through Firebase services). Our primary database and file storage are located in the United States. We choose Google Cloud for its robust security measures and compliance with international standards. By using the App, you understand that your data will be transferred to and stored in the U.S. (see Data Transfers below for how we protect data during such transfers).

• Retention Period: We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Policy, unless a longer retention period is required or permitted by law. In practice:

  • Indefinite Retention Until Deletion: We will keep your account data (including your stored e-receipts and profile info) until you actively request deletion or as long as you maintain an active account. This allows you to access your receipt history over time.
  • Account Deletion: If you decide to delete your account, we will permanently erase your personal data upon request. You can initiate deletion by using the in-app delete account option or by sending us an email from your registered email address (see Data Deletion Process below). Once we confirm your request, your identifiable personal data (such as your user profile and full e-receipt details) will be deleted from our servers within 30 days. Backup copies may persist slightly longer in secure storage but will be removed shortly thereafter through our regular backup purge cycles.
  • Anonymized Data: Any data that has already been anonymized and aggregated (for example, statistics derived from many users’ receipts) is not linked to you and cannot be feasibly deleted for an individual user. Such aggregated data may be retained indefinitely for analysis, research, and reporting purposes, since it contains no personal identifiers. Similarly, if you had opted into the Puntos Facturillo program, any anonymized profile data or insights that were generated and shared with partners under your consent will remain in use as part of existing datasets and partnerships (but, as noted, this data cannot identify you personally).
  • Shared (Family) Account Data: Data stored in a shared family account (see Shared Accounts (facturillo Familia) below) is retained for as long as the family account exists, independently of any individual member's account. When a family account is closed, receipt documents that could not be returned to a live member (including receipts originally scanned by users who have since deleted their own accounts) are deactivated (soft-deleted) and retained on the closed account rather than being erased. This intentional retention mirrors how we retain other deleted data: the documents are no longer visible or accessible in the App, and are kept only in our internal systems.

We periodically review the data we hold and securely delete or anonymize information that is no longer needed for any legitimate purpose.

Data Sharing and Disclosure

We do not sell or rent your personal information. We only share data in the following circumstances:

• Service Providers (Processors): We employ reputable third-party companies to help operate and improve the App. These data processors handle data on our behalf under strict confidentiality and security agreements. For example:

  • Cloud Hosting: We use Google Cloud/Firebase to host databases and store files (including receipt PDFs). Google acts as our data processor, storing data under strong security measures. We have a Data Processing Addendum (DPA) with Google, which includes standard contractual clauses to safeguard personal data.
  • Analytics: We use Google Analytics for Firebase to track usage patterns and Google Crashlytics to log app crashes. These tools help us understand app performance and issues. Data they collect (e.g., Usage Data, crash reports) may be associated with a unique identifier but not with your name. Google processes this data on our behalf and is bound by privacy commitments and DPAs to protect it.
  • Subscription Management (RevenueCat): We use RevenueCat, Inc. to manage paid subscriptions (including facturillo Pro) across iOS and Android. When you subscribe, your user identifier and subscription events are shared with RevenueCat so that it can track your entitlements and notify us via webhooks when your subscription changes (purchase, renewal, cancellation, or expiration). RevenueCat acts as our data processor and is bound by its own privacy policy and security commitments. See RevenueCat's privacy policy at https://www.revenuecat.com/privacy.
  • Payment Processing (Apple and Google): When you purchase a subscription on iOS, the payment is processed by Apple Inc. under the Apple Media Services Terms and Conditions. On Android, the payment is processed by Google LLC under Google Play's Terms of Service. These platforms handle all billing, payment method storage, tax collection, and refunds. We never receive or store your credit card or other payment instrument details. We only receive anonymized transaction metadata and entitlement status via RevenueCat.

• Third-Party Data Partners (Aggregated Data): We may share aggregated, anonymized insights with third parties for business or research purposes. For example, we might share statistics like “X% of users spent more on groceries this month compared to last month” or other market trends derived from many users’ receipts. This information contains no personal identifiers and cannot be traced back to any individual. Partners who receive aggregated data have no ability to contact you or extract personal details from it.

• Legal Compliance: We may disclose personal data if required to do so by law or a valid legal process (for example, in response to a court order, subpoena, or government investigation). We will only do this after verifying the request is legitimate and only to the extent required by law. Where permitted, we will inform you of such disclosure.

• Protection of Rights and Safety: If we believe that disclosure is necessary to enforce our Terms of Use, to protect our rights, privacy, safety, or property (or that of our users or the public), we may disclose certain data. This includes exchanging information with other companies and organizations for fraud prevention or security protection.

