Privacy Policy – Finelly

Last updated: 28 September 2026

1. Data controller

Eduviku SL — Tax ID (NIF/CIF) B27643162
Paseo de Gracia, 19, 08007 Barcelona, Spain
Email: privacidad@finelly.app

2. What data do we process?

Event chat: the messages you write in an event's chat, with your display name and the time. Only the organizer and the participants who have accepted that event can read them. If someone reports a message, the report keeps a copy of the text and of its author's name.
Registration data: email and password (stored encrypted).
Username (nickname): public within the app, so other users can find and invite you to events.
Usage data: events you create or join, check-in time, minutes late, fines assigned, and your punctuality history and statistics.
Location at check-in: when you tap "I've arrived", your device sends your GPS coordinates. They are used to check that you are within the radius of the meeting point and are kept together with your check-in record as proof of attendance and of the associated fine. Only you and Finelly's administrators can see your coordinates: the other participants in the event see your arrival time, never your location. They are deleted after 12 months.
Device data: platform (web, iOS or Android), browser and operating system, and the dates of your first and last connection. If you use the iOS or Android app and enable notifications, we also store the identifier (token) your device generates to receive them. They are used to provide support, send you notifications and understand which devices Finelly is used from. Finelly does not store your IP address in its own records, without prejudice to the providers described in section 6 processing it as part of their own services.
Reports and blocks: if you report a user or an event, we store who reports, who or what is reported, the chosen reason, your comment if you write one, and the date. If you block someone, we store that block for as long as you keep it active. Reports are reviewed manually by the Eduviku SL team.
Security log: attempts to access the admin panel and relevant security events. These specific records do store the IP address, but only that of Finelly's administrators, never that of users.
Technical data, cookies and advertising on the web: on finelly.app we use Google Analytics to measure site usage, the Meta Pixel from Meta (Facebook and Instagram) to measure the performance of our advertising on those platforms, the X Pixel from X to measure the performance of our advertising on X, and Google AdSense to display advertising. Google Analytics, the Meta Pixel and the X Pixel are activated only after your consent in our cookie banner; consent for Google AdSense advertising is collected by Google's certified consent form (TCF v2.2), which is shown in the European Economic Area, the United Kingdom and Switzerland. The Meta Pixel and the X Pixel run on the web only: the iOS and Android apps do not include them. See the Cookie Policy.
Technical data and advertising in the iOS and Android apps: the native apps use no cookies, but device identifiers and the Google and RevenueCat SDKs instead. They are described in detail in section 3.
Payment data, only if you purchase the ad-removal option: purchase status, date, amount and a transaction identifier. If you buy from the web, payment is processed by Stripe; if you buy from the iOS or Android app, payment is handled by the Apple App Store or Google Play, with RevenueCat validating the purchase. Finelly never sees or stores your card number.

We do not request or process your real name, photo, phone number or exact date of birth — you only confirm you are 16 or older when registering.

3. In the mobile app (iOS and Android)

Finelly's native apps include tools that do not exist in the web version. No cookies are used here: the services in this section rely on identifiers from the device itself.

Google AdMob (advertising): displays banners and full-screen ads. It uses your device's advertising identifier — the IDFA on iOS and the Android advertising ID — which you can reset or limit from your phone's settings.
Firebase Analytics (measurement): records app usage events so we can understand which features are used.
Firebase Crashlytics (stability): collects crash reports and diagnostic data when the app closes unexpectedly, so we can fix it. Your internal user identifier is attached to these reports; your email address is not sent to Crashlytics.
Firebase Cloud Messaging (notifications): in order to send you alerts about your events, the token identifying your device is stored, along with the platform. This only happens if you accept the notifications permission.
RevenueCat (purchases): validates the ad-removal purchase for Finelly and keeps the purchase history associated with your email address, which is what identifies your account to that service.
Precise location: works the same as on the web. It is obtained only at the moment of check-in, is stored together with that check-in as proof of your arrival, and is deleted after 12 months. Finelly does not access your location in the background or at any other time.

How your consent is obtained on mobile

There is no cookie banner because there are no cookies. Instead:

Advertising and measurement are two separate decisions, and they are made in different places. Accepting one does not mean accepting the other.

Advertising. In the European Economic Area, the United Kingdom and Switzerland, Google's consent form (UMP, following the TCF v2.2 standard) is shown the first time you open the app. Refusing does not leave you without the service or without ads: you will still see advertising, but non-personalised. The app works normally either way.
On iOS, the system will additionally ask for Apple's tracking permission (ATT). If you deny it, the ads you see will likewise be non-personalised.
Usage measurement (Firebase Analytics). This is not decided in Google's form but in a setting of Finelly's own. Where the law requires consent — the European Economic Area, the United Kingdom and Switzerland — measurement is off and stays off until you turn it on; where consent is not required, it is on and you can turn it off whenever you want. Your decision is stored on your device.
You can change each of the two decisions separately and at any time from your profile, under Privacy settings: there you will find Google's form for advertising and a switch of our own, "Share usage data", for measurement. Both remain available even if you have purchased ad removal.
Record of your decision. So that we can demonstrate what you consented to, as the GDPR requires, we store the decision itself, linked to your account: the platform, whether you accepted advertising, whether you accepted personalisation, whether you accepted measurement, your response to Apple's tracking permission on iOS, where the decision was recorded, and the date. It contains nothing about your browsing or your use of the app.

If you purchase the ad-removal option, no advertising is shown to you and AdMob is not used.

