Presta2 · Privacy

Presta2 Privacy Policy

Last updated: 12 October 2026

This policy describes how Kitusoft ("we") collect, use and protect the information we process when you use the Presta2 application ("the App"). It is written to comply with the European Union's General Data Protection Regulation (GDPR), Ecuador's Organic Law on the Protection of Personal Data (LOPDP, 2021), Brazil's Lei Geral de Proteção de Dados (LGPD), the California Consumer Privacy Act (CCPA/CPRA), the United States Children's Online Privacy Protection Act (COPPA), and the "Data safety" requirements of Google Play and Apple's App Store "App Privacy".

1. Who is the data controller

Kitusoft (Cesar J. Santacruz), based in Quito, Ecuador. Contact for any privacy matter: soporte@kitusoft.com.

We are not required to appoint a Data Protection Officer under Article 37 GDPR, but we receive and resolve rights requests at that same address.

2. Quick summary

  • Presta2 requires an account. Unlike some of our other apps there is no local mode: your records sync to Google Firebase so they are available across your devices and survive a change of phone.
  • You store your own records (what you lent, to whom, how much) and other people's data (the contacts you lend to). Section 5 explains your responsibility for that third-party data.
  • Presta2 does not move money. It is not a financial institution, does not process payments, does not collect debts and does not report to any credit bureau. The amounts you see are your own notes, like in a paper notebook.
  • We do not sell your information. We do not use advertising or behavioural trackers today.
  • Access to your address book is optional and only happens when you tap "Sync from phone".
  • The App never contacts anyone on your behalf. Calling or texting a contact, sending them a reminder or exporting your data opens other apps on your phone, and whatever is sent, you send yourself (section 3.7).
  • You can delete your account and all your data from inside the App, without writing to us.

3. What data we process

3.1 Account data

In Firebase Authentication:

| Category | Specific data | Source | |---|---|---| | Identification | Unique identifier (UID) | Generated by Firebase | | Sign-in method | Email address, phone number, or Google identity, whichever you choose | You, or Google OAuth | | Credentials | Password, stored encrypted by Firebase. We never see it in plain text | You | | Profile | Display name and profile picture (optional) | You |

You can link several sign-in methods to the same account (for example email + Google) and unlink them, as long as at least one remains.

3.2 Your records

In Cloud Firestore, under your user identifier and accessible only by you:

| Category | Specific data | |---|---| | Loans and borrowings | Description of what was lent, amount (optional), currency, tags, status, direction (lent / borrowed), date, due date, whether it recurs and how often, notes, whether it is pinned, its colour and the date of its reminder (if you set one) | | Payment ledger | Every partial payment you record: amount, date and, if you write one, a note | | Your own tags | Name and the properties they enable (monetary, text, has due date, recurring) | | Trash | Records you delete are marked as deleted for 30 days so you can restore them; after that they are removed automatically |

Notes on a loan and on each payment are free text that you write. They are stored in your account in Cloud Firestore like the rest of the record, only you can read them, and they are deleted with the record or with your account. We ask the same as in section 5: do not use them for other people's sensitive data.

3.3 Your contacts' data (third-party data)

So the App can tell who you lent something to, it keeps its own address book with:

  • Name (required)
  • Phone, email, relationship ("sister", "work") and notes (all optional)

This data reaches the App in one of two ways: you type it in, or you import it from your phone's address book with the "Sync from phone" feature.

This is other people's information. See section 5 for what that means.

3.4 Profile picture

If you choose a picture it is uploaded to Firebase Storage at profile_photos/{your-identifier}.jpg. The download URL is attached to your account. Replacing the picture overwrites the file; deleting your account removes it.