• Business Transfers: If the Company is involved in a merger, acquisition, investment, reorganization, or sale of assets, your data may be transferred to the new owner or partner as part of that deal. If such a transfer occurs, we will ensure the new entity honors the commitments we’ve made in this Privacy Policy, and we will notify you (for example, via email or an in-app notice) of any change in data handling. You will have the opportunity to delete your data if you do not wish to be subject to the privacy practices of the new owner.

We never share your raw, identifiable receipt data or personal details with third parties (such as data brokers) without your knowledge or consent. Any periodic sharing with third parties is done on an anonymized basis as described above. If you have questions about third parties that may have access to your data, feel free to contact us.

Shared Accounts (facturillo Familia)

facturillo offers shared family accounts (see the Family Accounts section of our Terms of Use). Joining or creating a family account has the following privacy implications:

• Sharing with other members is user-initiated and visible to the whole family: Everything stored in a family account (receipts scanned into it [including the vendor, items, prices, dates, and other details on those receipts], pockets, budgets, analytics, and the family's Puntos Facturillo activity) is visible to all members of that family account. The App also shows which member scanned each receipt, so your display name and profile photo may appear as attribution on receipts and activity you contribute. This sharing happens because you (or another member) chose to place data in the shared account; it is not a disclosure to any third party outside your family group.

• Member profile visibility: Basic profile information (your display name, photo, and role) is visible to the other members of your family account so the family can be managed.

• Leaving a family: If you leave (or are removed from) a family account, the receipts you scanned into it are automatically returned to your personal account. Contributions that legitimately belong to the family's shared records (for example, your past activity reflected in the family's historical statistics) may remain part of the family account.

• If you delete your facturillo account: Receipts you scanned into a family account remain with that family account after you delete your own account: they are part of the family's shared records and cannot be returned to a deleted account (see Data Deletion Process below).

• Closed family accounts: When a family account is closed, receipts are returned to the member who scanned them wherever possible. Receipt documents that cannot be returned to a live member are deactivated (soft-deleted) and retained on the closed account, as described under Data Storage and Retention above.

AI Assistant Connections (facturillo AI Connector)

facturillo lets you connect your account to a third-party AI assistant of your choice (such as Claude by Anthropic, or ChatGPT by OpenAI) so the assistant can answer questions about your receipts. This feature is entirely optional. Connecting an assistant has the following privacy implications:

• You initiate and approve every connection: A connection exists only if you set it up in the assistant yourself and then approve it from the facturillo app on your phone, using an industry-standard authorization flow (OAuth). We never connect your account to any AI provider on our own initiative, and no data flows until you approve. You never share your facturillo credentials with the assistant.

• Read-only access: The connection can only read data. The assistant can never create, modify, or delete anything in your account, and its access is limited to receipt-related data.

• What is shared, and when: Data is shared only in response to the questions you ask the assistant, at the moment you ask them. Depending on your question, this can include your receipts and their details (vendor, items, prices, dates, payment method), spending summaries, and product or vendor information from your account. If you belong to a shared family account and select it as the context for your questions, the assistant can read the shared data of that account that you are already entitled to see in the App. If you ask for a receipt's attached file, the assistant receives a temporary download link that expires after 15 minutes.

• The recipient is your chosen AI provider: Data returned to the assistant is transmitted to the AI provider you connected (for example, Anthropic or OpenAI) and is from that point handled under that provider's own terms and privacy policy. The AI provider is not our data processor: we do not control how it uses, stores, or retains what you choose to share with it through your questions. We encourage you to review your provider's privacy terms (including any settings about the use of your conversations for model training) before connecting.

• Disconnecting: You can revoke the connection at any time from the connector settings of your AI assistant, and access credentials also expire automatically. Once revoked or expired, the assistant can no longer read anything from your account. Data already transmitted to the provider in past conversations remains subject to that provider's own policy.

Accounting Integrations (Connecting an Accounting Platform)

facturillo lets you connect one third-party accounting platform of your choice (such as QuickBooks Online, Xero, Zoho Books, Alegra, or Odoo) to a client account, so you can export selected expense records into your accounting software. This feature is entirely optional. Using it has the following privacy implications:

• You initiate and control every export: You connect the platform yourself through an industry-standard authorization flow (OAuth) or the credential it provides, and each export happens only when you select specific facturas (receipts) and confirm it. Nothing is exported automatically. Only one accounting platform can be connected per client account at a time.

