Privacy Policy

At Finex we handle your personal data on a simple principle: we collect only what we need to give you a useful financial plan, we never sell your data to anyone, and you can delete it yourself from inside the app whenever you want.

This policy explains what data we process, what for, on what legal basis, and what rights you have, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD).

1. Data controller

• Controller: Brava AM Solutions SL
• Tax ID (NRT): NRT L-717603-E (company incorporated in Andorra)
• Registered address: Carrer del Clos 1, casa 2A, AD300 Ordino, Andorra
• Data protection contact: hola@finex-app.com
• Service: the Finex app and website

The controller is established in Andorra. The GDPR applies to this processing because the service is offered to people living in the European Union (Article 3(2) GDPR), together with Andorra's Llei 29/2021 on personal data protection. You may lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) or with the Andorran Data Protection Agency (APDA, www.apda.ad).

We are not required to appoint a Data Protection Officer, so you can send any privacy question straight to the address above.

2. What data we process

• Account data: your email address, your password (stored encrypted, we can never read it) and the language you use the app in.
• Financial data you enter voluntarily: income, expenses, savings, debts, details of your mortgage and the financial goals you set yourself. You decide whether to provide them: you can use Finex without filling them in, although the recommendations and calculations will then be far less accurate.
• Mortgage review request data: if you choose to request one, your full name, phone number, email address and details of the property and the operation (amount, property value, term, employment status).
• Technical usage data: IP address, browser and device type, pages viewed, date and time of access, and clicks on links to partner providers.

We do not process special categories of data (health, beliefs, ethnic origin and the like), and we never ask for bank details, card numbers or your online banking credentials: Finex does not connect to your bank accounts and does not read your transactions.

3. Why we use your data and on what legal basis

• Creating and managing your account, signing you in and giving you access to the service. Legal basis: performance of the contract you accept when you register (Art. 6(1)(b) GDPR).
• Working out your financial health level, building your action plan and pre-filling the calculators with your figures. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
• Sending you operational emails (sign-up confirmation, password reset, mortgage request confirmation). Legal basis: performance of the contract (Art. 6(1)(b) GDPR). These are not marketing messages and cannot be switched off without closing your account, because they are part of the service.
• Passing your mortgage review request to our partner broker (Gibobs). Legal basis: your explicit consent (Art. 6(1)(a) GDPR), given through a separate tick box on the form, which you can withdraw at any point before the request is sent by deleting the draft.
• Keeping the service secure, preventing abuse, detecting fraud and fixing bugs. Legal basis: our legitimate interest in protecting the app and its users (Art. 6(1)(f) GDPR).
• Measuring, in aggregate, which pages and features are used, including clicks on partner links. Legal basis: our legitimate interest in understanding and improving the service and in settling commissions with partner providers (Art. 6(1)(f) GDPR). This measurement is done without cookies and without advertising identifiers.
• Complying with legal obligations (tax, accounting and responding to requests from public authorities). Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR).

We do not build advertising profiles and we do not make automated decisions producing legal effects concerning you. The financial level and the recommendations you see are an informational calculation: they decide nothing on your behalf and are not shared with any provider.

4. Who we share your data with

We do not sell or share your data with third parties for advertising purposes. The only parties with access are the providers we need in order to run the service, acting as processors under a data processing agreement pursuant to Article 28 GDPR:

• Hosting provider (Heroku, by Salesforce, Inc.): hosts the application and the database. The servers we use are located in the European Union (Ireland region).
• Transactional email provider: delivers the service's operational emails. It processes your email address and the contents of the message.
• Cookieless analytics provider: measures aggregate use of the app without setting cookies or creating persistent user identifiers.

In specific situations, your data may also reach:

• Gibobs allbanks (partner mortgage broker): only if you request a mortgage review and explicitly authorise the transfer. In that case we send them the details from the form, and Gibobs then processes that data as a controller in its own right, under its own privacy policy, in order to contact you and handle your request. Without that consent, nothing is shared.
• YouTube (Google Ireland Ltd.): videos are embedded in no-cookie mode (the youtube-nocookie.com domain). YouTube only receives data about you if you press play; from that point on its own privacy policy applies as well.
• Public authorities, courts and law enforcement, where we are legally required to provide the information.

