Privacy Policy

Arvo is a personal project developed and operated by an individual, acting as the Data Controller of your personal data under Regulation (EU) 2016/679 — the General Data Protection Regulation ("GDPR") — and Portuguese Law no. 58/2019 of 8 August. For any questions related to your personal data, you can contact us at: goncaloserna44@gmail.com.

Account data: name (if provided via Google Sign-In), email address and password (encrypted and managed by Firebase Authentication — we never have direct access). 

Profile and financial configuration data: country of residence, salary configuration (gross salary, tax regime, dependents, meal allowance, among others), language and usage preferences.

Financial data entered by you: transactions, categories, bank accounts (manual name and balance only), monthly budget plans, investments and savings goals. 

Technical data: IP address, device type, operating system, browser, identifier for push notifications (if authorized) and usage and error logs.

Optional import data: contents of bank statements (CSV or PDF) you choose to import. These files are processed locally on your device; only the resulting transactions are saved to your account.

Providing the service: creating and managing your account, calculating net salaries, organizing transactions, budgets and investments (contract performance — art. 6(1)(b) GDPR). 

Sending push notifications: reminders and alerts, only when authorized by the user (consent — (a)).

Ensuring platform security: fraud prevention and unauthorized access (legitimate interest — (f)).

Complying with legal obligations: when applicable (legal obligation — (c)).

Arvo does not sell or commercialize your personal data. We do not use your data for targeted advertising and we do not share financial data with banks, insurers or other commercial entities.

We rely only on the sub-processors strictly necessary for the operation of the App:

Google Ireland Limited (Firebase): authentication services, database (Firestore), hosting, Cloud Functions and push notification delivery. Data may be stored on servers in the European Union or covered by adequate safeguards (European Commission Standard Contractual Clauses) for any international transfers.

We keep your data for as long as your account is active. If you close your account, the data is deleted within a maximum of 30 days, except where there is a legal obligation to retain it. Backup copies may persist for up to 90 days after deletion.

Under the GDPR, you have the right to: Access your personal data. Rectify inaccurate or outdated data. Erase your data ("right to be forgotten"). Restrict or object to processing. Receive your data in a structured format (portability). Withdraw consent at any time, without retroactive effect. Lodge a complaint with the Portuguese Data Protection Authority (CNPD) — www.cnpd.pt. 

To exercise any of these rights, contact us at the email indicated. We will respond within a maximum of 30 days.

We apply appropriate technical and organizational measures to protect your data, including encryption in transit (HTTPS/TLS), encryption at rest, mandatory authentication with email verification and Firestore security rules that ensure each user can only access their own data. 

Despite these measures, no system is completely invulnerable. You agree to keep your password secure and to notify us immediately in case of misuse of your account.

Arvo is intended for users aged 18 and over. We do not intentionally collect data from minors. If you become aware that a minor is using the App, please contact us and we will proceed to immediately delete the account.

We may update this Privacy Policy from time to time. Material changes will be communicated through the App or by email before they take effect. Continued use of the App after such changes constitutes your acceptance.

For any questions about this Policy or about the processing of your personal data, contact us at: goncaloserna44@gmail.com.