Version 0.1, 5 November 2026. Applies to the Orwanna app for iPhone and Android and to the website orwanna.com. The Spanish version is the source; if the two differ, the Spanish one applies.
In short
- Orwanna reads the transactions on your accounts through Tink to work out your round-ups and propose sends to your debt.
- Money never passes through Orwanna. A licensed partner initiates each payment. Orwanna never initiates, holds or executes it: the money goes from your account straight to your debt, after you confirm at your bank.
- We do not sell your data.
- You can delete your account from the app. Your data leaves our database at that moment and leaves the backups over the following days (section 6).
1. Who is responsible
The controller of your data is [RAZÓN SOCIAL], tax id (NIF) [NIF], registered address [DOMICILIO], registered at the [REGISTRO MERCANTIL]. In this policy we call it "Orwanna" or "we".
- General contact: [EMAIL DE CONTACTO]
- Privacy and your rights: [CONTACTO DE PRIVACIDAD]
[Data protection officer: whether one must be appointed is still to be confirmed. If one is, add their contact here.]
2. What data we process
2.1 In the app
Before you create an account. The first time you open the app we create an anonymous user with a random identifier. It lets you accept access to your bank data, connect your bank and try the app before you create an account. If you do not sign in or start the trial within 72 hours, we delete it with everything linked to it, bank data included.
Your account. When you sign in with Apple or Google we receive the identifier Apple or Google assigns to you, your email (or Apple's relay address if you choose to hide yours) and your name, if Apple or Google gives it to us. We also keep the language you choose. You never have a password with us.
Bank data we read through Tink.
- From your accounts: the account name and type, the currency, the balance, the last four digits of the IBAN and, if the bank sends it, the masked card number.
- From your transactions: the date, the amount, the currency, whether it is pending or booked, the description your bank gives it and, if the bank sends them, the merchant name, the category and the merchant category code. The first time we read the last 90 days. After that we read what is new, twice a day.
- From the access permission: which bank it is, when the permission expires and its status.
- The bank's response as it arrives. It can include your name as account holder and data about other people who appear in your transactions, for example the name or IBAN of someone who sends you a transfer. We keep this copy for 90 days and then delete it. We do not keep the full IBAN of your accounts: we strike it out before storing anything and keep only the last four digits.
We never see your bank login details. You type them on your bank's page, not in Orwanna.
Your debts. The name you give it, the balance, the interest rate (TIN), the monthly payment, the card's IBAN that sends go to, the holder's name and the last four digits of the card. You type them in, or we take them from a card that appears in your accounts.
Round-ups and sends. The multiplier, the weekly cap if you set one and the minimum balance you want to leave in the account. For each send: the amount, the status, the dates, the debt it goes to, the account it comes from, the payment's identifier at Tink and what Tink tells us about the payment. That response includes the IBAN of your account and of your card; we strike them out 90 days after the send ends.
Trial and subscription. The status of your trial or subscription, its start, renewal and end dates, and the purchase identifier Apple or Google sends us. We do not see your card or payment details: the store takes the payment.
Device and notifications. Whether your phone is an iPhone or Android, the notification code Apple or Google assigns and the last time the app used it.
Security and errors. The IP address and technical details of each request in the server logs. A log of security events: sign-in and sign-out, device registered, attempts to connect the bank and their outcome, account deletion. Error reports from the app and the server, from which we remove emails, IBANs, request contents and credentials before sending.
Use of the app. We record some steps: install, acceptance of bank-data access, bank connected, subscription screen shown, trial started, account created, send confirmed, send completed, subscription active and subscription expired. Each step carries a pseudonymous identifier and, at most, the band your debt falls in (for example "between 1,000 and 3,000 €"). Never exact amounts, IBANs, names or emails.
What you write to us. If you write to us, your email and what you tell us.
What stays on your phone. The app keeps your first name on the phone to greet you, and your language preference. The daily message is worked out on the phone itself and does not reach us.
2.2 On the website
- If you joined the old waiting list, removed on 5 November 2026: your email and, if you gave them, your answers to the optional questions and your phone or WhatsApp number. The website no longer collects any of these.
- In the calculator: the card you choose, the balance and monthly payment you type, the result and the balance band. If you tap the link to your lender's terms, that you tapped it and for which card.
