Data Processing Policy — Clara

1. Data Controller

Luis Pinilla. Email: privacy@clara.app.

2. Data We Collect

Local data on your device (never leaves your phone): transactions, accounts, budgets, categories, receipts. Stored in a local SQLite database. Cloud data (only if you create a Clara account): email address (Supabase Auth), opaque device and installation identifiers. If you opt into detailed auditing: email, device model, app version, platform. Retention: 6 months. Infrastructure provider: Supabase Inc. Region: AWS South America (São Paulo). Standard contractual clauses from the Supabase DPA apply.

3. Purpose

Provide the service: record transactions, enforce AI limits. Support: correlate failures per user when detailed auditing is enabled. Compliance with legal obligations.

4. Legal Basis (Law 1581 of 2012, Colombia)

Performance of the contract (art. 6.b). Express consent (art. 6.a) for detailed auditing.

6. International Transfers

Supabase processes data in AWS São Paulo. No transfers are made to third parties outside the infrastructure provider.

7. Data Subject Rights (art. 17, Law 1581)

Know, update, and correct your data. Request proof of the consent granted. Be informed about the use of your data. File complaints before the Superintendencia de Industria y Comercio. Revoke consent and/or request deletion of your data. To exercise any of these rights, write to privacy@clara.app.

8. Minors

Clara is not intended for users under 18. We do not knowingly collect data from minors.

9. Changes to This Policy

Any change is published at this same URL. The "Last updated" date reflects the current version.

5. Retention