Zeta ("we", "the app") respects your privacy. This document describes what personal data we collect, how we use it, and your rights under Colombia's Ley Estatutaria 1581 of 2012 (Habeas Data) and GDPR when applicable.
1. Data we collect
- Identifiers: email address, unique user ID (UUID), account creation date. If you sign in with Google or Apple, we receive the email and name that account shares.
- Financial information: transactions, balances and credit limits of your accounts and cards (with the name you give them and their last digits), recurring payments, debts and loans, categories, recipients, your income, your payday and the pay stubs you record.
- What you send us from your bank: alerts you forward to your Zeta address (we keep part of the email text so you can review it), bank SMS you share with Zeta, and PDF statements you upload or that arrive by email.
- Data about other people that you enter: the names of people who share accounts or loans with you and what they owe.
- User-generated content: notes and descriptions of your transactions.
- Diagnostics and reports: when something fails, the app sends us the error with the phone model and the system and app versions, linked to your account. If you use «Reportar un problema o una idea», we keep your message and, if you give it, the email to reply to.
We do not collect: the passwords you use to sign in to your bank, biometric data (fingerprint or Face ID is validated by your phone), location, contacts, or browsing activity outside Zeta. Dictation is turned into text on your phone: the audio never leaves it (see «Dictate with AI» below).
Without an account: if you use Zeta with «Iniciar sin cuenta», your financial data stays on your phone and is not sent to our servers. We only receive technical error reports, with no account data.
2. How we use your data
- Provide core functionality: read what comes from your bank and your statements, categorize, compute your Disponible and your payments, track your debts and shared accounts.
- Authenticate your account and keep your session active.
- Diagnose errors and answer your reports.
Dictate with AI (only if you accept it): to understand long sentences and pick the category, Zeta sends an external AI service the text of what you dictated and the names of your categories, your accounts and the people in your shared accounts. It does not send the audio, balances or account numbers. The AI only proposes: nothing is saved until you review and confirm it. Our logs do not keep the text you dictate, only how many times you use dictation. You can turn it off at any time in Ajustes › Privacidad; without AI, dictation keeps working on your phone.
Receipt photo (Zeta Plus, only if you accept it): to split a bill by item in a shared account, Zeta sends the photo you pick, once, to Anthropic's AI service (Claude). Before sending it, our server reduces it and strips its metadata, such as location. We do not store the photo: it is read in memory and discarded; our logs only keep how many photos were read. Your balances, your accounts, the people in the shared account and who had what are not sent. The AI only proposes the items: nothing is saved until you review and confirm it. You can turn it off at any time in Ajustes › Privacidad; without AI, you split the bill by hand.
We do not sell your data. We do not share data with advertisers or third parties for commercial purposes.
3. How we protect your data
- On your phone: Zeta's database is encrypted with a key unique to that install, kept in the phone's secure storage. The fingerprint or Face ID lock protects access to the app.
- In transit: all communication between the app and our servers uses HTTPS/TLS 1.2+.
- On the server: the names of your accounts, banks and recipients, the descriptions, merchants and notes of your transactions, your cards' last digits and your statement passwords are encrypted with a key unique to your account. Amounts, balances, dates and your income do not have that extra encryption: they are protected by the database's access controls, and the provider encrypts its disks.
- Isolation: Row-Level Security (RLS) policies ensure each user only accesses their own records.
- Links you share: if you share the link of a shared account or a loan, anyone with the link sees that account: the names, the amounts and how to pay you. That data is stored without the per-account encryption so the link works.
- No cross-tracking: we do not use ad-tracking SDKs or third-party cookies.
4. Who we share data with
These providers process data on our behalf, only to run the service:
- Supabase: database and sign-in, with servers in the United States (and in Brazil for the previous web version).
- Hostinger: Zeta's server, in the United States.
- Resend: receives the bank emails you forward to your Zeta address.
- Anthropic: the AI service (Claude) behind «Dictate with AI» and «Receipt photo», in the United States. It only receives what «How we use your data» describes, if you agreed to use it. It does not use this data to train its models and keeps it only for the limited time its terms for API customers set.
- Google and Apple: if you sign in with their account.
- GitHub: keeps «Reportar un problema o una idea» messages in a private repository, with the phone model and without your email.
Some of these servers are outside Colombia. By accepting this policy you expressly authorize that international data transfer, under article 26 of Law 1581 of 2012.
5. Your rights
Under Law 1581/2012 and GDPR (where applicable), you have the right to:
- Access: see what data we hold about you.
- Rectification: correct inaccurate data.
- Erasure: request deletion of your account and associated data.
- Portability: export your data in a readable format.
- Consent withdrawal: at any time.
To exercise these rights, email giraldo.0302@gmail.com. We respond within 15 business days.
6. Retention and deletion
We retain your data while your account is active. PDF statements that arrive by email are kept only until Zeta reads them or you dismiss them. When you delete your account, we erase your personal data within 30 days. Aggregated, non-identifiable data may be retained for statistical purposes.
7. Minors
Zeta is not directed at children under 18. We do not knowingly collect data from minors. If we detect a minor's account, we will delete it.
8. Changes to this policy
We may update this policy. Material changes will be communicated in the app and via email before they take effect.
9. Contact
Data controller: giraldo.0302@gmail.com.
For complaints with the Colombian data protection authority, you may contact Superintendencia de Industria y Comercio (SIC) at www.sic.gov.co.