Controller and contact
The data controller is Jose Antonio Neto Suárez, with tax ID ES29607219D and address at C/ Manuel Vela 37, 21440 Lepe, Huelva, España.
For privacy questions or requests about your data, write to: hello@utropia.es
What data we process
Account and security data: name, email, language, the one-time sign-in codes we send you (stored as hashes and valid for ten minutes), passkeys and two-factor authentication if you set them up, sessions and activity signals.
Data you enter: assets and debts, balances and history, contributions, quantities, account identifiers, projection assumptions, alerts, letters, instructions and details of your trusted contacts.
Technical data: IP addresses, browser information, requests and error logs needed to operate and protect the service. We do not request bank credentials or access your banks.
Purposes and legal bases
Performing the service you request allows us to manage your account, calculate your net worth, obtain public prices, send configured alerts and carry out Legacy according to your instructions.
Our legitimate interest in maintaining a secure, operational service supports abuse prevention, fault diagnosis, usage statistics and internal new-registration alerts to the operator. These alerts contain the registered name and email, never balances.
We also process data needed to meet legal obligations and respond to rights requests. We do not use your data for automated decisions with legal effects or send advertising merely because you registered.
Trusted contacts and providers
We only share Legacy content with the people you designate and under the conditions you configure. If you enter their details, you must inform them of this policy and have a lawful basis for doing so.
We use technical providers to host the application, deliver email and operate the service. They may process the data needed for their role. We do not sell your personal data.
Fathom Analytics provides statistics for public pages without analytics cookies. It receives technical visit data, such as the URL, referrer and browser information; it processes the IP address to compile statistics without retaining it as a personal identifier. We do not send balances, names or emails as analytics events.
Laravel Nightwatch, when active, receives technical information to detect errors and analyze performance. Diagnostics may contain user identifiers and request context; it is not an advertising system.
Some providers may process data outside the European Economic Area. Transfers that require safeguards must be covered by an adequacy decision or appropriate safeguards, such as standard contractual clauses. You can request information about the providers and applicable safeguards by email.
Cookies and browser storage
We use essential cookies to maintain your session, prevent fraudulent requests and remember your sign-in if you ask us to. We also store language, appearance and display preferences. Their purpose is to provide the features you use; we do not use advertising cookies.
Fathom does not set analytics cookies. You can clear or block browser storage, although some features, such as signing in, will stop working.
Retention and security
We retain account data while you use the service. You can correct it or delete your account in settings. After closure, we delete the associated active data, except information that must be retained to meet a legal obligation or address liability.
Backups rotate over a 14-day cycle. Deletion may take that long to reach those copies. Technical logs and operational emails are retained for as long as needed for their purpose and applicable obligations.
We don't use passwords: sign-in codes are stored as hashes and expire after ten minutes, and letters, notes and account identifiers are encrypted in the application. This does not mean that all data is end-to-end encrypted. No system can guarantee absolute security.
Your rights
You can request access, rectification, erasure, objection, restriction of processing and portability where applicable. Where processing is based on consent, you may withdraw it without affecting the lawfulness of earlier processing.
Email the contact address with your request. We may ask for proportionate information to verify your identity. We will respond within the statutory period, normally one month, and explain any justified extension.
You may also lodge a complaint with the Spanish Data Protection Agency or the relevant supervisory authority. Spanish Data Protection Agency
Changes to this policy
We will keep this page up to date and communicate significant changes to the processing of your data. The service is intended for adults.