Last updated 28 August 2026. This describes what this installation actually does with your data.
Bank transactions, the documents you upload (invoices, bank statements, receipts, payroll and tax papers), the tax filings your gestoría sends back, and the read-only links you issue to them. On your profile it holds your name, and optionally your NIE or TIE, your passport number, and the list of banks and cards you hold.
All of it is treated as sensitive, because it is: bank movements, identifiers and filed returns identify you directly.
Only you. Every transaction, document, filing and share link carries the id of the account that owns it, and every read, update and delete is filtered by that id. A request for someone else's record returns “not found” rather than “forbidden”, so the existence of another person's data is not confirmed either.
The one exception is what you deliberately share. A share link covers one period, is read-only, and can be revoked at any time. Its address is stored only as a SHA-256 hash, so it is shown once when created and cannot be recovered afterwards by anyone, including this application. Every write on a shared link is refused, and only a named allowlist of routes can be reached with one.
Your documents are read by OpenAI, a third party outside the EU. Text is extracted on this server and only that text is sent. Sample documents go freely; your own files ask first.
How that works matters, so it is worth being precise. A PDF is turned into text on this server, and only that text is sent to OpenAI. The file itself never leaves. Spreadsheets and CSV files are parsed here and are never sent at all.
Photographs and scans are the exception, and it is worth being exact about it. There are no characters in a photograph to extract, so the image itself is sent. The same is true of a scanned PDF, the form a gestoría's filed return usually arrives in: it is pages of pixels with no text layer, so the file goes to OpenAI to be read as pictures. Those are the cases where a file you uploaded leaves this server rather than only text taken from it. If you would rather that never happened, upload the PDF or CSV your bank generates instead of a scan or a photograph of it, and nothing but text will ever be sent.
What is sent alongside the text: the type you filed the document as, the note you wrote about it, and the names of the accounts on your profile. That last one is how a transfer between two of your own accounts is recognised instead of being counted as income. Nothing else.
Identifiers are taken out of that text before it is sent: IBANs, card numbers, NIE, DNI and TIE numbers, passport numbers, email addresses and phone numbers each become a placeholder. The figures, dates and descriptions the reader needs are left as they are, and your bank is recognised on this server from its own codes before anything is sent. Names are not removed: a statement's lines are about who paid you and whom you paid, and reading them needs those names. A scan or a photograph cannot be treated this way, because it is pictures, so it goes as it is.
Every one of those calls is recorded, with the model that answered and when. There is a hard limit on how much can be read per month; when it is reached, reading stops rather than continuing quietly.
The forecast asks for three things: your autonomous community, your residency status and your RETA tier. They are required because each one changes what the correct answer is. A model asked to assume any of them assumes confidently, and the wrong premise is the part nobody checks.
The figures are not the assistant's. Your income, deductible expenses, tax base and IVA are computed here, from your own records, and handed to it as facts it is told not to recalculate. Your community's IRPF scale is handed over the same way, from a rate table in this repository with the law printed beside each figure. The assistant's job is what the law says about those numbers and which article says it. Where we do not hold a community's scale the answer says it is approximating rather than presenting a national figure as a local one.
What comes back is checked before you see it. If the answer restates one of your figures as a different number, a correction naming the real one is added underneath rather than the discrepancy passing quietly.
Prompts are stripped of identifiers before they are sent: IBANs, DNI and NIE numbers, passport numbers, card numbers, email addresses and phone numbers. For questions typed into the assistant this happens in your browser, so the identifier never leaves your device. For the forecast it happens on our server, because the figures are read from the database rather than from the page.
Each reading is stored so it is generated once rather than every time you open the page, along with a fingerprint of the figures behind it. Change a transaction or your region and the reading is marked as no longer describing your books. These readings are included in your export and are deleted with your account.
This application runs on a single server rented from Contabo, in Germany, and uses these processors. Each holds only what it needs:
Your records, your files and your login are all on a server in Germany, and the application's mail is sent from Ireland. The remaining international transfer is the one described above: the text of documents you ask to have read, and the questions you ask the assistant, go to OpenAI in the United States. That is a deliberate choice rather than an oversight, and if it is not acceptable to you, this is the point to stop.
OpenAI states that data sent through its API is not used to train its models. It does retain API traffic for a limited period for abuse monitoring, so “not used for training” is not the same as “not stored anywhere”, and we would rather say so than let you assume otherwise.
The database and your files are copied each night to an encrypted backup held with a different provider than the server, so that one failure cannot take both. The copies are encrypted before they leave this server; the backup provider never sees plaintext.
Backups exist to survive a disaster, not to keep what you deleted: a deleted document or a closed account disappears from the live system immediately and rolls out of the backups as they expire, daily copies within two weeks and the last monthly copy within six months.
An audit record is kept of every document read by AI, every export, every document download, every view of a share link, and every sign-in attempt, with a timestamp and the IP the request came from. It exists so you can see what happened to your own data, including anything your gestoría did with a link you gave them.
There is no analytics, no advertising, and no third-party tracking in this application.
Nothing is deleted on a schedule. Your books are records you may need for years, and the Spanish tax office can ask about them long after a quarter closes. You are in control instead: deleting a document removes the file from storage and takes the figures read out of it with it, and transactions can be deleted individually or by month.
To have everything removed, close your account from the account page. Deleting it removes every transaction, filing, note and share link from the database, every file you uploaded from storage, every forecast reading written about you, and your sign-in details from this application's own database. It happens immediately, it is not a request queued for somebody to action, and it cannot be reversed. Copies in backups roll off as described above.
Under the GDPR you can also ask for a copy of what is held, have it corrected, or object to how it is processed. The same page has a single download that produces everything at once: every record as JSON and as spreadsheets, together with the original files. The export buttons throughout the application produce a copy of any period as CSV or Excel at any time.
Every page and API route sits behind authentication, apart from signing in and the share links described above. Uploads are restricted by type and size and are checked before anything is stored; only PDFs and images may be displayed in the browser, and everything else is forced to download so a stored file cannot become script on this site. Requests are rate limited, sign-in attempts more tightly still, writes must come from this site, and error messages return a reference rather than internal detail.
Connections are encrypted in transit; certificates are issued and renewed automatically. Passwords are stored only as scrypt hashes, and a second factor from an authenticator app can be added on the account page.
No API key or database credential is ever sent to the browser. All processing happens on the server.
This is a private application run by one person, not a company. For anything on this page, whether a copy of your data, a correction, deletion, or a question about the transfers described above, contact the account holder directly.