- With your consent: page usage data and a recording of your visit (PostHog), and Meta's advertising pixel. In recordings, what you type into forms is hidden. If you do not accept, they do not load. Details in the cookie policy.
- Server logs: your IP and the page address. If you open a shared calculator link, that address carries the balance and monthly payment in it.
3. What we use it for, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Create and keep your account, work out your round-ups, show you estimates of interest and of the date your debt ends, propose sends and tell you about them | Performance of the contract you accept by using the app (Art. 6(1)(b) GDPR) |
| Read your accounts through Tink | Performance of the contract (Art. 6(1)(b) GDPR). On top of that, payment services law requires your explicit consent to access your accounts (Art. 94(2) of Directive (EU) 2015/2366 and Spanish Royal Decree-law 19/2018). You give it in the app and on Tink's page. If you withdraw it, we stop reading your accounts |
| Process data about other people who appear in your transactions | Legitimate interest in providing the service you ask for (Art. 6(1)(f) GDPR). We use it only for that |
| Ask Tink to initiate each send you confirm | Performance of the contract (Art. 6(1)(b) GDPR) |
| Keep the anonymous user before you create an account | Steps you ask for before entering a contract (Art. 6(1)(b) GDPR) |
| Manage the trial and the subscription | Performance of the contract (Art. 6(1)(b) GDPR) |
| Protect the service, prevent abuse and fix errors | Legitimate interest in a service that is safe and works (Art. 6(1)(f) GDPR) |
| Measure use of the app with the pseudonymous steps in section 2.1 | Legitimate interest in knowing which parts of the app work (Art. 6(1)(f) GDPR). You can object by writing to us |
| Answer your messages and your rights requests | Performance of the contract and legal obligations (Art. 6(1)(b) and 6(1)(c) GDPR) |
| Meet legal obligations, for example tax or requests from authorities | Legal obligation (Art. 6(1)(c) GDPR) |
| Website: old waiting list, optional questions and contact phone (no longer collected) | Your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time |
| Website: analytics, visit recording and Meta pixel | Your consent (Art. 6(1)(a) GDPR and Art. 22(2) of Spanish Law 34/2002, LSSI) |
What we do not do:
- We do not sell your data.
- We do not use your bank data to grant credit or to assess your creditworthiness.
- We do not use your bank data for advertising or share it with advertisers.
- We do not classify your transactions to infer your health, religion, trade union membership or other specially protected data. If we ever add transaction classification, we will design it to ignore those categories and say so here first.
4. Who else processes your data
We work with these companies. Those marked "processor" process data only on our instructions and under a contract that requires it.
| Company | What it does | Role | Where |
|---|---|---|---|
| Tink AB | Connects to your bank, passes us your account and transaction data, and initiates each payment you confirm. An authorised payment institution in Sweden (company number 556898-2192), supervised by the Swedish financial authority. You accept its terms on its page and its own privacy notice applies: https://tink.com/privacy-policies | Controller for what it does with you under its terms [exact role towards Orwanna to be confirmed] | Sweden (EU) |
| Enable Banking Oy | Alternative for reading accounts. Switched off today. If we ever offer it to you, we will tell you before you connect | Controller for what it does with you under its terms [to be confirmed] | Finland (EU) |
| Railway Corporation | Hosts our servers and the database | Processor | Servers in the EU (Amsterdam). US company |
| Apple | Sign in with Apple, iPhone notifications, subscription billing in the App Store | Controller for its own services; processor for notifications [to be confirmed] | Ireland and US |
| Google sign-in, Android notifications (Firebase Cloud Messaging), subscription billing in Google Play | Controller for its own services; processor for notifications [to be confirmed] | Ireland and US | |
| PostHog Inc. | App analytics (pseudonymous steps) and website analytics | Processor | Servers in the EU (Frankfurt). US company |
| Functional Software Inc. (Sentry) | Error reports | Processor | [Servers in the EU (Frankfurt): confirm the region chosen]. US company |
| Resend | Would send the sign-in link by email. Not active today | Processor | US |
| Vercel Inc. | Hosts the website | Processor | [Region to be confirmed]. US company |
| Meta Platforms Ireland Ltd. | Advertising pixel on the website, only if you accept it | [Joint controller for collection on the website, to be confirmed] | Ireland and US |
| Google (Google Workspace) | Our email and working documents | Processor | [To be confirmed] |
Authorities and courts may also receive data when the law requires it, and so may our advisers (accountants, lawyers), who are bound by confidentiality.