5. International data transfers

As a rule no international transfers take place: your data is hosted on servers located within the European Union. Should any of our providers process data outside the European Economic Area (for example, for technical support), the transfer relies on an adequacy decision of the European Commission or, failing that, on the standard contractual clauses approved by the Commission, together with any additional safeguards required. You can ask us for a copy of these safeguards by writing to hola@finex-app.com.

6. How long we keep your data

• Account and financial data: for as long as your account exists, since it is what keeps your plan and your history alive.
• After you delete your account: data is erased within a maximum of 30 days, including backups as they are rotated out.
• Mortgage review requests: 12 months from submission, so that we can evidence what was done and handle any complaint.
• Technical logs and IP addresses: 90 days.
• Data we are legally required to keep (invoicing, for instance): for the periods set by tax and commercial law, blocked and accessible only to answer official requests.

7. Your rights

As the owner of the data, you can exercise the following rights at any time:

• Access: find out what data of yours we process and get a copy of it.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data (the "right to be forgotten").
• Objection: object to processing based on our legitimate interest.
• Restriction: ask us to suspend processing while a complaint is resolved or the accuracy of your data is verified.
• Portability: receive your data in a structured, commonly used format, or have us send it to another controller where technically feasible.
• Withdrawal of consent: withdraw at any time the consent you have given us (for example, to send your details to the mortgage broker), without affecting the lawfulness of processing carried out before the withdrawal.

8. How to exercise your rights

Many of these rights you can exercise yourself, instantly, from within the app: edit your personal and financial details from your profile, or delete your entire account under Settings > Delete account.

For everything else, write to hola@finex-app.com stating which right you wish to exercise, from the email address linked to your account (we may ask for further information if we need to verify your identity). We will reply within a maximum of one month of receiving your request, extendable by a further two months if the request is particularly complex, in which case we will let you know within the first month.

If you believe we have not handled your request properly, or that we are processing your data unlawfully, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es), which is the competent supervisory authority.

9. Minors

Finex is not intended for anyone under 18. By registering you declare that you are 18 or older. If we find that an account belongs to a minor, we will delete it along with its data. If you are a parent or guardian and believe a minor in your care has created an account, write to hola@finex-app.com and we will close it.

10. Deleting your account

You can delete your account at any time, free of charge, from the app itself under Settings > Delete account. Deletion removes your profile, your financial data, your goals and your mortgage requests within a maximum of 30 days, except for any data we are legally required to keep. You can also ask us to delete it by email if you would rather we did it for you.

11. Cookies and similar technologies

Finex uses the bare minimum:

• A technical session cookie (_finex_session): keeps you signed in and protects forms against CSRF attacks. It lasts up to 6 months and is necessary for the app to work.
• A language preference: remembers whether you use the app in Spanish or English.

Both are technical or personalisation cookies requested by you and are exempt from prior consent under Article 22(2) of Spanish Law 34/2002 (LSSI-CE), which is why we do not show a cookie banner.

We use no advertising cookies, no third-party cookies and no tracking pixels. Usage analytics run without cookies and without persistent identifiers, producing aggregate statistics only. Videos are embedded in no-cookie mode: until you press play, YouTube sets no tracking cookies on your device. You can block or delete cookies from your browser settings, although blocking the session cookie will stop you from signing in.

12. Security

We apply appropriate technical and organisational measures to protect your data: traffic encrypted over HTTPS, passwords stored as hashes, restricted database access and regular backups. No system is infallible, but should a security breach occur that poses a high risk to your rights, we would notify you without undue delay and report it to the Spanish Data Protection Agency.

13. Changes to this policy

We may update this policy to reflect legal changes or new features. The version in force will always be published on this page, with its update date. If a change is significant, we will tell you inside the app or by email before it takes effect.

14. Contact

For any question about this policy or about how we handle your data, write to hola@finex-app.com.