Skip to content
PlanDos

Privacy policy

Last updated: 16 October 2026

This policy explains what personal data PlanDos processes, why, for how long and how you can exercise your rights, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).

1. Data controller

Controller: Arturo Puentes. Contact for any privacy matter: hola@plandos.app. Further identification details in the Legal notice.

2. What data we process

  • Account data: your email address, your password, the language you choose, the date you signed up and the date of your last sign-in. Your password is stored transformed by an irreversible hash function: nobody, including us, can read it. If you sign in with Google you have no password on PlanDos.
  • Plan data: the figures you choose to enter (income, rent, expenses, car price, assumptions about the home and the baby) and what you log as saved each month.
  • Shared household data: the email addresses of the members of your household and, if you invite your partner, the email address the invitation is sent to.
  • Acceptance record: the version of the Terms and of this policy that you accepted, and the date.
  • Technical data: IP address, browser type and access logs generated automatically by our hosting providers for security and operational reasons.

We do not ask for health data or any other special category of data. The figures about the baby are financial assumptions that you decide; please do not enter medical information in the app.

3. Why we use them and on what legal basis

  • Providing the service (creating your account, saving and calculating your plan, sharing it with your partner): performance of the contract you accept with the Terms of use (art. 6.1.b GDPR).
  • Sending you account emails (sign-up confirmation, password recovery, change of email) and essential service notices (for example, changes to these texts): performance of the contract (art. 6.1.b GDPR).
  • Keeping the service secure and preventing abuse through technical logs: legitimate interest (art. 6.1.f GDPR).
  • Keeping proof that you accepted the Terms and this policy: compliance with legal obligations and defence against claims (art. 6.1.c and 6.1.f GDPR).
  • Non-essential cookies: we do not use any today. If any are added in the future, they will only be enabled with your consent (art. 6.1.a GDPR and art. 22.2 LSSI-CE). See the Cookie policy.

We do not sell your data, we do not use it for advertising, we do not build commercial profiles and we do not take automated decisions that have legal effects on you.

4. Who it is shared with

Your partner: the people who belong to your household see the plan, the monthly log and the members' email addresses. If you invite someone, you confirm that they have allowed you to give us their email address.

Providers that process data on our behalf (processors), under contracts that comply with art. 28 GDPR:

  • Supabase, Inc.: database, authentication and sending of account emails. The data is hosted on servers in the European Union (Ireland).
  • Vercel, Inc.: hosting and delivery of the website, including technical access logs.
  • Cloudflare, Inc. (Turnstile): anti-bot check on the sign-up and sign-in screens. It receives technical data from your browser, such as your IP address, to tell people apart from automated programs.

If you choose “Continue with Google”, Google LLC identifies your account and gives us your email address (and, depending on your Google settings, your name). Google acts as controller of its own processing, under its privacy policy. If you do not use that button, Google receives no data about you through PlanDos.

Supabase, Vercel, Cloudflare and Google are based in the United States, so there may be international transfers of data. These are covered by the EU-US Data Privacy Framework and/or the standard contractual clauses approved by the European Commission.

We will only disclose data to authorities when the law requires us to.

5. How long we keep them

  • Account, plan and household data: for as long as your account is open.
  • Invitations: until they are accepted, cancelled, or the account that created them is deleted.
  • Technical logs: the limited period each provider applies for security.

If you delete your account, we erase your data immediately. If you shared the household with your partner, the joint plan remains available to them, because it is theirs too; your email address and your access are removed. The providers' backups are overwritten in their usual cycles.

6. Your rights

You can exercise at any time your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you have given:

  • From the app, under Account: download all your data in a file (access and portability) or delete your account (erasure).
  • By writing to hola@plandos.app from your account's email address. We will reply within one month at most.

If you feel we have not handled your request properly, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the data protection authority of the country where you live.

7. Minimum age

PlanDos is intended for people aged 18 or over. We do not knowingly create accounts for minors.

8. Security

The connection is encrypted (HTTPS) and the database applies row-level access rules so that each person only sees their own household's data. No system is infallible: if we detect a breach affecting your data, we will report it as the GDPR requires.

9. Changes to this policy

If we change anything important, we will show it to you when you open the app and ask you to accept the new version before you continue using it.