• What is shared, and when: Data is shared only for the facturas you choose to export, at the moment you export them. For each exported factura this includes its expense data (vendor name and tax ID, date, amounts, taxes, line items, payment method, and reference numbers) together with the receipt file (its PDF or image) as an attachment. Data flows one way, from facturillo to your connected platform; the only information we read back is the platform's chart of accounts (so you can map categories) and duplicate-check look-ups of records we ourselves created for you.

• The recipient is the accounting platform you connected: Exported data is transmitted to the platform you connected (for example, Intuit for QuickBooks Online) and is from that point handled under that platform's own terms and privacy policy. The platform is not our data processor for that data: we do not control how it uses, stores, or retains it, and we cannot retrieve or delete it from the platform on your behalf. You manage exported records within your accounting software.

• Your data goes only to your platform: Your exported data is sent only to the platform you connected. We never send it to any other platform, to any other customer, or to any other third party, and we never aggregate it with other users' data or use it to train or process any AI model.

• How we protect the connection: The authorization tokens and API credentials for your connection are stored encrypted, using envelope encryption with keys managed in Google Cloud Key Management Service (KMS), on Google Cloud servers in the United States. They are never displayed to you or anyone else.

• Disconnecting: You can disconnect the integration at any time. This stops all future exports immediately and deletes or invalidates the stored credentials. Data that was already exported remains in your accounting software and continues to be governed by that platform's own policy.

User Rights

Under applicable data protection laws, including Panama’s PDPL and the GDPR, you have several rights regarding your personal data. These include:

• Right to Access: You can request confirmation of whether we are processing your personal data, and if so, request a copy of the data we hold about you. This allows you to know and verify the legality of our data processing.

• Right to Rectification: If any of your personal data is inaccurate or incomplete, you have the right to request that we correct or update it. (We appreciate it when you keep your information up-to-date!)

• Right to Erasure (Cancellation): You have the right to request deletion of your personal data when it’s no longer needed for the purposes for which it was collected, or if you withdraw consent or object to processing (among other reasons provided by law). This is sometimes called the “Right to be Forgotten.” We will honor such requests to the extent required by law (see Data Deletion Process below for more details).

• Right to Object: You may object to certain processing of your data, such as for direct marketing purposes or in cases where we process data based on a legitimate interest. If you object and we do not have an overriding legitimate ground to continue the processing, we will stop processing your data for that purpose. For example, you can object to receiving promotional communications from us, and we will refrain from sending them (unless you later opt in again).

• Right to Data Portability: You can request to receive the personal data that you have provided to us, in a structured, commonly used, and machine-readable format, and you have the right to transmit that data to another service provider (where technically feasible). In practice, this means we can provide you with an export of your account information and receipt data (for example, in CSV or JSON format) upon request.

• Right Not to be Subject to Automated Decisions: The App does not make any legally significant decisions about you based solely on automated processing. In general, you have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal or similarly significant effects on you. In our case, any automated analyses we perform (like categorizing your expenses or awarding points/badges) are intended for your benefit and do not negatively affect your rights or access to the service. If you believe an automated process is affecting you in a significant way, you have the right to request human review of the outcome.

These rights may be subject to certain exceptions or limitations under law. For example, we might not delete data we are required to keep for legal compliance, or we might decline a data portability request that infringes on others’ rights. If we cannot fulfill a request in whole or in part, we will explain the reasons to you.

Exercising Your Rights: You can exercise any of your rights at any time by contacting us (see Contact Information below). To protect your privacy, we will take steps to verify your identity before fulfilling your request (for instance, by confirming you have access to the email associated with your account). Exercising your rights is free of charge. We will do our best to respond within 30 calendar days, as required by law. If we need more time or cannot comply with your request due to a legal obligation or another valid exception, we will inform you and explain the reasons.

Data Deletion Process

We hope you enjoy using facturillo, but you can delete your account at any time. The data deletion process is as follows:

• Account Deletion Request: To delete your account and all associated personal data, you have two options:

  • In-App Support Request: Contact our support team through the App's built-in “Support” feature. Because this request originates from your authenticated session, it serves as proof of account ownership.

  • In-App “Delete My Account” Button: Within the App’s settings or account menu, tap “Delete my account.” Since this request also comes from your logged-in session, it serves as proof of ownership.

  • Email Request: Send an email to privacy@facturillo.com from the email address associated with your account. (If you used “Sign in with Apple” or another method that masks your email, please use one of the in-app options above so we can verify account ownership.)

