Privacy Policy

Last updated: 8 October 2026.

At Aurio we take your privacy seriously. We process the least personal information possible and apply data minimisation and data protection by design. This policy explains what data we process, for what purpose and what rights you have, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

1. Data controller

• Data controller: Studio Flix, S.L.
• NIF: B93905800
• Registered address: Ronda del General Mitre, 126, 6th floor — 08021 Barcelona, Spain
• Privacy contact: privacidad@aurioapp.com

We are not required to appoint a Data Protection Officer; you may address any query about your data to the address above.

2. Who is responsible for which data

For the operation of the service (your account, your analyses, your calculations) Aurio acts as the data controller. That said:

• You decide what data goes in. It is you who chooses to import a file or upload a document and, when bank connectivity becomes available, whether to enable it to connect a bank. You are responsible for the accuracy of that data.
• Third-party data that you provide. If you upload invoices or receipts containing data of suppliers, customers or counterparties, it is you who determines that processing: with respect to that data you act as the controller and Aurio merely as a data processor handling it on your behalf. You must have a legitimate basis to provide it.
• Your decisions are yours. Aurio is informative; financial or tax decisions and any formality before the Administration are your responsibility.

In any case you are in charge of your data: you can export and delete it whenever you want (section 8).

3. What data we process

• Account data: name, email and credentials (the password is stored hashed; the 2FA secret is stored encrypted). If you choose Google Sign-In, Google may also process technical authentication data, identifiers, phone number and approximate location in accordance with your Google account settings and policy.
• Financial data: transactions, categories, accounts and net worth. They are kept encrypted and with minimisation: of the IBAN, only the last 4 digits plus a token; merchants, counterparties and tax IDs (NIF) are tokenised; the raw bank description is ephemeral.
• Tax data: tax bases, VAT and amounts for the calculations (VAT, estimated personal income tax, depreciation). If you choose to use simulators that require them, this also includes year of birth and disability percentage. They are informative estimates.
• Documents (OCR, optional feature): when you upload an invoice or receipt the data is extracted; the tax ID (NIF) and the supplier are tokenised and the image is kept encrypted by default as a supporting copy in case of a tax inspection (it does not replace the original where the rules require you to keep it). You can discard it while reviewing the document or delete it later, and it is erased when you delete your account.
• Google Drive folders (automatic sync, optional): if you enable this feature, you share one specific Drive folder, read-only, with an Aurio service account. We only access that folder you share (never the rest of your Drive) to import documents into OCR, with the same guarantees as above. You can revoke access at any time by unsharing the folder or turning the sync off. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements (we do not use this data to train generalised AI models).
• Payment and subscription data: on the web, Stripe processes the payment. On iOS, Apple processes the purchase and RevenueCat manages pseudonymous identifiers for subscription status and Premium access. We do not store your card or payment method details.
• Minimal technical and usage data: only what is essential for security, diagnostics and improving the service. Product analytics uses a pseudonymous internal workspace identifier and usage events with a closed set of properties; it never includes amounts, balances, merchants, descriptions, document content or AI question content. If you answer “How did you find Aurio?”, we record only the selected category and platform, never the URL, referrer, UTM parameters or browsing history. If you enable notifications, we store the pseudonymous device token linked to your account. Crash and performance diagnostics are sent to Sentry without linking them to your Aurio identity.

4. Protection by design

Aurio is built so that not even we can normally read your sensitive data in the clear: encryption at rest of sensitive information, tokenisation of identifiers (merchants, counterparties, NIF, IBAN), strict per-user isolation and minimisation of identifying information. It is the best guarantee of your privacy and reduces the scope of any incident.

5. Purposes and legal basis

• Providing the service and managing your account — performance of the contract.
• Read-only PSD2 bank aggregation, when it becomes available and you choose to enable it — explicit and revocable consent.
• Analysis, insights and tax calculations on your data — performance of the contract and legitimate interest in offering you a useful service.
• Processing of the documents you upload to OCR — consent (an optional feature that you activate).
• Security, fraud prevention and compliance with legal obligations — legal obligation and legitimate interest.
• Pseudonymous usage analytics and technical diagnostics — legitimate interest in improving the security, reliability and usefulness of the service, using minimised data without financial content.
• Optional communications (for example, a periodic summary) — consent, revocable at any time.

6. Artificial intelligence

The AI features operate on aggregated and tokenised (pseudonymised) data: as a general rule no personal or sensitive data is ever sent in the clear (name, email, IBAN, tax ID, merchants or counterparties) to the AI provider. Processing is carried out through model providers —currently Google (Gemini models) and Anthropic (Claude models)— acting as processors, and your data is not used to train their models. With Google, processing in the European Union (Vertex AI) is prioritised; Anthropic may process it outside the EU (see “International transfers”) and keeps it for at most 30 days for safety purposes before deleting it.

