Privacy Policy

🌐 Español · English

Last updated: August 21, 2026 · Version: 2.0

1. Data controller

Joan Stiven Torres Orozco (Bitnestco; “we”, “the App”), based in Colombia, is the data controller for the personal data collected through the mobile and web application CrediPlan (bundle ID com.st.crediwise). For any question about this policy or your data, write to contacto@bitnestco.com.

2. Scope

This policy applies to the use of CrediPlan, available on Google Play, the App Store, and the web. It describes what data we collect, why, who we share it with, and the rights you have over it.

3. What personal data we process

We only process the data strictly necessary for the App to work:

  • Email address (when you register): identify you and let you sign in.
  • Password (register / sign in): authentication. Stored hashed with bcrypt; never in plain text or logs.
  • Name (optional): personalize the experience.
  • Language and currency preferences: display the interface in your language and number format.
  • Your plan status (Free / Premium), if you buy CrediPlan Premium: grant you the features you paid for, on any device where you use your account.
  • Simulations you choose to save (when you tap “Save”): amount, rate, term, contributions, notes and the name you give them, so you can review and edit them later.

Data we do NOT collect:

  • Real bank details, account numbers, or card information.
  • GPS location.
  • Contacts, photos, calendar, or any other device content.
  • Advertising identifiers (IDFA, GAID) — we show no ads and do no tracking.
  • Behavioral analytics (no Google Analytics, Firebase Analytics, Meta Pixel or similar).

4. Legal basis (GDPR / Colombian Law 1581 of 2012)

  • Performance of a contract: creating and maintaining your account and storing the simulations you decide to save (art. 6.1.b GDPR).
  • Consent: by registering you expressly accept this policy (Law 1581 of 2012, art. 9).
  • Legitimate interest: security of the App (protection against abuse and brute-force attacks).

5. How your data is stored

  • Your password is stored hashed with bcrypt (we can never see it).
  • All other data is stored in a MySQL-compatible database protected with TLS.
  • Communication between the App and our backend always travels over HTTPS.
  • Session tokens (JWT) are stored locally on your device and expire automatically after 24 hours.

6. Who we share your data with

We do not sell your data. We share it only with the technical providers (“processors”) strictly necessary to operate the App:

  • Google Cloud (Cloud Run) — hosts the App backend · us-east4 (N. Virginia, USA) · terms.
  • TiDB Cloud (PingCAP) — hosts the database · AWS us-east-1 (N. Virginia, USA) · terms.
  • Apple / Google — App distribution and payment processing for in-app purchases · Global · their respective policies.
  • RevenueCat — validates store purchase receipts and tells us whether your account has the Premium plan · United States · privacy policy.

International data transfer: since our providers may store information outside Colombia, by accepting this policy you expressly authorize such international transfer under the terms of art. 26 of Law 1581 of 2012 and the GDPR safeguards for transfers.

7. Data retention

  • Account data: for as long as you keep your account active.
  • Simulations: until you delete them from the App or delete your account.
  • When you delete your account (Settings → My Account → Delete account): all your personal data and simulations are permanently erased within a maximum of 30 days. We keep only the minimum audit records the law requires.

8. Your rights

As data subject you have the right to:

  • Access the data we hold about you.
  • Rectify inaccurate data.
  • Erase your data (“right to be forgotten”) — directly from the App (My Account → Delete account) or by writing to us.
  • Port your data: we will give you a copy in JSON format.
  • Object to or restrict processing, and withdraw consent at any time.
  • File a complaint with the Colombian Superintendence of Industry and Commerce (SIC) or your local data protection authority.

To exercise any of these rights write to contacto@bitnestco.com from the email associated with your account. We reply within 15 business days.

9. Security

  • Encryption in transit (HTTPS/TLS 1.2+).
  • Passwords never stored in plain text (bcrypt).
  • Restricted, authenticated access to the backend.
  • Periodic database backups.

No system is 100% secure. If a security incident affects your data we will notify you without undue delay.

10. Children

The App is not directed at children under 13. We do not knowingly collect data from minors. If you are a parent or guardian and believe your child has provided us data, contact us and we will delete it.

11. Cookies and similar technologies

The App uses no tracking or advertising cookies. It only uses the device’s local storage to remember your session (JWT token) and save your preferred language. You can clear this data by clearing the App’s storage in your device settings.

12. Advertising and in-app purchases

The App shows no ads and does no advertising tracking: it uses no identifiers such as IDFA or GAID, and no analytics or attribution SDKs.

The App is free and includes one optional in-app purchase (CrediPlan Premium, one-time payment) that unlocks additional features. Regarding that purchase:

  • We never see your card details. Payment is processed entirely by Apple or Google depending on the store you buy from; we neither receive nor store payment data.
  • To recognise your purchase we use RevenueCat, which validates the receipt with the store. We send it only your numeric account identifier, and receive transaction data from the store (purchase identifier, product, country, currency and amount). We do not send it your email, your name or your simulations.
  • In our database we store only whether your account is Free or Premium and the date of the last change, so we can grant you what you paid for on any device.
  • None of this constitutes tracking: purchase data is not linked with third-party data for advertising purposes, nor shared with data brokers.

13. Changes to this policy

We may update this policy. If a change is substantial we will notify you inside the App or by email before it takes effect. The latest version is always available on this page.

14. Governing law

This policy is governed by Colombian Law 1581 of 2012 (Personal Data Protection) and its Regulatory Decree 1377 of 2013, and by the EU General Data Protection Regulation 2016/679 for users in the European Economic Area. Any dispute will be submitted to the competent courts of Colombia.

15. Contact

Controller: Joan Stiven Torres Orozco (Bitnestco) · Email: contacto@bitnestco.com

CrediPlan does not offer loans and does not manage real bank accounts. It is an educational simulation tool.