• Processing Your Request: Once we receive your deletion request, we will send a confirmation (if necessary) and begin the deletion procedure. We will permanently remove your personal data from our active databases within 30 days of confirming your request. This includes your profile information and all stored e-receipts that can identify you. The PDF copies of your receipts and any metadata linked to your account will be erased or anonymized. (If you have any active subscription or premium features, deleting your account will terminate access to those as well. See our Terms of Use for details on any points or rewards implications.)

• Family Account Data: Deleting your account applies to your personal account and its data. Receipts you scanned into a shared family account belong to that family's shared records and remain with the family account after your deletion: they cannot be returned to a deleted account (see Shared Accounts (facturillo Familia) above). If you want those receipts removed from the family before deleting your account, leave the family account first (which returns your scanned receipts to your personal account) and then request deletion.

• Post-Deletion: After deletion, you will no longer be able to log in to the App or retrieve any receipts that were stored. Your username/email will be freed up for use (though we do not reuse emails for new accounts without a fresh signup). Some residual information may remain in encrypted backups for a short period but will be overwritten in the normal course of backup rotations. We will not use any data in backups except as needed for legal obligations or disaster recovery, and such backup data will eventually be completely purged.

• Anonymized Data Retention: As noted, any aggregated analytics or reports that were generated while you used the App (and which do not identify you personally) will not be deleted because they are not considered personal data. For example, if your receipts contributed to a statistic like “total spending in Panama City this month,” that statistic remains in our datasets, but it contains no identifying information. We cannot feasibly reverse-engineer aggregated data to remove individual contributions. Rest assured, those insights contain no personal identifiers after anonymization.

• Confirmation: If you require confirmation of deletion for your records, please let us know in your request. We can provide written confirmation once your data has been fully erased from our systems.

Note: Deleting your account is permanent and cannot be undone. If you simply uninstall the App from your device without requesting account deletion, your account (and data) will remain on our servers. If you wish to stop using the App but think you might resume later, no action is needed: your account will stay dormant until you log in again or decide to delete it.

Security Measures

We take the security of your personal data very seriously and employ a variety of measures to protect it from unauthorized access, alteration, disclosure, or destruction. Our security practices include:

• Encryption: Data is encrypted both at rest and in transit. This means your data is stored on our servers in encrypted form, and all communication between the App and our servers is protected by SSL/TLS encryption (HTTPS). For example, when you scan receipts or view your data, the transfer is secured so that third parties cannot eavesdrop.

• Secure Infrastructure: We use Google Firebase and Google Cloud services, which provide industry-standard security features including firewalls, intrusion detection systems, and access controls. Google’s data centers are highly secure facilities with 24/7 monitoring and strict personnel access restrictions.

• Authentication and Access Control: Access to production databases and storage buckets is tightly limited to authorized personnel who require it to operate and maintain the service. Our Firebase databases are protected by authentication rules (for instance, your account can only read your own data, not someone else’s). Internally, our team members’ access to personal data is restricted on a need-to-know basis and protected by strong authentication (e.g., two-factor authentication). We also encourage you to use a strong, unique password for your account to protect against unauthorized access on your side.

• Regular Updates and Patching: We keep our application software, libraries, and servers up-to-date with the latest security patches and updates. This helps protect against known vulnerabilities. We also rely on Google’s managed services, which are continuously updated and monitored for security issues.

• Monitoring and Auditing: We regularly review our systems for potential vulnerabilities or attacks. Suspected breaches or anomalies are investigated promptly. In the event of a security incident involving your personal data, we have procedures to notify affected users and authorities as required by law (for instance, PDPL and GDPR mandate notification of certain breaches).

• Employee Training and Policies: Our team is trained on data protection best practices. We limit employee access to personal data and require confidentiality commitments from those who handle it.

While we strive to protect your information, no system can be 100% secure. You also play an important role in security: keep your login credentials confidential and notify us immediately if you suspect any unauthorized access to your account. We will work promptly to address any issues.

Cookies and Tracking Technologies

Our App does not use traditional "cookies" like a website, but it employs similar tracking technologies through third-party SDKs. Here is how we use these technologies:

• Analytics Tracking: The App uses Google Analytics for Firebase to collect data on how users engage with the App (such as which features are used most, user demographics, device information, etc.). This may involve using unique identifiers (like an Instance ID) to distinguish unique devices or users. The information collected helps us improve app functionality and user experience. It does not directly identify you by name or email and is mainly aggregated for analysis.