3.5 Technical data

  • App Check token: the App proves to our backend that a request comes from a genuine installation of Presta2, using Google Play Integrity. This mechanism does not tell us who you are or what device you own, only whether the app is authentic. It exists to stop anyone from reaching the database with a tampered copy of the App.
  • Local preferences: theme (light/dark/system), language, currency and the rest of the App's settings (colour palette, reminders, list order and view) are stored on your device (SharedPreferences on Android, UserDefaults on iOS). They never reach our servers.
  • Android backup: if you have it turned on, Android may copy those preferences only to your Google account so they can be restored on a new phone. Google manages that copy in your account and we have no access to it. It does not include your records, your contacts, your session, pending reminders or the widget's contents: what matters is already in your Presta2 account.
  • Crash reports (Firebase Crashlytics): when the App closes unexpectedly or hits an error, we send Google a technical report. It contains the stack trace, the App version, the device model, the operating system version, the state of the device at that moment (free memory and storage, orientation) and an installation identifier generated by Crashlytics. It does not include your loans, your contacts, your email or your user id: we deliberately do not tie reports to your account. It exists so that we learn about a failure without waiting for someone to write to us, and can fix it. Since version 1.1 it also reports failures in the App's native code (the engine that draws the screen and the libraries it uses), with the same contents: the technical trace of the failure and the device data, without your records and without tying it to your account.

3.6 Operating-system permissions

  • Contacts (READ_CONTACTS): optional. Requested only when you tap "Sync from phone". We read the name, phone and email of your address-book entries in order to create contacts inside the App. We do not read your address book in the background, at launch, or on any schedule. If you never use that feature we never ask for the permission.
  • Photos / gallery: optional. Only when you pick a profile picture. The selected image is uploaded; we do not access the rest of your gallery.
  • Camera: optional. Only if you choose to take a profile picture on the spot.
  • Network / Internet: required. The App syncs with Firebase.
  • Notifications (POST_NOTIFICATIONS): optional. Only for reminders. Requested when you turn them on, after a line explaining why; if you decline, reminders stay off and the rest of the App works the same.
  • Phone start-up (RECEIVE_BOOT_COMPLETED): lets the App schedule your reminders again after the phone restarts. It gives access to no data.
  • We do not use the microphone, location, SMS, call log, calendar or body sensors. Calling or texting a contact opens your phone's own app and needs none of those permissions (section 3.7).

3.7 What happens only on your phone

Some features work with your data without sending it to our servers or anyone else's:

  • Reminders. They are local notifications the App schedules on your own phone; they go through no server. Each one shows the record's description, the person and the date, never an amount. If your phone is set to hide sensitive content on the lock screen, Android shows only "Presta2". The date of a reminder you set on a record is stored with that record in your account (section 3.2). When you sign out or delete your account, the App cancels the reminders on that phone.
  • Home screen widget. It shows what you are owed and what you owe and, in its list form, the description, person and amount of some records. The App hands it that data inside the phone itself, and it does not leave the phone. Bear in mind that anyone who sees your home screen can read it. When you sign out or delete your account, the widget is emptied.
  • Exporting your data (CSV). In Settings → Export my data (CSV) the App creates a spreadsheet on your phone with your records: type, contact name (without their phone or email), description, tags, dates, amounts, payments with their notes, record notes and status. It is built from the data the phone already holds, and Android's share menu opens so that you decide where to save it or who to share it with. Presta2 receives no copy. What happens to the file afterwards depends on the app or person you choose, and deleting your account does not delete it.
  • Calling, writing and reminding. From a contact's page you can call them or write to them by SMS, WhatsApp or email, and from a loan, "Remind" followed by their name drafts a friendly message with what is still pending. In every case the App only opens another app on your phone (the dialer, messages, WhatsApp, email or the share menu) with the number, address or text already filled in. You are the one who calls or sends, from that app: Presta2 sends nothing to the other person or to any third party. What you send is subject to the privacy policy of the app you use. The WhatsApp button opens a wa.me link with the contact's number; if WhatsApp is not installed, that link opens in the browser.