4. Why do we use your data? (Purposes)

Creating and managing your account.
Enabling event creation, invitations, and the check-in system with location verification.
Calculating and showing you your punctuality history and statistics.
Sending you notifications related to your events, if you accept the corresponding permission.
Showing you advertising: Google AdSense on the web and Google AdMob in the iOS and Android apps.
Measuring the performance of our advertising on Meta (Facebook and Instagram) through the Meta Pixel, on the web.
Measuring the performance of our advertising on X through the X Pixel, on the web.
Measuring use of the service: Google Analytics on the web and Firebase Analytics in the apps.
Detecting and fixing application failures (Firebase Crashlytics).
Processing the optional ad-removal purchase and issuing the corresponding receipt.
Handling your enquiries and data-related requests.

5. Legal basis

Performance of the contract for using Finelly (registration, events, check-in, notifications about your events, handling the purchase): Article 6.1.b GDPR.
Consent (Article 6.1.a GDPR) for advertising and measurement. You can withdraw it at any time, and how you give it depends on where you use Finelly:
- On the web, through our cookie banner for Google Analytics, the Meta Pixel and the X Pixel, and through Google's certified consent form (TCF v2.2) for Google AdSense advertising.
- In the iOS and Android apps, through two separate routes described in section 3: Google's consent form (UMP) for Google AdMob advertising, and a setting of Finelly's own — "Share usage data", under Privacy settings — for measurement with Firebase Analytics. The cookie banner does not apply on mobile.
Legitimate interest (Article 6.1.f GDPR) for Firebase Crashlytics: keeping the application stable and secure is a legitimate interest of Eduviku SL, and crash reports are limited to technical diagnostic data. You can object by writing to privacidad@finelly.app.
Access to your GPS location and the sending of notifications also require your browser or device permission, which you can revoke at any time from their settings.

6. Who do we share your data with?

Base44 Ltd., the technical infrastructure provider for Finelly, acting as data processor and hosting the app's data on servers located in the European Union.
Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), as the provider of Google Analytics and Google AdSense on the web, and of Google AdMob, Firebase Analytics, Firebase Crashlytics and Firebase Cloud Messaging in the iOS and Android apps. It receives the data described in sections 2 and 3, under the consent terms explained there. You can review its policy at https://policies.google.com/privacy.
Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland), as the provider of the Meta Pixel on the web. It receives technical data about your visit — such as the page viewed and a browser identifier — to measure the performance of our advertising on Facebook and Instagram. You can review its policy at https://www.facebook.com/privacy/policy/.
X Internet Unlimited Company (One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland), as the provider of the X Pixel on the web. It receives technical data about your visit — such as the page viewed and a browser identifier — to measure the performance of our advertising on X. You can review its policy at https://x.com/en/privacy.
RevenueCat, Inc., as data processor for validating purchases made from the iOS and Android apps. It receives your email address as your account identifier and the history of that purchase.
OpenStreetMap: place search when creating an event is resolved from our own server against OpenStreetMap, so that service never receives your IP address or any identifier of yours.
Stripe, as data processor for payments made through the web (ad-removal purchase).
Apple and Google, when you buy the ad-removal option from the iOS or Android app: in that case, the Apple App Store or Google Play handle payment and billing directly, under their own terms.

We do not sell your data to third parties or use it for purposes other than those described here.

International transfers. Some of these providers, in particular Google, Meta, X and RevenueCat, may process data outside the European Economic Area. When that happens, the transfer relies on the standard contractual clauses approved by the European Commission or, where applicable, on the EU-US Data Privacy Framework. You can request information about these safeguards by writing to privacidad@finelly.app.

7. How long do we keep your data?

Event chat messages: deleted 7 days after the event is closed.
Support tickets: deleted 180 days after you mark them as resolved. A ticket is kept while it remains open, and all of them are deleted when you delete your account.
Copy of a reported message (text and author's name): kept with the report for 24 months.
Account and profile data: for as long as your account is active. When you delete it, they are erased immediately.
Events, participations and fines: for as long as your account is active.
Check-in coordinates: 12 months.
Device data, including the notification token: 12 months from your last connection, or until you disable notifications or delete your account.
Reports: 24 months after they are resolved. Pending reports are kept until resolved.
Blocks: for as long as you keep them active.
Security log: 12 months.
Admin action log: 24 months.
Purchase receipts: kept due to accounting and tax obligations even if you delete your account, unlinked from your identity (your email is replaced with an anonymous one).
Use without an account (guest mode): if you use Finelly without registering, your data is deleted 30 days after your event closes: the event, its participations and the guest session. Sessions that never reached an event are deleted after 7 days.
If you took part in someone else's event: your participation is kept in anonymous form — no session identifier, a generic name and no coordinates — because it forms part of the history of whoever organised that event (their roster, their fines and their result), and deleting it would change a past event of theirs.
If you register: that data becomes part of your account and is kept like any other user's, under the periods in this same list.
Counter for the guest-session limit: to prevent abuse we keep a daily counter linked to an irreversible value derived from your IP address (hashed with a server secret). The IP address itself is not stored. The counter is deleted after 7 days.

8. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability at any time by writing to privacidad@finelly.app.

To withdraw your consent to advertising and measurement you do not need to write to us: on the web, from the Cookie preferences link in the footer; in the iOS and Android apps, from your profile, under Privacy settings.

If you exercise your right to erasure, your registered devices, your blocks and the counters associated with your account are also deleted. Any reports you had submitted are kept in anonymised form, because they affect the safety of other users.

If you believe we have not properly handled your request, you can file a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) or your local supervisory authority.

9. Minors

Finelly is not directed at minors under 16. If we detect an account belonging to someone under that age, we will delete it.

10. Security

We apply reasonable technical and organisational measures (encrypted passwords, restricted access, Base44's encrypted infrastructure hosted in the EU) to protect your data against unauthorised access, loss or alteration.

11. Changes to this policy

We may update this Privacy Policy to reflect legal or service changes. If a change is significant, we will notify you through the app.