• Crash Reporting: We use Google Crashlytics to automatically report app crashes or errors. Crash reports include device and app version information and help us diagnose and fix issues quickly. These reports do not include personal content from your receipts, only technical data about the crash.

• Third-Party Policies & Opt-Out: All third-party tools we use (such as Firebase Analytics and Crashlytics) are governed by Google’s privacy policies. We encourage you to review Google’s Privacy Policy and the specific privacy information for Firebase services to understand how they handle data. By using our App, you consent to the operation of these technologies as described in this Policy. If you opt out of certain tracking (for instance, by disabling analytics collection in the App settings or on your device), we will respect those preferences. However, completely opting out of all data collection may not be possible without discontinuing use of the App, since some data (like basic analytics and crash reports) is necessary to provide the service and maintain its quality. Rest assured that we do not use any tracking technologies for purposes other than those stated (such as analytics, crash reporting, and the optional loyalty program features).

Data Transfers

Because our services are operated from the United States and utilize cloud infrastructure in the United States, your personal data may be transferred to and processed in countries outside of your own (including outside of Panama or the European Economic Area). Your data is routinely transferred to and stored in the United States where our cloud servers and company headquarters are located.

Additionally, to provide and improve our services, we may engage trusted third-party service providers located in various countries worldwide who may access or process your data on our behalf. These providers may be located in countries including but not limited to the United States, Canada, European Union member states, India, the Philippines, or other jurisdictions where our service providers operate. All such providers are contractually bound to protect your data in accordance with this Privacy Policy and applicable data protection laws.

We take steps to ensure that international data transfers comply with applicable laws and that your data remains protected:

• Adequacy and Safeguards: Panama’s PDPL and the GDPR both require that personal data transferred out of their jurisdiction is adequately protected. For transfers from the EU/EEA (if any), we rely on the European Commission’s Standard Contractual Clauses (SCCs) as part of our agreements with service providers like Google. These clauses contractually require the recipient to protect EU personal data to EU standards. Google’s Cloud Data Processing Addendum incorporates SCCs to cover data transfers from Europe to the US.
• Consent for International Transfer: By using the App and providing us your information, you explicitly consent to the transfer of your data to servers in the United States and to our handling of data by our company and authorized service providers.
• Monitoring Developments: We monitor legal developments around international data transfers (such as new regulations or guidance from data protection authorities). If needed, we will adjust our practices (for example, by adopting any new approved transfer mechanisms) to ensure continued compliance.
• Requests for Information: If you have questions about the mechanisms by which your data is transferred across borders, feel free to contact us. We can provide more information on our data transfer safeguards upon request.

Our goal is to make sure that no matter where your data is processed, the level of protection and care is consistent with the protections offered in Panama and the EU.

Changes to the Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes (meaning significant changes that affect your rights or how your data is handled), we will notify you in advance:

• Notification: We will post an in-app notification or send an email to the address associated with your account to inform you of the proposed changes.
• Advance Notice: We will provide at least 30 days notice before material changes take effect, so you have time to review the updates. The "Last Updated" date at the top will be revised accordingly.
• Your Choice: If you do not agree with the changes, you have the right to stop using the App and may delete your account (as described above) before the updated policy applies. If you continue to use the App after the effective date of the revised Privacy Policy, it means you accept the changes.

For minor updates that do not significantly affect rights (such as clarifications or typographical corrections), we may not send a formal notice, so we encourage you to periodically review this Privacy Policy. We maintain archives of previous versions which can be provided upon request for transparency.

Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, you can contact us using the details below. We are here to help and will respond as promptly as possible.

• General Support Inquiries: support@facturillo.com

• Privacy & Data Protection: privacy@facturillo.com

  When contacting us about your personal data, please include the email address associated with your account and clearly state your request or question. This will help us locate your information and respond more efficiently.

Your Right to Lodge a Complaint: If you believe we have not addressed your data protection concerns satisfactorily, you have the right to lodge a complaint with the relevant data protection authority.

• In Panama, the supervisory authority for data protection is the Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI), which oversees compliance with Law 81 of 2019.
• In the United States, you may contact the Federal Trade Commission (FTC) or your state's Attorney General's office regarding data protection concerns. The FTC can be reached at https://www.ftc.gov or 1-877-FTC-HELP.
• In the European Union, you may contact the data protection authority in the country of your residence. Since we process EU residents' data, you have the right to lodge a complaint with your local supervisory authority.

We would, however, appreciate the chance to address your concerns directly before you approach a regulator. Your trust is very important to us, and we will do our utmost to resolve any issue to your satisfaction.