4. Why we use the data and on what legal basis

| Purpose | Data | Legal basis (GDPR Art. 6) | |---|---|---| | Create and maintain your account, authenticate you | Email/phone/Google, password, UID | Performance of a contract (Art. 6(1)(b)) | | Store and sync your loans, contacts and tags across devices | Records, contacts, tags, payments | Performance of a contract (Art. 6(1)(b)) | | Show you totals, balances and overdue warnings | Records and payments | Performance of a contract (Art. 6(1)(b)) | | Import contacts from your address book when you ask | Name, phone, email of your contacts | Consent (Art. 6(1)(a)), revocable in system settings | | Display your profile picture | Image | Consent (Art. 6(1)(a)) | | Prevent access from tampered copies of the App | App Check token | Legitimate interest (Art. 6(1)(f)) | | Handle support requests | Email, message | Legitimate interest (Art. 6(1)(f)) | | Comply with legal obligations | Any of the above | Legal obligation (Art. 6(1)(c)) |

5. Your responsibility for other people's data

Presta2 is by nature a notebook about third parties: the people you lend things to. Regarding that data:

  • You decide which contacts you keep and what information about them you write down. We process it on your behalf and following your instructions.
  • If you use Presta2 for purely personal or household purposes, GDPR does not impose controller obligations on you (Art. 2(2)(c), the "household exemption"). That covers the vast majority of users.
  • If you use Presta2 in a professional or commercial context (for example, to track your business's credit), you are the data controller for those people's data under the law, and we act as processor. In that case it is on you to have a legal basis for processing it, to inform them, and to honour their rights.
  • Do not record more than you need. Notes (on a loan, on each payment and on a contact) are free text; we ask you not to use it for other people's sensitive data (health, religion, sexual orientation, judicial matters).
  • If someone asks you to delete their data, you can do it yourself by removing that contact in the App. If that person writes to us directly at soporte@kitusoft.com we will help them locate and exercise their rights, though in many cases we will have to refer them to you, since you control that information.

6. Who accesses your data

  • Us (Kitusoft): only authorised personnel, and only when necessary for support or maintenance.
  • Google LLC (Firebase Authentication, Cloud Firestore, Firebase Storage, App Check, Firebase Crashlytics, Google Sign-In): as data processor. It hosts the database, the authentication and the files. Google Firebase is certified under the EU Standard Contractual Clauses (SCC) and participates in the EU-U.S. Data Privacy Framework.

Presta2 does not share your records with anyone else. There are no social features: nobody can see your loans or your contacts, and nobody is notified about a debt. We do not sell your information and we do not pass it to data brokers or advertising networks. We do not share it with credit bureaus or debt-collection companies.

When you share something from the App (a reminder for a contact, a CSV file), you send it from another app on your phone, to whoever you choose. Presta2 plays no part in that sending and receives no copy (section 3.7).

7. International transfers

Your data is stored on Google Cloud / Firebase infrastructure. The database's primary region is us-central1 (Iowa, United States), and Google may replicate the data to other regions for availability and backup.

This means that if you live in the European Union, Ecuador or Brazil, your data is transferred to the United States. These international transfers rely on the safeguards of the EU-U.S. Data Privacy Framework (in which Google LLC participates), the European Commission's Standard Contractual Clauses, and the equivalent clauses applicable under LGPD and LOPDP.

8. How long we keep your data

  • Account and content: for as long as your account is active.
  • Trash: records you delete are flagged as deleted and kept for 30 days so you can restore them from the Trash screen. After that they are removed automatically and permanently, with no action on your part. You can also delete them sooner yourself, and they go too if you delete your account. The automatic removal is carried out by Google Cloud infrastructure and is approximate: it normally happens within 24 hours of the date the app shows.
  • When you delete your account: we immediately remove your loans, contacts, tags, payment ledger (with its notes), profile picture and sign-in credentials. Provider backups may take up to 30 days to rotate out. On that phone, the App also cancels the reminders and empties the widget.
  • Local preferences: until you uninstall the App or clear its storage.
  • CSV files you export: we do not keep them because we never receive them. They stay wherever you save or send them, and you delete them.
  • Crash reports: Google Crashlytics keeps them for 90 days from receipt, then deletes them.
  • Support records (emails): up to 24 months, for request traceability.
  • Data required by legal obligation: for as long as the applicable law requires.