The only exception: in document OCR, the image you upload necessarily contains its data (supplier, NIF, amounts), because reading it is precisely the objective. That processing is carried out on an ephemeral basis, the identifiers are tokenised before anything is stored and the image is kept encrypted by default as a supporting copy in case of a tax inspection (it does not replace the original where the rules require you to keep it); you can discard it while reviewing the document or delete it later, and it is erased when you delete your account. The AI features do not make decisions with legal effects on you: they are indicative and always reviewable by you.

Aurio in ChatGPT (optional)

If you use Aurio's plugins inside ChatGPT, ChatGPT is a service provided by OpenAI that you use under your own terms with OpenAI: OpenAI is not our processor. We only send back what you ask for:

• Calculators: only the figures you type in the conversation; no account is needed and we store nothing.
• Analyse your statement: the file you upload to ChatGPT is downloaded, analysed in memory on the spot and discarded. It is not stored, its content is not logged and it does not go through any AI model. We only return totals to ChatGPT (income, spending, categories, months and subscriptions to well-known merchants); never your transactions, your IBAN or people's names.
• Your Aurio account (only if you expressly connect it): ChatGPT can read, read-only, aggregated totals of your finances (balance, income, spending, spending by category and by month); never individual transactions, merchants or IBAN. You can revoke the connection at any time from Settings › Security.

7. Recipients and data processors

We rely on a small number of providers. Depending on the service and their role, they act as processors or process data under their own terms, with the applicable safeguards and, where appropriate, Standard Contractual Clauses. We prioritise providers that process data in the EU:

• Web hosting and aggregate traffic analytics: Vercel (without analytics cookies).
• Database (encrypted, in the EU): Neon.
• Queues and rate limiting: Upstash.
• Payments and subscriptions: Stripe (web); Apple and RevenueCat (iOS purchases and Premium access management). We do not store payment method details.
• Transactional email: Resend.
• PSD2 bank aggregation (when it becomes available and you choose to enable it): an authorised aggregator, read-only. We will publish its identity here before the feature goes live; today no provider has access to your banking data.
• Artificial intelligence: Google (Gemini models / Vertex AI) and Anthropic (Claude models), through Vercel AI Gateway.
• Product analytics: PostHog Cloud EU (Frankfurt), with pseudonymous events, no personal profile and no financial content, and a maximum retention of 12 months.
• Error diagnostics: Sentry (technical information needed to detect failures).

We do not sell your data or transfer it to third parties for advertising purposes.

8. Your rights

You can exercise the rights of access, rectification, erasure, objection, restriction of processing, portability and to withdraw your consent at any time. From Settings you can, immediately and on your own, export all your data and delete your account. You can also write to us at privacidad@aurioapp.com. Product analytics events do not create a personal profile. When you delete your account we also ask PostHog to erase those events: to do so, an empty profile (with no data at all) is created for a moment and deleted together with them. PostHog completes the deletion in its weekly cycle, usually within one to two weeks. You can also request any additional erasure at the same address. If you consider that we have not handled your request, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) (aepd.es).

9. Retention

We keep your data for as long as you have an active account. After cancellation, we delete it without undue delay, except for data we must retain due to a legal obligation (for example, billing and payment records, in accordance with tax and commercial regulations, usually between 4 and 6 years) or data that is blocked to address possible liabilities during the applicable limitation period. The audit log is kept without personal data in the clear. When product analytics is enabled, its events are limited to a maximum retention period of 12 months.

If you send us a suggestion or a report from the app, the message reaches our support inbox together with your email, account identifier, plan, version and platform; we keep it only for as long as needed to handle it and for a maximum of 12 months.

10. Invite programme

If you invite someone with your link, or you join Aurio through another person's or a creator's link, we keep the link between the two accounts, the status of the invitation (pending or rewarded) and the months of Premium earned. The person who invited you only sees counters (people invited, pending and months earned), never your name, your email or your transactions. To check that the invitation has been activated we only look at how many transactions the invited account has and on how many different days they were recorded, not at their content.

If you join with a creator's code, we also record the amount, currency and date of each charge of your subscription during your first year, to calculate their commission. The creator is only paid an aggregate figure: they do not receive your identity or the details of your payments.

Legal basis: performance of the programme terms you accept when you use an invitation link (Art. 6(1)(b) GDPR). Retention: charges are kept for 730 days; the link between the accounts, until 730 days after the reward or until one of the accounts is deleted, whichever comes first. Each creator's name is managed manually; they can exercise their rights by writing to privacidad@aurioapp.com.

11. International transfers

We prioritise providers that process data in the EU. Where a provider entails a transfer outside the European Economic Area, it is covered by an adequacy decision or by European Commission Standard Contractual Clauses, together with any additional measures that may apply. This is the case for Anthropic (United States), whose data processing addendum incorporates those clauses; it only receives aggregated, tokenised data.

12. Minors

Aurio is not directed at minors. To create an account you must be over 18 years old.

13. Security

We apply encryption at rest of sensitive information, tokenisation of identifiers, per-user isolation, strengthened authentication (two-factor verification) and audit logging. No system is infallible, but we design Aurio to minimise both the data we process and the impact of any incident.

14. Changes

We may update this policy; we will publish the current version with its date and, when the change is significant, we will notify you.