Controller
Data controller: Juan Francisco Jimenez, Spanish tax ID 77570409-B, owner of Lista Calista.
Address: CEEIM, C/ Campus Universitario de Espinardo, 7, 30100 Murcia, Spain.
Privacy contact: aaargbapps@gmail.com.
Data and purposes
Lista Calista is for people aged 18 or over in Spain and the European Union or European Economic Area. A guest account keeps a persistent identifier and is not technically anonymous.
We process account and authentication data; receipts, images, PDFs and metadata; extracted and confirmed information; lists, preferences, notes, transcripts and photos you choose to send; privacy choices; subscription status; and limited technical data.
We use this data to provide the requested service, retain your history, prepare reviewable suggestions, manage accounts, exports, deletion and subscriptions, protect the service, prevent abuse and meet legal obligations.
The main legal basis is performance of the contract. Optional analytics relies on your consent. Security, fraud prevention and limited diagnostics rely on our legitimate interests, subject to your rights. Tax or payment records are retained where legally required.
Providers and transfers
Google provides Firebase Authentication, Firestore, Cloud Storage, Cloud Run, Cloud Tasks, Vertex AI, Firebase Analytics and Crashlytics. Core records and files are configured on European resources; Vertex AI and some support services may involve processing outside the EEA.
RevenueCat manages subscription status and receives a user identifier, technical information and Apple or Google transaction data. Apple and Google process purchases, charges, cancellations and refunds under their own terms. The web host and email provider process technical or delivery data where necessary.
For international transfers we use the provider’s contractual safeguards, including standard contractual clauses where applicable. We do not sell personal data or share it for advertising.
AI processing
Before private content is first sent, the app identifies Google Vertex AI, explains what will be sent and why, and lets you decline processing without transmitting it.
Google does not use data sent to Vertex AI to train models without prior permission. Temporary in-memory storage and abuse controls may apply under its terms. Lista Calista does not use your receipts, images, notes or results to train models.
AI output may contain errors. You must review and confirm information before it affects purchase memory or later suggestions.
Retention and control
Receipts, original files, confirmed data, lists and preferences are kept while you maintain the account or until you delete the relevant receipt. Temporary exports expire after one day and their link after one hour. Operational logs are limited to 30 days.
Firebase Analytics is enabled only if you allow it, uses a closed event list without household content or account identifiers, and is configured for two-month retention. You can withdraw permission in Settings.
Crashlytics is active in production to detect failures. It may process device model, operating system, app version, technical traces and closed error categories for 90 days. We do not send receipts, images, products, prices, notes, searches, account identifiers or free-form error messages.
You can export your data, delete individual receipts or fully delete the account from the app. You can also start a request through the Delete account. Deletion does not automatically cancel an Apple or Google subscription.
Stores, RevenueCat and other providers may retain financial or security records where required by law or their obligations. Provider backups are deleted under their contractual cycles.
Your rights
You may request access, correction, deletion, restriction, objection or portability, where applicable, by writing to aaargbapps@gmail.com. The request is free and may require proportionate identity verification.
You may also complain to the Spanish Data Protection Agency at aepd.es. This policy may be updated when purposes, providers or features change; material changes will be communicated in the app.