Privacy Policy

Nido keeps your household’s finances. That’s sensitive information, and the text below says exactly what’s stored, where, for how long, and who else sees it. It’s written to be read, not to cover ourselves.

What follows applies to everyone. After that there are four annexes—Uruguay, Brazil, California, and the European Union—with what each law requires on top of it: the articles, the deadlines, and where to file a complaint. The rights in this first part apply wherever you live; the annex only tells you what they’re called in your country and where to complain if we don’t respect them.

Who is responsible

Santiago Rodríguez, a natural person, in Uruguay, is the controller of the data Nido collects. For any question about this document or your data: [email protected]. It’s the same address for exercising any right, in any country.

What data we store

Your account data

Name, email address, and password. The password itself isn’t stored: a hash is stored, which is a result that can’t be reversed. If you sign in with Google, instead of a password we store the identifier Google returns to us, along with your name, your email, and your profile photo if you have one. If you turn on two-factor authentication, we store the key that generates the codes.

Your household data

The household’s name, who its members are, and the name each person appears under. A household is shared: what you enter is visible to the other members, which is exactly what it’s for.

The data you enter

Income, expenses, debts, cards, subscriptions, budgets, and savings, with their amount, currency, date, category, merchant, payment method, and any notes you write. If you use bank reconciliation, also the statements you upload and the transactions they contain.

For a card, we store the last four digits, the expiration date, the limit, and the rate. Never the full number or the security code: there’s no column to put them in.

Receipt photos

When you scan a receipt, the photo is uploaded so it can be read to extract the amount, the date, and the merchant. The image isn’t kept forever: see How long.

Device data

• Notification token. An identifier issued by Google so a notification can be sent to your phone. It doesn’t say who you are or where you are.
• IP address. It’s used to limit the number of sign-in attempts and operations per minute, which is what stops someone from guessing passwords automatically. It’s kept only for as long as that counting window lasts and is then deleted.
• App errors. If something breaks, the app sends the error message, where it happened, the platform, and the version. Before sending it, it masks the amounts, and from the screen it sends only the route, without the data that came with it. It doesn’t include your name or your identifier. Those reports stay in the server logs, not in the database.

What permissions the app asks for, and why

Permission	What for
Camera	Taking the photo of a receipt. It’s only requested when you choose to scan, not when you open the app.
Notifications	Alerting you about due dates and about what the other household members enter.
Biometrics	The optional app lock with your fingerprint. The phone does the verification and your fingerprint never leaves it: Nido receives a yes or a no.

Nido doesn’t ask for your location. Nor does it access your contacts, your calendar, your messages, or your files.

What we use the data for

To make the app work: showing you your numbers, calculating the period’s totals, alerting you to what’s coming due, sending you the service emails—verification, password recovery, invitation to a household—and keeping your session open securely. Nothing else.

We don’t advertise, we don’t sell or hand over your data, and there are no third-party analytics tools in Nido. No one is tracking what you tap.

Who it’s shared with

Only with the services needed for the app to work, and only with the minimum each one needs. All of them are outside your country, mainly in the United States: using Nido involves an international data transfer, and the Brazil and Europe annexes explain its legal basis.

Service	What it receives
OpenAI	The documents you ask Nido to read: a receipt photo, a bank statement, a card statement, or a debt contract. And, if you use Auria, what you write to it along with the household data it needs to respond.
Google	If you sign in with Google, your sign-in. And your phone’s token, to deliver notifications.
Resend	Your email address and the text of the message, when the app sends you one: verification, password change, or invitation to a household.
Vercel	Hosts the website and the API. Everything that goes back and forth passes through it.
Supabase	Hosts the database where all of the above lives, including the photos and statements—they’re stored in the database itself, not in a separate file storage service.
DolarAPI	Nothing of yours. It’s queried for the dollar exchange rate, which is the same for everyone.

Beyond this list, data is disclosed if an order from a competent authority requires it. If that happens and the law allows us to tell you, we will.

Auria and artificial intelligence

Auria is Nido’s assistant. To respond, it needs to see your household’s data, which is why it doesn’t work until the household’s administrator explicitly accepts it. That consent is recorded, can be revoked, and as long as it doesn’t exist Auria receives nothing: neither the household data nor what you write to it.

