Privacy Policy

Last updated: 26 April 2026

This Privacy Policy describes how Luis Francisco Soria Labaña (the “Controller”) collects, uses and protects the personal information of users of the website luisfranciscosoria.es and the mobile application PAI — Plan de Ahorro e Inversión (the “Service”).

1. Data Controller

2. Personal data we process

Depending on your interaction with the Service, we may process the following categories of data:

2.1 Account data

  • Email address
  • Password (stored as a bcrypt hash; never in plain text)
  • Technical session identifiers and authentication tokens (stored as SHA-256 hashes)

2.2 Financial data entered by the user

  • Income, expenses, savings, debts and savings challenges you choose to record
  • Configuration of your monthly and annual plans
  • Financial Health Index calculated from the data above

You enter this data voluntarily and we use it solely to provide the Service.

2.3 Banking data via Open Banking (optional)

If you voluntarily activate the connection with your bank through the provider Salt Edge Limited, the data of the accounts and transactions you authorise will be processed. This connection takes place under the framework regulated by PSD2 (the European Payment Services Directive) and you may revoke it at any time.

2.4 Purchase data

If you purchase the Premium version of the Service, the WooCommerce platform processes your order and the enabled payment gateways (WooPayments —Stripe-based— and PayPal) process your payment data. The Controller does not store or have access to the full data of your card or payment method.

2.5 Technical data

  • IP address and basic browsing data (server logs)
  • Device type and operating system when you use the PAI mobile app

3. Purposes and legal basis for processing

Purpose Legal basis
Create and maintain your user account Performance of a contract (Art. 6.1.b GDPR)
Provide the financial management features Performance of a contract
Process your purchase of the Premium version Performance of a contract
Connection with your bank via Salt Edge Explicit consent (Art. 6.1.a GDPR)
Sending operational communications (password recovery, order confirmation) Performance of a contract
Compliance with legal obligations (tax, accounting) Legal obligation (Art. 6.1.c GDPR)
Fraud prevention and system security Legitimate interest (Art. 6.1.f GDPR)

4. Minimum age

The Service is intended exclusively for persons over 18 years of age. We do not knowingly collect data from minors. If we detect that a minor has registered, we will delete the account and the associated data.

5. Recipients and processors

To provide the Service we share data only with the following providers, all of which offer adequate data protection guarantees:

  • Webempresa Europa S.L. (hosting and SMTP email provider for luisfranciscosoria.es): servers located in the European Union. Used both for storing the Service data and for sending operational emails.
  • WooPayments (operated by Automattic Inc., with Stripe Payments Europe Ltd. as a sub-processor) and PayPal (Europe) S.à r.l. et Cie, S.C.A.: payment gateways used to process Premium purchases. These entities process payment data directly; the Controller does not store full card data.
  • Salt Edge Limited (United Kingdom): only if you activate the connection with your bank. Salt Edge acts as a regulated account information service provider under PSD2.
  • Apple Inc. and Google LLC: as operators of the App Store and Google Play stores where the PAI app is distributed. These companies apply their own privacy policies.

We do not sell or transfer your personal data to third parties for commercial purposes.

6. International data transfers

Some providers (Salt Edge, Apple, Google) may process data outside the European Economic Area. In those cases, transfers are made under the standard contractual clauses approved by the European Commission or under valid adequacy decisions.

7. Retention periods

  • User account and financial data: as long as you keep your account active.
  • Authentication tokens: automatically purged after 90 days of inactivity.
  • Billing data: retained for the period required by tax and commercial regulations (up to 6 years).
  • Data after account deletion: effectively erased within a maximum of 30 days from the request, except where there is a legal obligation to keep them.

8. Your rights

As a data subject, you may exercise the following rights at any time:

  • Access: know what data we process about you.
  • Rectification: correct inaccurate data.
  • Erasure (“right to be forgotten”): delete your data. The PAI app lets you delete your account and all associated data directly from the “Me → Delete account” screen.
  • Objection and restriction: object to processing or request its restriction.
  • Portability: receive your data in a structured, commonly used format.
  • Withdraw consent previously given, without affecting the lawfulness of prior processing.

To exercise them, send an email to privacidad@luisfranciscosoria.es stating the right you wish to exercise and attaching a copy of a document that proves your identity.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you believe the processing does not comply with applicable law.

9. Data security

We apply reasonable technical and organisational measures to protect your data: encryption in transit (HTTPS/TLS), passwords stored as bcrypt hashes, session tokens hashed with SHA-256, periodic backups and access controls on the server.

10. Cookies

The use of cookies on the website is governed by our Cookies Policy. The PAI mobile app does not use cookies; it uses the device’s native secure storage (Keychain on iOS, Keystore on Android) to store the session token.

11. Changes to this policy

We may update this Privacy Policy when necessary. The current version will always be the one published on this page, with its last update date. If changes are substantial we will notify you by email or through a prominent notice in the Service.

12. Contact

If you have any questions about this Privacy Policy or about the processing of your data, please contact us at privacidad@luisfranciscosoria.es.

Scroll al inicio