9. Your rights

Wherever you live, we guarantee you the following rights over your personal data:

  • Access: to know what data of yours we process.
  • Rectification: to correct inaccurate data (you can edit everything from the App).
  • Erasure ("right to be forgotten"): to ask us to delete your information.
  • Portability: to receive your data in a structured, machine-readable format. You can get a copy of your records yourself in Settings → Export my data (CSV).
  • Objection: to object to processing based on legitimate interest.
  • Restriction: to ask us to pause processing while a dispute is resolved.
  • Withdraw consent: for the address book and the profile picture, by revoking the permission in system settings, without affecting what was already done.
  • Not to be subject to automated decisions: Presta2 makes no automated decisions with legal effect on you. We compute no credit or solvency score of any kind.
  • To lodge a complaint: with your country's data protection authority (in Ecuador, the Superintendency for the Protection of Personal Data; in the EU, your national authority; in Brazil, the ANPD; in California, the Attorney General or the CPPA).

How to exercise them: write to soporte@kitusoft.com from the email associated with your account. We answer within the legal deadlines (30 days for GDPR, 15 days for Ecuador's LOPDP, 45 days for CCPA).

To delete your account and all your data there is a direct route inside the App, with no need to write to us: Settings → Delete account. The exact steps are at Delete your Presta2 account.

For California residents: you have the additional CCPA/CPRA rights, including the right to know what personal information we collect, to delete it, to correct it, to opt out of the "sale" or "sharing" of information (we do neither), and not to be discriminated against for exercising these rights.

10. Security

  • All communication between the App and our servers goes over HTTPS/TLS.
  • Passwords are stored encrypted by Firebase Authentication; we never have access to the plain-text password.
  • The Firestore and Storage security rules are written so that each user can only read and write their own data subtree. No path exists that lets one account see another's data.
  • App Check requires every request to come from a genuine Presta2 installation, which prevents the App's keys from being used by a tampered client.
  • Although we follow industry best practice, no system is 100% impenetrable. Should a security breach affecting your data occur, we will notify it as the law requires (within 72 hours to the relevant authorities under GDPR).

11. Children and young people

Presta2 is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe your child has sent us information, write to soporte@kitusoft.com and we will delete it.

If the user is between 13 and 18 (or the applicable digital age of consent in their country: 16 in the EU by default, 14 in Ecuador), we recommend that their parents or legal guardians review this policy and supervise use of the App.

12. Advertising and analytics

Presta2 shows no ads and uses no behavioural analytics services. We do not know which screens you open, how long you spend in the App or which buttons you tap.

The one thing we do use is Firebase Crashlytics, for crash reports (section 3.5). That is diagnostics, not analytics: something is only sent when the App fails, and the report is not tied to your account. It exists because without it the only signal that the App breaks on somebody's phone would be one-star reviews.

We reserve the right to add, in the future, third-party services for advertising (for example, Google AdMob), usage analytics or install attribution. If we do, we will update this policy before enabling them, state which providers we use and what data they share, and offer the consent mechanisms the applicable law requires (for example, consent forms for EU users under ePrivacy/GDPR before any advertising identifier, and Apple's ATT prompt on iOS). Under no circumstances will we use the content of your loans or your contacts' data for ad targeting.

13. Cookies and similar technologies

Presta2 is a native application and uses no cookies. It uses the operating system's local storage to keep your preferences, which is not accessible to other apps or to websites.

14. Third-party links

The App links to external sites (kitusoft.com, email support). We are not responsible for how those sites process your data. Read their privacy policies separately.

15. Changes to this policy

We may update this policy to reflect changes in the App, in the law or in our practices. When we do:

  • We will change the "Last updated" date at the top.
  • If the change is material (for example, starting to show ads or changing the purposes of processing), we will notify you in the App or by email before it takes effect.
  • Continuing to use the App after the notice constitutes your acceptance of the new version.

16. Contact

Questions, rights requests, incident reports?

Kitusoft Quito, Ecuador Email: soporte@kitusoft.com Website: kitusoft.com

View Terms of UseBack to home