Privacy Policy

🌐 Español · English

Last updated: October 6, 2026 · Version: 3.0

1. Data controller

Joan Stiven Torres Orozco (Bitnestco; “we”, “the App”), based in Quebec, Canada, is the data controller for the personal data collected through the mobile and web application CrediPlan (bundle ID com.st.crediwise). For any question about this policy or your data, write to contacto@bitnestco.com.

2. Scope

This policy applies to the use of CrediPlan, available on Google Play, the App Store, and the web. It describes what data we collect, why, who we share it with, and the rights you have over it.

3. What personal data we process

We only process the data strictly necessary for the App to work:

  • Email address (when you register): identify you and let you sign in.
  • Password (register / sign in): authentication. Stored hashed with bcrypt; never in plain text or logs.
  • Name (optional): personalize the experience.
  • Language and currency preferences: display the interface in your language and number format.
  • Your plan status (Free / Premium), if you buy CrediPlan Premium: grant you the features you paid for, on any device where you use your account.
  • Simulations you choose to save (when you tap “Save”): amount, rate, term, contributions, extra principal payments, notes and the name you give them, so you can review and edit them later.
  • App usage data (screens visited, features used, events such as “simulation calculated” or “PDF exported”, device model and OS, approximate country, App version), while using the mobile App: understand which features are used and improve the App (Firebase Analytics). Linked to an App instance identifier and, if you are signed in, to your account’s internal number; never to your email or name.
  • Crash reports (error trace, device model and OS, App state at the time of the crash): detect and fix bugs (Firebase Crashlytics).
  • Advertising identifier (GAID on Android, IDFA on iOS) and technical device data, when an ad is shown in the free version of the mobile App: serve and measure ads (Google AdMob). See section 12: on iOS the IDFA is used only if you allow tracking, and in the EU only with your consent.

Data we do NOT collect:

  • Real bank details, account numbers, or card information.
  • Precise GPS location.
  • Contacts, photos, calendar, or any other device content.
  • Usage, crash or advertising data in the web version: those systems exist only in the mobile App.

4. Legal basis (GDPR / Colombian Law 1581 of 2012)

  • Performance of a contract: creating and maintaining your account and storing the simulations you decide to save (art. 6.1.b GDPR).
  • Consent: by registering you expressly accept this policy (Law 1581 of 2012, art. 9).
  • Legitimate interest: security of the App (protection against abuse and brute-force attacks), bug fixing (crash reports) and aggregated usage statistics to improve the App (art. 6.1.f GDPR).
  • Consent: personalized advertising. In the European Economic Area, the United Kingdom and Switzerland we ask you through a form when you open the App; on iOS, additionally, through Apple’s tracking permission. Without your consent you will still see ads, but non-personalized ones.

5. How your data is stored

  • Your password is stored hashed with bcrypt (we can never see it).
  • All other data is stored in a MySQL-compatible database protected with TLS.
  • Communication between the App and our backend always travels over HTTPS.
  • Session tokens (JWT) are stored locally on your device and expire automatically after 24 hours.

6. Who we share your data with

We do not sell your data. We share it only with the technical providers (“processors”) strictly necessary to operate the App:

  • Google Cloud (Cloud Run) — hosts the App backend · us-east4 (N. Virginia, USA) · terms.
  • TiDB Cloud (PingCAP) — hosts the database · AWS us-east-1 (N. Virginia, USA) · terms.
  • Apple / Google — App distribution and payment processing for in-app purchases · Global · their respective policies.
  • RevenueCat — validates store purchase receipts and tells us whether your account has the Premium plan · United States · privacy policy.
  • Google Firebase (Analytics and Crashlytics) — usage statistics and crash reports for the mobile App · United States · Firebase privacy.
  • Google AdMob — serves the ads in the free version of the mobile App. Google and its advertising partners act as independent controllers of the data they collect to serve and measure ads · Global · Google ads policies.

International data transfer: since our providers may store information outside Colombia, by accepting this policy you expressly authorize such international transfer under the terms of art. 26 of Law 1581 of 2012 and the GDPR safeguards for transfers.

7. Data retention

  • Account data: for as long as you keep your account active.
  • Simulations: until you delete them from the App or delete your account.
  • Usage data (Firebase Analytics): at most 14 months linked to the instance identifier; afterwards only aggregated statistics remain.
  • Crash reports (Crashlytics): 90 days.
  • Advertising data (AdMob): according to Google’s policy linked in section 6.
  • When you delete your account (Settings → My Account → Delete account): all your personal data and simulations are permanently erased within a maximum of 30 days. We keep only the minimum audit records the law requires.