Your conversations with Auria are yours. The rest of the household doesn’t see them, even though they share the data you’re asking about.

Receipt scanning and the reading of bank statements, card statements, and debt contracts also use artificial intelligence, and in those cases what’s sent is the document. If you’d rather not use them, enter your transactions by hand: the app works just the same.

Your data doesn’t train any model. It’s sent to get a response, and we ask the provider not to keep those responses.

How long

• Your account and your personal data, for as long as the account exists. When you delete your account, they’re deleted immediately.
• A household left with no one, 90 days. If you deleted your account and were the only person with access, the household isn’t deleted on the spot: it’s flagged, and the daily cleanup removes it when the period expires. That leaves room to write to us and ask for it back, because deletion can’t be undone.
• Receipt photos and statements, 30 days. After that they’re deleted automatically, every day, whether anyone used them or not.
• The rate limiter’s IP address, for as long as the counting window lasts: minutes.
• Error logs, for as long as the server keeps them, which is a short time, and they can’t be queried.

How it’s protected

Everything travels encrypted over HTTPS. Passwords are stored hashed. Every query checks that whoever makes it belongs to the household whose data it requests, and that check can’t be skipped by mistake: it’s built into the type, so a procedure that skips it doesn’t compile. On your phone, the app prevents screenshots of the screens with your data and offers to lock itself with your fingerprint.

No system is infallible. If a breach affecting your data occurs, we’ll tell you, and we’ll tell the relevant authority within the deadline set by its law—72 hours in Uruguay and in Europe.

Your rights

Wherever you live, you can access your data, correct it, take it with you in a format another app can read, object to processing, withdraw consent you gave—the one for Auria, for example—and ask for everything to be deleted. You exercise these rights by writing to [email protected], free of charge and without explaining why.

Account deletion already exists as a procedure and is carried out immediately: your user is deleted, and with it your sessions, your credentials, your linked Google account, two-factor authentication, the devices registered for notifications, and your conversations with Auria. You do it from Settings → Security → Delete account, on the web or in the app, and you can also request it by email. If you were the only owner of a household where someone else remains, the household passes to another person: first to someone who already managed it and, among equals, to whoever joined first.

A note about deletion in a shared household: when an account is deleted, its personal data goes with it, but the transactions you entered into the household stay, with no author, because they’re also the finances of the other people in it, and they didn’t ask for anything. If you want those gone too, delete them first or ask by email. If you were the only person with access, the entire household is deleted after 90 days.

Minors

Nido isn’t designed for children under 13, and we don’t knowingly collect data from anyone that age. A family can add a teenager as a household member; that’s decided and supervised by the household’s administrator.

If you live in Uruguay (Ley 18.331)

It’s the home-country law: the data controller lives in Uruguay, and it’s the law that applies by default. Ley N.º 18.331 on personal data protection and habeas data action, as amended by Ley N.º 19.670 and Decreto 64/020, gives you these rights:

• Access (art. 14): knowing what data about you exists, free of charge, every six months, or sooner if something has changed.
• Rectification, updating, inclusion, or deletion (art. 15): correcting what’s wrong or asking for anything that doesn’t belong to be deleted.
• Challenging automated assessments (art. 16). Nido has none: see automated decisions, which applies here as well.
• Habeas data action (arts. 37 to 45), if your complaint doesn’t succeed.

The deadline to respond to an access request is five business days, and for a rectification or deletion, five business days from receipt. Send them to [email protected].

Security breaches

If a breach occurs that could affect your data, art. 4.º bis requires it to be reported to the Unidad Reguladora y de Control de Datos Personales (URCDP) within 72 hours of becoming aware of it, and requires that you be notified too when the risk is significant. That’s what we’ll do.

Complaints

With the URCDP, which operates under AGESIC. You don’t need to write to us first, although it’s usually faster.

Se você está no Brasil (LGPD)

This section responds to the Lei Geral de Proteção de Dados Pessoais (Lei n.º 13.709/2018). It applies because art. 3.º, II covers any processing where the collection takes place in Brazilian territory, regardless of where the party processing the data is located.