5. Transfers outside the European Economic Area
Our database is in the EU. Some of the companies in section 4 are based in the United States or may access data from there. In those cases we rely on one of two safeguards:
- The European Commission's adequacy decision on the EU-US Data Privacy Framework of 10 July 2023, when the company has signed up to it.
- The standard contractual clauses approved by the European Commission (Decision 2021/914), when it has not.
You can ask us for a copy of these safeguards at [CONTACTO DE PRIVACIDAD].
6. How long we keep your data
| Data | How long |
|---|---|
| Your account and everything the app holds (accounts, transactions, debts, sends, device) | While you have the account. When you delete it, it is removed from the database at that moment |
| Database backups | Up to [6] days after deletion, the time our provider keeps each daily backup [confirm in the Railway dashboard] |
| Anonymous user who does not sign in or start the trial | 72 hours, with its bank data |
| The bank's full response for each transaction | 90 days. The data the calculations need (date, amount, description) stays while you have the account |
| IBANs inside Tink's response about a payment | Struck out 90 days after the send ends |
| Permission to access your bank | 90 days with Tink. After that you need to renew it |
| One-time sign-in codes | Deleted when they expire |
| Ended sessions | 30 days after they end |
| Attempts to connect the bank | 90 days |
| Security event log | 13 months. When you delete your account, we remove any reference to you from it |
| Server logs | [Depends on the Railway plan: confirm] |
| Error reports | [90 days: confirm in Sentry] |
| App usage steps | [Confirm PostHog's period] |
| Website: old waiting list and optional answers | Until we open your access and at most 12 months after the public launch, or until you unsubscribe |
| Website: analytics and recordings | [Confirm PostHog's period] |
If a law requires us to keep something longer, we keep it blocked and only for that purpose.
Tink, Apple and Google keep their own data under their own policies. When you delete your account, we ask Tink to delete the user it created for you and the permission to access your bank.
7. Your rights
You can ask us for:
- Access: to know what data we hold about you and get a copy.
- Rectification: to correct what is wrong.
- Erasure: to delete it. You can do this yourself in Settings, "Delete account".
- Restriction: to stop using it while a complaint is resolved.
- Portability: to receive the data you gave us in a machine-readable format.
- Objection: to stop using it where the basis is our legitimate interest, for example usage measurement.
- Withdrawal of consent at any time. On the website, from "Cookie settings" at the foot of every page. For your bank data, by deleting the account or withdrawing the permission at your bank.
Write to [CONTACTO DE PRIVACIDAD] from your account's email, or tell us how to identify you. It is free. We answer within one month at most; if the request is complex, we can extend that by two more months and will tell you within the first month.
For what Tink does with your data under its terms, you can also contact Tink. For subscription billing, contact Apple or Google.
8. Complaints to the authority
If you think we are not handling your data properly, you can complain to the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, or at its online office, sedeagpd.gob.es. We ask you to write to us first in case we can sort it out, but you do not have to.
9. Automated decisions
We do not take automated decisions that have legal effects on you or affect you in a similar way. The app works out automatically how much to propose for each send, but a send only goes if you confirm it in the app and at your bank. We do not assess your creditworthiness and we do not profile you for advertising in the app.
10. Minors
The app is for people aged 18 or over. The website is not meant for children under 14. If we learn that a minor has given us data, we delete it.
11. How we protect your data
- All connections between the app, the website and our servers are encrypted.
- We do not store your bank login details, Tink access tokens or passwords.
- We strike out the full IBAN of your accounts before storing it, and the app shows only the last four digits.
- Sign-in codes and sessions are stored as a fingerprint (hash), not in readable form.
- Only the people at [RAZÓN SOCIAL] who need it can access the database, each with their own account.
12. Changes to this policy
If we change something important, we will tell you in the app and, if we have your email, by email, before the change applies. The date of the current version is at the top.