Last updated: March 2026 · Version 1.0
Privacy Policy
Luca ("we", "us", "our") operates this Service. For privacy questions, contact privacy@fuentech.dev.
This Privacy Policy explains how we collect, use, store, and protect your personal data when you use Luca (the "Service"). We are committed to protecting your privacy in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Spanish Organic Law 3/2018 (LOPDGDD).
1. Data Controller
- Controller: Luca
- Privacy contact: privacy@fuentech.dev
- Data protection contact: dpo@fuentech.dev
2. What Personal Data We Collect
a) Account data
Email address, name (optional), timezone and language preference, account creation date.
b) Authentication data
Session tokens, IP address and browser user agent (for security), one-time passwords (temporary).
c) Banking and financial data
When you connect a bank account: bank account identifiers (IBAN, account name), transaction history (date, amount, currency, description, merchant name), bank connection metadata.
d) AI-processed data
Transaction descriptions and merchant names (sent to our AI provider for categorization), your category names, categorization results.
e) Notification data
If you configure alerts: Telegram bot token and chat ID (provided by you), alert threshold settings.
3. How We Use Your Data
| Purpose | Lawful basis |
|---|---|
| Provide the core service (dashboard, transactions) | Contract — Art. 6(1)(b) |
| Connect to your bank via open banking | Contract — Art. 6(1)(b) |
| AI transaction categorization | Legitimate interest — Art. 6(1)(f). You can disable this in Settings. |
| Savings suggestions (optional) | Consent — Art. 6(1)(a). You choose whether to enable this. |
| Spending alerts | Contract — Art. 6(1)(b) |
| Authentication and security | Contract and legitimate interest |
4. AI Processing
Luca uses Google's Gemini API to categorize transactions. Your transaction descriptions, merchant names, and amounts are sent to Google for processing. As an EU/EEA user, Google applies paid-tier data protections: your data is not used for model training.
AI categorization may be inaccurate. You can review, correct, or disable it at any time. AI features are informational only and do not constitute financial advice. See our AI Transparency Notice for full details.
5. Who We Share Your Data With
| Processor | Purpose | Location |
|---|---|---|
| Google (Gemini API) | AI categorization | US (EU protections for EEA) |
| Enable Banking | Open banking access | EU (Finland) |
| Supabase | Database hosting | EU (Ireland) |
| Vercel | Application hosting | Global CDN |
| Resend | Transactional email | US |
| Inngest | Background jobs | US |
We do not sell your personal data. We do not share your data with advertisers.
6. International Transfers
Where personal data is transferred outside the EEA, we rely on EU Standard Contractual Clauses (SCCs) incorporated into our processor agreements.
7. Data Retention
- Account and transaction data: until you delete your account
- Security event logs: 12 months
- Session data: until expiry or revocation
- OTP records: 24 hours
- Background job records: 90 days after completion
- Application logs: 30 days
When you delete your account, all your personal data is permanently deleted.
8. Your Rights
Under GDPR, you have the right to:
- Access (Art. 15) — request a copy of your data
- Rectification (Art. 16) — correct inaccurate data
- Erasure (Art. 17) — delete your account and all data
- Restriction (Art. 18) — restrict processing
- Portability (Art. 20) — export your data
- Object (Art. 21) — object to processing based on legitimate interest
- Withdraw consent (Art. 7(3)) — where processing is based on consent
For privacy requests, email dpo@fuentech.dev. We respond within 30 days.
9. Cookies
We use only strictly necessary cookies (session and locale). No advertising, analytics, or tracking cookies are used.
10. Children
Luca is not directed at individuals under 18. We do not knowingly collect data from minors.
11. Automated Decision-Making
AI categorization does not produce legal effects or similarly significantly affect you. It can be reviewed, corrected, or disabled at any time. This does not constitute automated decision-making under GDPR Art. 22.
12. Changes to This Policy
We may update this policy from time to time. Material changes will be notified via email or in-app notification.
13. Complaints
You may lodge a complaint with the Spanish Data Protection Authority (AEPD) at www.aepd.es.
14. Contact
- Privacy: privacy@fuentech.dev
- Data protection: dpo@fuentech.dev