Privacy Policy

1. Information we collect

We collect only the information necessary to operate Walpli.

Account information

• Email.
• Password (stored as a hash via Supabase Auth; never in plain text). If you sign in with Google or Apple, we receive your email, your name and, with Google, your profile photo.
• Name and profile photo (optional).
• Time zone and language (detected automatically; you can change them).

Technical data

• IP address, device type, operating system and browser, processed by our servers and providers to keep your session, deliver app updates and protect the service.

Financial data you create

• Accounts (name, type, balance, currency, color, icon) and reserves.
• Transactions (type, amount, name, date, category, account, payment method).
• Categories, budgets, automations, templates and pending items.
• Shared spaces: if you invite someone or accept an invitation, the members of that space can see its financial data.

Optional integration data

• Telegram: chat identifier and linking date.
• WhatsApp (through Meta's WhatsApp API): phone number and linking date.

Data processed by AI

• Text messages and voice notes (which we transcribe) you send to the bots or to the app's voice input, and receipt images you send to the bots.
• Financial context to interpret them and answer your questions (account names and balances, categories, recent transactions).

Subscription data

We store your subscription status (plan, dates, provider) and a record of payment notifications. Payments are processed directly by LemonSqueezy (web), Apple (App Store) or Google (Google Play); Walpli never receives your full card number, only its brand and last 4 digits to show them to you.

Service operation data

To run plans and features we record how many times you use AI features (to manage each plan's usage), your conversations with Walpli Coach (deleted automatically after 30 days, or sooner if you delete them), email deliveries and the emails of people you invite to a shared space.

Usage data (only with your consent)

If you accept the analytics tools, we record how you use the interface (screens, clicks, scrolling and session recordings with text hidden). App sessions are linked to your internal Walpli identifier so they can be analyzed. See Cookies, analytics and measurement.

2. How we use the information

We use your data to:

• Provide the financial management service, including shared spaces.
• Interpret your messages, voice notes and images to record transactions and answer questions about your finances.
• Answer the questions you ask Walpli Coach, using your account data.
• Send you service emails (due-date reminders, summaries) and, unless you turn them off, product news. You can turn them off in the app or from the link in each email.
• Keep the service secure, prevent fraud and improve stability.
• Measure and improve Walpli and our campaigns, only if you accepted the analytics tools.
• Comply with legal obligations.

We do not sell your data or use it for third-party advertising.

3. Legal basis for processing

In accordance with Chile's Personal Data Protection Law No. 21,719 (and, where applicable, the EU GDPR), we process your data on these bases:

• Performance of a contract: to provide the service you request when you create your account.
• Consent: for analytics and measurement tools and bot integrations. You can withdraw it at any time.
• Legitimate interest: for service security, fraud prevention and Walpli product news emails (you can unsubscribe anytime).
• Legal obligation: when required by law (for example, payment records).

4. Storage and security

• Database, authentication and functions on Supabase, on Amazon Web Services infrastructure in São Paulo, Brazil.
• Web app and website served from Cloudflare.
• Encrypted connections (HTTPS/TLS), per-user and per-space data isolation at the database level (Row Level Security) and least-privilege access.
• Optional app lock with Face ID, fingerprint or PIN.

If a security breach affecting your data occurs, we will inform you and the competent authority as required by law.

5. Providers that process data

We only share data with providers needed to run the service, acting on our behalf:

• Supabase (database, authentication and servers), Cloudflare (web hosting) and Expo (mobile app update delivery).
• OpenAI and Groq (AI processing of messages, voice notes, images and imports).
• Telegram and Meta (WhatsApp), if you link those bots.
• Resend (email delivery; it may measure opens and link clicks) and Web3Forms (website contact form).
• Google and Apple (sign-in and payments in their stores), LemonSqueezy and RevenueCat (payments and subscriptions).
• Hotjar, Microsoft Clarity, Google Analytics and Meta Pixel (analytics and measurement, only with your consent). The walpli.com website also loads fonts from Google Fonts.

Walpli does not sell or trade personal data.

6. Processing by artificial intelligence

• Your messages, voice notes and images are sent to OpenAI models (or Groq in some import processes) only to interpret them, record transactions and answer your questions.
• These providers do not use data sent through their API to train their models.
• The bots remember the last messages of the conversation for about 2 hours to understand follow-up questions; they are then deleted automatically.
• Walpli Coach (Pro plan) sends the model your question, your name and the account data needed to answer it (for example, category totals, balances or transactions). The conversation is stored in Walpli, is private (people you share a space with can't see it either) and is deleted automatically after 30 days.
• Walpli does not make automated decisions that produce legal effects on you, nor does it assess your credit risk.

7. Optional integrations

The Telegram and WhatsApp integrations are voluntary. You can link or unlink them anytime from the app; deleting your account removes their data.

8. Cookies, analytics and measurement

Necessary: local storage and technical cookies for your session and preferences. Walpli does not work without them.

Analytics and measurement (optional): only turned on if you accept them in the notice you will see on the website, the web app or the mobile app (the mobile app only uses Microsoft Clarity):

• Hotjar and Microsoft Clarity: heatmaps and session recordings to improve the design. All on-screen text is hidden in recordings, so your amounts, names and data are not captured. In the mobile app recording pauses on the lock screen.
• Google Analytics: aggregated usage statistics, with the IP address anonymized.
• Meta Pixel: measures the effectiveness of our advertising campaigns.

You can change your choice at any time in Settings › Usage analytics (app) or in Cookie preferences at the bottom of the website. Each provider processes data under its own policies (Hotjar, Microsoft, Google, Meta).

9. Your rights

Under Law No. 21,719 you have the right to:

• Access: know which of your data we process.
• Rectification: correct inaccurate data (you can do it directly in the app).
• Erasure: delete your data; you can delete your account from the app.
• Objection: object to certain processing, such as measurement.
• Portability: receive your data in a structured format; you can export your transactions to Excel or CSV from the web version, and ask us by email for a full copy.
• Blocking: request the temporary suspension of processing while a request is resolved.
• Withdraw your consent at any time, without affecting processing carried out before.

To exercise these rights, write to walpliapp@gmail.com. We will respond within the deadlines set by law. If you believe we did not address your request, you can file a complaint with Chile's Personal Data Protection Agency.

10. Data retention and deletion

• We keep your data while your account is active.
• When you delete your account we permanently delete your profile, your photo, your personal spaces with all their data, your bot links and your email records.
• If you owned a shared space, that space is deleted with all its data (also for its members). If you were a member of someone else's space, the transactions you recorded there are kept for the others, no longer linked to your account.
• Payment records are kept, no longer linked to your account, as long as needed to meet legal obligations and resolve disputes; and if your email bounced or you marked an email as spam, we keep it on an exclusion list so we don't write to you again.
• Bot conversation memory is deleted automatically after ~2 hours.

11. International transfers

Some of our providers (for example OpenAI, Resend or the analytics tools) process data outside Chile, mainly in the United States. These transfers are made with providers that offer adequate protection safeguards through their terms and data processing agreements.

12. Minors

Walpli is not intended for children under 14. If we learn that a child under 14 provided data without the authorization of a parent or legal guardian, we will delete it.

13. Changes to this policy

We may update this policy. We will publish the new version on walpli.com with its effective date and, if the changes are significant, we will notify you by email or in the app before they apply.

14. Data controller and contact

The controller of your data is Tecniforce, the company that develops and operates Walpli. For any question about privacy or data protection, write to us at walpliapp@gmail.com.