Privacy Policy

1. Information we collect

We collect only the information necessary to operate Walpli.

Information when you sign up

• Email.
• Password (hashed via Supabase Auth, never stored in plain text).
• Name (optional).
• Time zone (detected automatically from the browser).

Financial data created by the user

• Accounts (name, type, balance, currency, color, icon, favorite).
• Transactions (type: income/expense, amount, payee, description, date, time, category, subcategory, associated account).
• Custom categories and subcategories.
• Budgets.
• Automatic or recurring payments.
• Transaction templates.
• Pending items to collect or pay.
• Display order and preferences.

Configuration data and preferences

• Default currency.
• Date format.
• Visual theme (light/dark) and accent color.
• Configured time zone.
• Onboarding status.
• Preferences saved in localStorage or on the server.

Optional integration data

• Telegram: Chat ID and linking date (we do not store name or profile photo).
• WhatsApp (via Twilio): phone number in international format and linking date.

Data processed by AI

• Messages sent to the @walplibot bot.
• Limited financial context (account names, categories and recent transactions).

Walpli does not connect to banks and does not store credit card data. AI messages are processed in real time through the OpenAI API (GPT-4o model) and are not stored permanently.

2. How we use the information

We use your data to:

• Provide the financial management service.
• Interpret instructions sent to the bot.
• Improve stability and performance.
• Ensure security.
• Comply with legal obligations.

We do not use your data for external advertising or marketing.

3. Legal basis for processing

We process your data under the following legal bases:

• Performance of a contract: to operate Walpli as requested by the user.
• Consent: when you enable integrations such as the AI bot.
• Legitimate interest: for security, fraud prevention and technical improvements.
• Legal compliance: when required by law.

This complies with the standards of the GDPR (EU), CCPA (California) and Chile's Law 19.628.

4. Storage and infrastructure

Walpli uses:

• Supabase (AWS) for hosting, authentication and PostgreSQL database.
• Supabase Auth (JWT and secure sessions).
• Supabase Edge Functions (Deno runtime).
• React SPA hosted on Cloudflare infrastructure.

Official apps in transit (HTTPS/TLS), signed JWT tokens, restricted database access and the principle of least privilege.

5. Sharing with third parties

We only share data with providers necessary to operate and improve the service:

• OpenAI (AI processing).
• Supabase (hosting and database).
• Telegram Bot API.
• Hotjar and Microsoft Clarity (usage and experience analytics).
• Meta Platforms (advertising campaign measurement via Meta Pixel).

These providers process data under their own security and privacy policies and their processing agreements. Walpli does not sell or trade personal data. More detail about the measurement and advertising tools in the Cookies, analytics and measurement section.

6. Processing of data by artificial intelligence

When you use the bot:

• Messages are sent to the OpenAI API for interpretation.
• OpenAI does not use these API submissions to train its models.
• The processing is automated and, except for legal or credit decisions.
• Walpli does not perform automated financial profiling for risk assessment.

The AI only interprets text to record transactions.

7. Optional integrations

The integrations with Telegram and WhatsApp are voluntary. You can:

• Link or unlink at any time.
• Revoke permissions from the settings.
• Completely delete the associated data when you close your account.

8. Cookies, analytics and measurement

To operate the service, Walpli uses:

• localStorage for visual preferences and session.
• Technical cookies necessary for authentication.

To understand how Walpli is used and to improve its design and experience, we use third-party measurement tools on our web properties:

• Hotjar and Microsoft Clarity: record, in aggregate, how users interact with the interface (clicks, scrolling, heatmaps and session recordings, without capturing sensitive financial data). We use them exclusively to evaluate and improve Walpli's design.
• Meta Pixel: measures the effectiveness of our advertising campaigns and shares usage data with Meta Platforms for that purpose.

Each tool processes the data under its own security and privacy policies (Hotjar, Microsoft, Meta). This data is used solely to measure and improve Walpli —and, in the case of Meta Pixel, to measure advertising—; we do not sell it or share it with third parties for other purposes. You can limit this tracking from your browser settings or each provider's opt-out options.

9. User rights

You have the right to:

• Access all of your data.
• Modify any personal information.
• Export data in CSV format.
• Delete your account and all associated data.
• Unlink integrations.
• Request a structured copy of your data.

To exercise these rights, write to walpliapp@gmail.com.

10. Data retention and deletion

• We keep the data while your account is active.
• When you delete your account, all associated data is permanently deleted.
• Automatic backups are purged according to internal technical policies.

11. International transfers

Since we use global infrastructure (AWS, OpenAI), data may be transferred outside Chile.

These transfers are carried out under adequate data protection standards and processing contracts in accordance with the GDPR.

12. Minors

Walpli is available to people over 13 years of age.

If we detect that a minor provided data without valid authorization where required by law, we will proceed to delete it.

13. Changes to this policy

We may update this policy when necessary.

We will publish the new version on walpli.com with the date of the update indicated. Continued use of the service implies acceptance of the changes.

14. Contact

For any question related to privacy or data protection, write to us at walpliapp@gmail.com.

If you have any questions about our privacy policy, please do not hesitate to contact us.