8. Your rights

As data subject you have the right to:

  • Access the data we hold about you.
  • Rectify inaccurate data.
  • Erase your data (“right to be forgotten”) — directly from the App (My Account → Delete account) or by writing to us.
  • Port your data: we will give you a copy in JSON format.
  • Object to or restrict processing, and withdraw consent at any time.
  • File a complaint with the Colombian Superintendence of Industry and Commerce (SIC) or your local data protection authority.

To exercise any of these rights write to contacto@bitnestco.com from the email associated with your account. We reply within 15 business days.

9. Security

  • Encryption in transit (HTTPS/TLS 1.2+).
  • Passwords never stored in plain text (bcrypt).
  • Restricted, authenticated access to the backend.
  • Periodic database backups.

No system is 100% secure. If a security incident affects your data we will notify you without undue delay.

10. Children

The App is not directed at children under 13. We do not knowingly collect data from minors. If you are a parent or guardian and believe your child has provided us data, contact us and we will delete it.

11. Cookies and similar technologies

The App uses no tracking or advertising cookies. It only uses the device’s local storage to:

  • Remember your session (JWT token).
  • Save your preferred language.
  • Count the sample PDFs used and the credits earned by watching an ad (mobile App only).
  • Remember your advertising consent choice so we do not ask again (mobile App only).

You can clear this data by clearing the App’s storage in your device settings.

12. Advertising, usage statistics and in-app purchases

12.1 Advertising (free version of the mobile App only)

To keep the calculators free, the mobile App shows ads through Google AdMob in two formats:

  • A banner on the calculators’ results screen.
  • A rewarded video, shown only if you choose it, to unlock a PDF export without paying.

CrediPlan Premium users see no ads at all, and the web version shows no advertising.

To serve and measure ads, AdMob and its partners may collect your device’s advertising identifier (GAID on Android, IDFA on iOS), IP address, technical device data and ad interactions. We do not access that data nor link it to your account.

Your control over advertising:

  • Consent (EU, UK and Switzerland): when you open the App you will see a form to accept or decline personalized advertising. You can change your choice later by contacting us or by resetting the App’s data.
  • iOS: the App asks for Apple’s tracking permission (App Tracking Transparency). If you decline, the IDFA is not used and ads are not personalized. You can change this in Settings → Privacy & Security → Tracking.
  • Android: you can reset or delete your advertising identifier in Settings → Google → Ads (or Settings → Privacy → Ads).
  • Without consent or without an identifier, AdMob shows non-personalized ads based on context only.

We do not show personalized ads to minors and the App is not directed at children under 13.

12.2 Usage statistics and crash reports (mobile App only)

We use Firebase Analytics to learn which screens and features are used (for example, how many simulations are calculated or how many PDFs are exported) and Firebase Crashlytics to receive reports when the App crashes. This data is linked to an App instance identifier and, if you are signed in, to your account’s internal number; never to your email, your name or the content of your simulations. We do not use it for advertising nor share it with advertisers.

You can limit statistics collection by clearing the App’s data or reinstalling it (a new identifier is generated).

12.3 In-app purchases

The App is free and includes one optional in-app purchase (CrediPlan Premium, one-time payment) that unlocks additional features and removes advertising. Regarding that purchase:

  • We never see your card details. Payment is processed entirely by Apple or Google depending on the store you buy from; we neither receive nor store payment data.
  • To recognise your purchase we use RevenueCat, which validates the receipt with the store. We send it only your numeric account identifier, and receive transaction data from the store (purchase identifier, product, country, currency and amount). We do not send it your email, your name or your simulations.
  • In our database we store only whether your account is Free or Premium and the date of the last change, so we can grant you what you paid for on any device.
  • Purchase data is not linked with third-party data for advertising purposes, nor shared with data brokers.

We do not sell your data to anyone, under any circumstances.

13. Changes to this policy

We may update this policy. If a change is substantial we will notify you inside the App or by email before it takes effect. The latest version is always available on this page.

14. Governing law

This policy is governed by Colombian Law 1581 of 2012 (Personal Data Protection) and its Regulatory Decree 1377 of 2013, and by the EU General Data Protection Regulation 2016/679 for users in the European Economic Area. Any dispute will be submitted to the competent courts of Quebec, Canada.

15. Contact

Controller: Joan Stiven Torres Orozco (Bitnestco) · Email: contacto@bitnestco.com

CrediPlan does not offer loans and does not manage real bank accounts. It is an educational simulation tool.