Privacy Policy
At Lince, we take the confidentiality and security of your personal and financial information with utmost seriousness. This policy outlines what data we collect, our legal grounds for processing, and how you can exercise your data rights autonomously.
1. Data Controller
The data controller for information processed through the Lince application is The Dave Stack. For questions, requests, or exercising your data protection rights, reach out to our privacy channel at privacy@linceapp.es.
2. Categories of Processed Data
We categorize processed data into three distinct tiers with strict safeguards:
Tier 1 — Identity & Technical Security
First name, last name, email address, cryptographically secured credentials (bcrypt), session tokens, two-factor authentication tokens (TOTP/MFA), IP addresses, and user-agent strings used for security audit logging and unauthorized access prevention.
Tier 2 — Financial & Banking Data
Bank accounts, balances, accounting adjustments, credit cards, monthly budgets, transfers between accounts, and raw bank statement CSV records (raw_data) uploaded by the user for reconciliation.
Tier 3 — Fiscal & Special Category Data (Art. 9 GDPR)
Employment profiles and payrolls (gross salary, net salary, IRPF tax withholdings, contribution bases, and family situation under AEAT Form 145). When the user voluntarily inputs a disability percentage, this data constitutes a special category under Article 9 GDPR. It is processed strictly with explicit consent (Art. 9.2.a GDPR) solely to apply the personal and family disability minimums in the deterministic AEAT IRPF withholding computation algorithm. This data is never used for automated profiling, behavioral advertising, or third-party sharing.
3. Legal Basis for Processing
- Contractual Performance (Art. 6.1.b GDPR):Account management, budget planning services, bank account synchronizations, and payroll calculations.
- Legitimate Interest & Security (Art. 6.1.f GDPR):Fraud prevention, brute-force defense, platform administrative audit logging, active session controls, and prevention of repeated or abusive use of the one-time 34-day free trial (Art. 6.1.f and Art. 17.3.e GDPR).
- Explicit Consent (Art. 9.2.a GDPR):Processing of disability rating data specifically for calculating applicable tax deductions and withholding percentages.
4. Cookies & Tracking Policy
Lince enforces a strict zero-tracking policy. We do not use third-party advertising cookies, commercial tracking pixels, or invasive behavioral analytics. Only strictly necessary technical cookies are used (HTTP-only access tokens with strict SameSite and CSRF protection) alongside local browser storage for interface preferences (theme, color palette, and language).
5. Data Subject Rights & Self-Service
As a user, you hold full rights of Access, Rectification, Erasure, Objection, Portability, and Restriction of Processing:
Right to Portability:
You can download a complete structured export of your data at any time (a compressed .zip archive containing JSON summaries and CSV statement files) under Profile Settings > Privacy.
Right to Erasure (Right to be Forgotten):
You can permanently delete your account and all associated personal and financial records via the self-service deletion option under Profile Settings > Privacy. In multi-user households (Plan Duo), if the owner deletes their account, members can choose automated emancipation (Option 2A), establishing their own independent solo household without loss of personal spaces or historical transactions. Under legitimate interest for promotional fraud prevention and legal claims defense (Art. 6.1.f and Art. 17.3.e GDPR), upon account cancellation or erasure Lince retains solely an irreversible cryptographic fingerprint (HMAC-SHA256, never storing the plaintext email address and subject to a maximum retention period of 24 months under the storage limitation principle in Art. 5.1.e GDPR) strictly to prevent repeated claims of the one-time 34-day free trial.