# Privacy Policy

## 1. What personal data do we collect?

DeLey collects the following data:

- **Identification data:** name, email address
- **Financial data:** imported bank transactions (date, description, amount, category)
- **Usage data:** app interactions, AI queries
- **Technical data:** IP address, browser type, session cookies

## 2. What do we use your data for?

Personal data is processed to:

- Provide the personal finance management service
- Automatically classify transactions via AI
- Generate personalized financial analysis and insights
- Generate aggregated, anonymized statistics on usage patterns (e.g. spending trends, most-used merchants or financial institutions)
- Improve service quality
- Comply with applicable legal obligations

## 3. What is the legal basis for processing your data?

Data processing is based on:

- **Consent:** express acceptance of the Terms and Privacy Policy
- **Contract performance:** providing the service requested by the user
- **Legitimate interest:** service improvement and fraud prevention

## 4. Do we share your data with third parties?

DeLey uses artificial intelligence service providers (Groq) for natural language processing. Transactions are sent **without personally identifying data** (name, email, account number). Only transaction descriptions and amounts are sent for classification.

Personal data is not sold, rented, or shared with third parties for commercial purposes.

**Aggregated, anonymized statistical data.** DeLey may generate, use, and, in the future, share or commercialize aggregated statistical information derived from platform usage (for example: "34% of DeLey users spend more on Delivery than on Groceries", "Diners Club is the most-used card for Entertainment spending among DeLey users", or "the most frequented merchants in the 'Eating out' category nationwide"). This information is processed in a way that **does not identify, directly or indirectly, any particular user**, and is only generated from a number of users sufficient to prevent individual re-identification. This data is not considered personal data under Ecuador's Organic Law on Personal Data Protection, since it does not allow the information to be associated with an identified or identifiable person.

## 5. How long do we keep your data?

Data is retained while the user maintains an active account. After account deletion, data will be removed from our databases within a maximum of 30 days, unless retention is required by legal obligation.

## 6. What rights do you have over your data?

Under Ecuador's Organic Law on Personal Data Protection, the user has the right to:

- **Access:** know what personal data we hold
- **Rectification:** request correction of inaccurate data
- **Erasure:** request deletion of their personal data
- **Objection:** object to the processing of their data in certain cases
- **Portability:** request a copy of their data in a structured format

To exercise these rights, contact [hola@de-ley.com](mailto:hola@de-ley.com). We will respond within a maximum of 15 business days.

## 7. How do we protect your data?

We implement appropriate technical and organizational measures to protect personal data:

- Password encryption using secure algorithms
- Encrypted communications (HTTPS/TLS)
- Restricted data access by authorized personnel
- Auditing of access and actions on data
- Encryption at rest for the database

## 8. Do we use cookies?

DeLey uses session cookies to maintain user authentication. We also use local storage (localStorage) for app preferences such as onboarding status and visual theme. We do not use tracking or advertising cookies.

## 9. How do you contact us?

For inquiries about this privacy policy, to exercise your rights, or to file a complaint:

Email: [hola@de-ley.com](mailto:hola@de-ley.com)