Koyo Privacy Notice

Last updated: [PUBLICATION DATE]

This notice explains what personal data Koyo processes, why, who it is shared with, and how you can exercise your rights. It is issued under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (the "Law"). This is a translation: if it differs from the Spanish version, the Spanish version prevails.

1. Who is responsible for your data

The party responsible for processing your personal data is JOSE CARLOS MARTINEZ DENA, an individual domiciled in Durango, Mexico ("Koyo", "we", "us").

For anything related to your personal data, write to support@getkoyo.com.

2. What personal data we process

Data you give us

• Identification and contact: your email address and, if you choose to give it, your name.
• Authentication: your password. We never store it as is: we only keep a cryptographic hash that cannot be turned back into the password.
• Financial and asset data: the accounts you add (name, type, balance and, if you choose to add them, 2 to 6 digits of the account or card number), their logos if you upload one, your transactions (date, amount, type, category, account and notes), and your categories, budgets and savings goals.
• What you write to the assistant: the messages you send in Koyo's chat.
• Receipt photos: when you use scanning, the image of the receipt. We do not store it on our servers: it is sent to an artificial intelligence provider to be read and then discarded. What gets stored is the transaction you confirm.
• CSV files: when you import transactions, the file is read on your phone and only the parsed transactions are sent. The file never leaves your device.

Please do not include sensitive personal data in your notes or messages (about health, beliefs, ethnic origin, sex life or anything of that nature). Koyo does not need it and does not ask for it.

Data generated when you use Koyo

• Operational technical data: your device's language and time zone, used on each request and not stored; a daily count of your assistant queries, to apply the usage limit; and, during a password reset, a temporary code that we store only in hashed form and that expires after 10 minutes.
• Server logs: like any internet service, our servers log data about the requests they receive, such as the IP address, the date and the requested path.
• Crash reports: if the app crashes, a technical report is sent with your device model, the operating system and Koyo versions, and the screens visited before the crash. It does not include your name, your email or your financial data.
• Installation identifier: a random code the app generates when it is installed and that is used to deliver updates to it. It is not linked to your identity.

Data that stays on your phone

So that you can see your data offline, the app keeps a copy of your accounts, categories, budgets, goals and transactions on your device, along with any changes waiting to be sent. That copy is deleted when you sign out or delete your account, and it is not included in Android's automatic backups.

3. What we use your data for

We use your personal data only for these purposes, all of them necessary to provide the service you ask for:

1. Creating and managing your account, and identifying you when you sign in.
2. Recording, showing and analyzing your finances: accounts, balances, transactions, categories, budgets and goals.
3. Answering your questions in the assistant and recording the transactions you dictate to it.
4. Reading the receipts you scan to suggest a transaction.
5. Sending you the code to reset your password.
6. Protecting the service: applying usage limits, preventing abuse and keeping accounts secure.
7. Detecting and fixing errors, and delivering app updates.

We do not use your data for advertising, we do not sell it, and we do not build profiles for third parties. Koyo has no secondary purposes: if we ever wanted to use your data for something else, we would ask you first.

4. How the AI assistant and receipt scanning work

Koyo uses artificial intelligence providers for two features, and only when you use them:

• The assistant (chat). So that it can answer questions about your finances, with each message we send the provider a summary of your information: your name, the balance of each of your accounts, your categories, your last 15 transactions with their notes, and your goals. We also send the most recent messages of the conversation.
• Receipt scanning. We send the photo of the receipt and the names of your expense categories.

What these providers read may contain errors. With scanning, nothing is saved until you review and confirm the result; with the assistant, a dictated transaction is recorded right away and you can edit or delete it afterwards. The Terms and Conditions explain how each one works.

If you prefer that your financial information not be sent to these providers, do not use the assistant or scanning. The rest of Koyo works without them.

5. Who we share your data with

To run Koyo we rely on providers that process data on our behalf and under our instructions (processors). We do not allow them to use your data for their own purposes. Some of them are outside Mexico, so your data is transferred to other countries:

Beyond these providers, we do not transfer your data to third parties, except when a competent authority requires it under the law, or in the other cases where the Law allows it without your consent.

6. How long we keep your data

We keep your data for as long as your account exists. This includes the history of your conversations with the assistant.

When you delete your account, we immediately and permanently delete from our database your account and everything that depends on it: accounts, transactions, categories, budgets, goals, assistant conversations and reset codes. Your account logos are deleted right after. If a technical failure prevents one from being deleted at that moment, an automatic process that runs every day deletes it, usually within two days. You can also ask us to delete it at the email address in section 1.

Some data may remain outside our database for a limited time:

• in our server logs and crash reports, for as long as each provider keeps those records;
• in the systems of the artificial intelligence providers, under their own retention policies;
• in any report forms you have sent us.

7. Your rights (ARCO) and how to exercise them

You have the right to access your personal data, to rectify it if it is inaccurate, to cancel it, and to object to its processing (ARCO rights). You can also revoke your consent and limit the use of your data.

You can do many of these things yourself in the app:

• Rectify: edit your data, accounts and transactions at any time.
• Access: export your transactions to a CSV file from the app.
• Cancel: delete your account from your account screen in the app. You can also request deletion without the app at getkoyo.com/delete-account.

For any other request, write to support@getkoyo.com from the email address you signed up with, including:

1. your name and your account's email address;
2. the right you want to exercise and a clear description of the data it refers to;
3. any document that helps us locate your data.

We may ask you to prove your identity before handling the request. We will reply within 20 business days at most and, if the request is granted, we will carry it out within the following 15 business days.

Revoking your consent to the processing of your financial data means we can no longer provide the service, so it amounts to deleting your account.

8. Cookies and tracking technologies

The Android app does not use cookies, does not show ads, does not use your device's advertising identifier, and does not track you across other apps.

The web version of Koyo uses an analytics tool (Vercel Web Analytics) that records which screens are visited, without cookies and without identifying you.

9. Minors

Koyo is intended for people over 18. We do not knowingly collect data from minors. If you know that a minor has created an account, write to us and we will delete it.

10. How we protect your data

All communication between the app and our servers is encrypted (HTTPS). Passwords and reset codes are stored only as cryptographic hashes, your session is kept in your phone's secure storage, and every query to our database is limited to your own account's data.

No system is completely infallible. If a security breach significantly affected your rights, we would inform you as the Law requires.

11. Changes to this notice

If we change this notice, we will publish the new version at getkoyo.com/privacy with its update date and, when the change is significant, we will let you know by email. If the change involves a new use of your data that requires your consent, we will ask for it before applying it.

12. Authority

If you believe your right to the protection of your personal data has been violated, you can turn to the Secretaría Anticorrupción y Buen Gobierno (Ministry of Anti-Corruption and Good Governance), the Mexican authority responsible for personal data held by private parties.