Controlador and encarregado

Controlador: Santiago Rodríguez, a natural person, in Uruguay. Encarregado pelo tratamento de dados pessoais (art. 41): the same person, and the channel is [email protected]. Nido is a one-person project, and announcing a department that doesn’t exist helps no one. The providers in the Who it’s shared with table are operadores within the meaning of art. 5.º, VII.

Legal bases, one per purpose

What for	Legal basis (art. 7.º)
Creating the account, showing your numbers, and making the app work	V — performance of the contract you’re a party to
Receipt scanning and conversations with Auria	I — consent, specific and revocable
Limiting sign-in attempts, preventing fraud, keeping the service running	IX — legitimate interest, and only with the IP address and the minimum necessary
Responding to a request from a competent authority	II — compliance with a legal or regulatory obligation

Nido doesn’t process sensitive personal data under art. 5.º, II: no racial or ethnic origin, religious belief, political opinion, union membership, health data, sex life, or genetic or biometric data. Financial data isn’t sensitive under the LGPD, even though this document treats it with that same care anyway.

International transfer

The database, the servers, and the email and artificial intelligence providers are outside Brazil. Using Nido necessarily involves an international data transfer, and its legal basis is art. 33, VI: the transfer is necessary to perform the contract you’re a party to. There’s no way to use the app without it, which is why it’s stated here and not in a footnote.

Your rights (art. 18)

• Confirm that processing exists, and access the data.
• Correct anything incomplete, inaccurate, or out of date.
• Request anonymization, blocking, or deletion of unnecessary or excessive data.
• Portability to another provider, in a machine-readable format.
• Deletion of data processed based on consent, except for the exceptions in art. 16.
• Know which public and private entities your data was shared with.
• Know what happens if you don’t give consent, and refuse to give it.
• Withdraw consent at any time, free of charge and without explaining why.

All of them are exercised by writing to [email protected]. We respond within a reasonable time and, for confirmation and access, within the 15 days set by art. 19, II.

Automated decisions

There aren’t any. Art. 20 gives you the right to request a review of a decision made solely by an automated system that affects your interests; no such decision exists in Nido. Auria suggests and summarizes, and what you do with that is up to you. Receipt scanning proposes amounts and dates that you then confirm or correct by hand.

Minors

Nido isn’t aimed at children under 13. Art. 14 requires specific and prominent consent from at least one parent or legal guardian to process data of crianças—children under 12—and we don’t knowingly collect data from that age group. A teenager can be part of a household; whoever administers it decides on and supervises that.

Complaints

If something doesn’t sit right with you, you can file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD), or with consumer protection agencies. Writing to us first is usually faster, but it isn’t a requirement for going to the ANPD.

If you live in California (CCPA/CPRA)

This section is required by the California Consumer Privacy Act, as amended by the CPRA (Cal. Civil Code §§ 1798.100–1798.199). Nido doesn’t meet any of the three thresholds that make it mandatory—it doesn’t have $25 million in revenue, doesn’t process data from 100,000 consumers a year, and doesn’t make money selling data—so the law doesn’t apply to it. It’s written anyway, and the rights below are honored even though there’s no obligation.

Categories of personal information, in the law’s terms

Category (§ 1798.140(v))	What it is in Nido	Where it comes from
Identifiers	Name, email, account identifier, Google ID if you sign in with Google.	You, when you sign up
Information under § 1798.80(e)	The financial records you enter: amounts, currencies, dates, merchants, debts, installments, and the last four digits of a card. Never the full number or the security code.	You, when you use the app
Commercial information	Subscriptions, budgets, spending and savings history.	You, when you use the app
Network activity	IP address during the rate limiter window, and the message and route of an error when the app breaks.	Automatic
Visual information	The receipt photos and statements you upload.	You, when you scan or import
Sensitive personal information (§ 1798.140(ae))	Only your account login credentials: email and password—stored as a hash—and the two-factor authentication key if you turn it on.	You, when you sign up

Nido doesn’t collect geolocation, biometric data, health information, ethnic or racial origin, religion, union membership, sexual orientation, education data, professional information, or the content of your private communications. Nor does it build profiles or inferences about your characteristics: there are no analytics tools in the product.

