1. Who is responsible for your data
The controller of your personal data is the owner of HomeFinance (homefinance.coach):
- Owner: [name or company, pending]
- Tax ID (NIF/CIF): [pending]
- Address: [pending]
- Email: alberto@homefinance.coach
Because of the size and nature of our activity, we have not appointed a Data Protection Officer. Write to the email above for anything related to your data.
2. What data we collect, why, and for how long
| Data | Purpose | Legal basis | How long |
|---|---|---|---|
| Account: email, name, password (encrypted), language, timezone, profile photo, two-factor settings | To create and run your account | Contract | While your account exists; deleted at once when you delete your account |
| HomeFinance App connection: API keys (stored encrypted) and the app features enabled for you | To link the app on your computer to your account | Contract | Until you revoke the key or close your account |
| Investment plan built with the assistant: your answers, chosen funds and brokers, progress | To guide you step by step and keep your plan | Contract | While your account exists |
| Bank statements you upload to the File Converter | To convert them into a standard file for you | Contract | Deleted when you download the result, or after 30 minutes at the latest |
| Bank formats you save in the File Converter: column names and formats, never transactions | To apply them to your next files | Contract | Until you delete them or your account |
| File Converter usage: date and number of rows converted, never the content | To understand how the tool is used | Legitimate interest | While your account exists; afterwards kept without any link to you |
| Records of the terms you accepted and the consents you gave: version, date and shortened IP address When you delete your account, these records are no longer linked to it: instead they keep a scrambled code made from your email address (a keyed hash), from which your address cannot be read. It only lets us find them if you, or an authority, ask about them later. | To be able to prove what you accepted | Legal obligation and legitimate interest | Up to 2 years after your account is deleted or the consent is withdrawn |
| Newsletter: email, and name if you give it | To send you the newsletter and workshop invitations | Your consent | Until you unsubscribe |
| Analytics with cookies: pages visited, device and browser, a pseudonymous identifier | To understand how the site is used and improve it | Your consent (cookie settings) | 12 months |
| Basic page-view statistics without cookies: page, date, browser type | To count visits to our pages | Legitimate interest | 12 months |
| Account activity log: sign-ups, sign-ins, email verification, app connections, subscription changes, with their date | To keep the service secure and understand how it is used | Legitimate interest | 12 months |
| Security and error logs: IP address, browser, the error that occurred | To keep the service secure and fix problems | Legitimate interest | 90 days |
| Blog comments: name, email (never published) and text | To publish your comment and reply to you | Your consent | Until the comment is removed |
| Emails you send us | To answer you | Legitimate interest | 2 years |
| Payments, if paid plans are offered: billing details (card data is handled only by Stripe) | To charge for the service and issue invoices | Contract and legal obligation | 6 years for invoices (Spanish tax law) |
3. What we do not do
- The HomeFinance App stores your financial data (accounts, transactions, budgets, investments) only on your computer. The app connects to our servers only to link your account and to download reference data such as currencies, exchange rates and market prices.
- We do not sell or rent your data, and we do not use it to build advertising profiles.
- We do not use artificial intelligence to process your personal data, and we do not make automated decisions about you.
4. Who we share data with
We use the following providers, who process data only on our behalf and under a data processing agreement:
- Render (Frankfurt, EU): hosting of the website and its database.
- Cloudflare: domain, protection against attacks, the anti-bot check on the sign-up form, and storage of profile photos.
- Our email provider: sending account emails (confirmations, password resets).
- Mailchimp: the newsletter, only if you subscribe.
- PostHog (EU): analytics, only if you accept analytics cookies.
- Sentry (EU): error monitoring.
- Stripe: payments, if paid plans are offered.
When you book a session through TidyCal or download the HomeFinance App from GitHub, those services receive the data you give them (or your IP address) under their own privacy policies. We only share data with authorities when the law requires it.
5. International transfers
Our servers and most of our providers are in the European Union. Mailchimp and Cloudflare may process data in the United States; they are certified under the EU-US Data Privacy Framework and also sign the European Commission's standard contractual clauses.
6. Your rights
You can access your data, correct it, delete it, receive a copy in a portable format, object to or restrict its processing, and withdraw any consent at any time, without affecting what was done before.
- Most of your data can be viewed and changed in your profile. You can revoke API keys there too.
- In the “Your data” tab of your profile you can download a copy of your data and delete your account yourself, at any time.
- Every newsletter includes a link to unsubscribe.
- For anything else, write to alberto@homefinance.coach. We answer within one month.
If you think we have not handled your data correctly, you can complain to the Spanish Data Protection Agency (AEPD, www.aepd.es).
7. Cookies
Cookies are small files that a website stores in your browser. We use the ones that the site needs to work and to remember your preferences. Analytics cookies are only used if you accept them; you can change your choice at any time from the cookie settings.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| sessionid | Necessary | Keeps you signed in | 2 weeks |
| csrftoken | Necessary | Protects forms against forgery | 1 year |
| hf_consent | Necessary | Remembers your cookie choice | 6 months |
| messages | Necessary | Shows confirmation messages after an action | Session |
| homefinance_web_language | Preferences | Remembers your language | Session |
| theme | Preferences | Remembers light or dark mode (also kept in your browser's local storage) | 1 year |
| ph_* | Analytics (only with consent) | PostHog analytics | 1 year |
8. Minimum age
Our services are for people aged 18 or over. We do not knowingly collect data from minors; if we find out we have, we delete it.
9. Security
All connections use HTTPS, passwords and API keys are stored encrypted, two-factor authentication is available, and access to the systems is limited. If a security breach puts your data at risk, we will notify the AEPD within 72 hours and tell you when the law requires it.
10. Changes to this policy
We may update this policy. The date and version at the top of this page show the current text. If a change is significant, we will tell registered users by email.
See also our legal notice and terms of use. For any question about your privacy, write to alberto@homefinance.coach.