Sensitive information: what is and isn’t done with it

Login credentials are used only to authenticate you and protect your account—the purposes that § 1798.121(d) expressly exempts. They aren’t used to infer characteristics about you or for any other purpose, so the right to limit the use of sensitive personal information has nothing to limit. You can exercise it anyway, and the answer will be this same one.

Selling and “sharing”

Nido doesn’t “sell” or “share” personal information, in the meaning those two words have in § 1798.140(ad) and (ah). It hasn’t done so in the twelve months before the date above, and there are no plans to. There’s no cross-context behavioral advertising, no ad networks, and no third-party pixels. That’s why this page doesn’t include the Do Not Sell or Share My Personal Information link under § 1798.135: there would be nothing to turn off.

The providers listed in Who it’s shared with are service providers and contractors within the meaning of § 1798.140(ag) and (j): they receive the minimum needed to provide their service and can’t use it for anything else.

Your rights, and their sections

Right	Section
Know what categories and what specific data we have	§ 1798.110
Know what was collected, for what purpose, and who it was shared with	§ 1798.115
Deletion	§ 1798.105
Correction of inaccurate data	§ 1798.106
Portability, in a machine-readable format	§ 1798.110(d)
Opt out of selling or “sharing”	§ 1798.120 — not applicable: there’s no selling or sharing
Limit the use of sensitive information	§ 1798.121 — not applicable: see above
Not be discriminated against for exercising any of the above	§ 1798.125

How to exercise them

By writing to [email protected]. A service that operates exclusively online and has a direct relationship with the person writing to it can offer email as its only channel: § 1798.130(a)(1)(A) says so. You don’t need to create an account to make a request, and if you already have one, we won’t ask you to create it again.

• Verification. We compare what you write to us with what’s already in the database. For specific data—not just categories—the bar is higher, and we may ask you to reply from your account’s email address.
• Deadlines. We acknowledge receipt within 10 business days and respond within 45 calendar days. If we need more time, we’ll let you know before the deadline passes and take up to 45 more days.
• Frequency. Two free access requests every twelve months, which is the legal minimum. If you need more, ask anyway.
• Representatives. We accept requests from an authorized agent with a signed authorization or a power of attorney, and we may confirm it with you directly.
• Limits on deletion. § 1798.105(d) allows keeping whatever is needed to comply with a legal obligation or to detect fraud. In Nido that exception is hardly used: the only thing that survives account deletion is the household’s transactions, for the reason explained in Your rights.

If you live in the European Union or the United Kingdom

Nido doesn’t target its service at the European Economic Area or the United Kingdom: it’s in Rioplatense Spanish, it’s free, and it isn’t promoted there. If you use it from there anyway, these are your rights and this is how we handle them, even though the GDPR and the UK GDPR don’t reach us under the targeting criterion in their art. 3.

Lawful bases (art. 6)

• Performance of a contract, art. 6.1.b: creating the account, storing your transactions, and showing your numbers.
• Consent, art. 6.1.a: receipt scanning and conversations with Auria. It’s requested separately and can be withdrawn.
• Legitimate interest, art. 6.1.f: security, rate limits, and abuse prevention. The interest is keeping the service running, and what’s used for it is an IP address for a few minutes.
• Legal obligation, art. 6.1.c: responding to a request from a competent authority.

No special categories of data under art. 9 are processed. Financial data isn’t one of them, and none of the data art. 9 lists is collected.

Your rights (arts. 15 to 22)

Access, rectification, erasure, restriction of processing, portability, and objection. And art. 22: there are no automated decisions with legal or significant effects. You exercise them by writing to [email protected], and we respond within the one month set by art. 12.3.

Transfers outside the EEA

The entire system is outside the EEA. Transfers rely on the European Commission’s standard contractual clauses, which each provider in the Who it’s shared with table incorporates into its data processing addendum, and on art. 49.1.b—the transfer is necessary to perform the contract you requested.

Nido hasn’t appointed a representative in the Union (art. 27), because it doesn’t target its service there. If that changes, this section will change first.

Complaints

With the supervisory authority in your country of residence, or with the ICO in the United Kingdom.

Changes

If this policy changes, we update the date above and let you know inside the app when the change is significant. Previous versions remain in the project’s public history, so you can always see what it said before and what changed.