Privacy Policy

Last updated: June 21, 2026

This Privacy Policy describes how Lenara Labs ("we", "our", or "the Company") collects, uses, stores, and protects the personal information of users ("you" or "the User") of the Waloop mobile application (the "App"), a personal finance tool for managing credit cards, published by Lenara Labs and available on iOS.

By downloading, registering, or using the App, you acknowledge that you have read and understood this Policy. If you do not agree with its terms, please do not use the App.

For privacy-related inquiries, contact us at hello@lenaralabs.com or visit https://lenaralabs.com.

1. Data controller

The data controller responsible for your personal data is Lenara Labs, with website at https://lenaralabs.com and contact email hello@lenaralabs.com.

Waloop is a Lenara Labs product intended for users in Peru, Latin America, the United States, and other territories where the service may be useful.

2. Data we collect and why

We collect only the information necessary to operate the App and provide its features. Waloop does not request or store full credit card numbers, CVV, PIN, banking credentials, or financial institution passwords.

2.1. Account and authentication data

Email address associated with your Google or Apple account when you use Google Sign-In or Sign in with Apple.
Display name provided by your authentication provider or entered by you.
Unique user identifier (Firebase UID) generated by Firebase Authentication.
Account creation date ("member since").
Authentication tokens required to maintain your session securely.

2.2. Financial data entered by you (non-sensitive)

Card alias or name (for example, "Gold Visa").
Last four digits of the card (optional reference you choose to record).
Card issuer (optional).
Billing cycle day and payment due day.
Card color in the UI and optional notes.
Associated cardholder (owner).
Payment history you mark as completed (cycle date, payment date, optional notes).

2.3. Cardholders / owners

Cardholder name.
Salary day (optional).
Indicator of whether the cardholder is the primary user.

2.4. Device and notification data

If you enable push notifications, we register the following on our backend to deliver alerts:

Firebase Cloud Messaging (FCM) device token.
Platform (ios).
Device language.
Time zone.

2.5. Local preferences and cached data

Theme preference (light / dark / system) — stored locally on your device.
Notification preference — stored locally and synced with our backend when applicable.
Onboarding completion status — stored locally.
User profile cached in SwiftData (email, name, dates) on your device.

3. How we use your data

We do not sell, rent, or trade your personal information to third parties for advertising purposes.

Waloop does not process real payments, connect to banks or financial aggregators, or provide financial, legal, or tax advice.

Create, authenticate, and manage your user account.
Organize credit cards and cardholders based on information you enter.
Track billing cycles, payment due dates, and payment history.
Display a timeline and calendar of upcoming due dates.
Identify optimal purchase days based on each card's billing cycle.
Send push notifications about due dates and reminders you configure.
Sync your data securely between your device and our backend.
Maintain, protect, and improve the security, stability, and functionality of the App.
Respond to support requests, inquiries, or privacy rights requests.
Comply with applicable legal obligations when required.

4. Legal basis for processing

We process your personal data on the following bases, as applicable in your jurisdiction:

Contract performance: to provide the Waloop service under our Terms of Service.
Consent: when you enable push notifications or choose to sign in with Google or Apple.
Legitimate interest: to ensure service security, prevent abuse, and improve the user experience.
Legal obligation: when we must retain or disclose information under applicable law.

5. Third-party services

We use trusted providers to operate the App. These third parties process data according to our instructions and their own privacy policies. Waloop shares only the minimum data necessary for each service to function:

5.1. Firebase (Google)

We use Firebase Authentication to manage sign-in and Firebase Cloud Messaging (FCM) to send push notifications. Firebase may process authentication identifiers, device tokens, and technical metadata. Privacy Policy: https://firebase.google.com/support/privacy

5.2. Google Sign-In

If you choose to sign in with Google, Google processes certain authentication data under its own policies. We receive only the minimum information needed to identify your account within the App. Privacy Policy: https://policies.google.com/privacy

5.3. Sign in with Apple

If you choose to sign in with Apple, Apple may provide us with your name and email address, or an Apple-generated relay email, depending on your privacy settings. Privacy Policy: https://www.apple.com/legal/privacy/

5.4. Railway (backend hosting)

We operate our own backend API hosted on Railway (https://cards-reminder-api-production.up.railway.app). Your account data, card information, and notification preferences are transmitted over encrypted HTTPS and stored on servers managed through Railway. Railway may process technical and hosting-related data as infrastructure provider. Privacy Policy: https://railway.com/legal/privacy

7. Data retention and deletion

We retain your personal information while you maintain an active Waloop account or as long as necessary to provide the service.

You may sign out of the App at any time. Waloop also offers an account deletion option within the App. If the in-app deletion flow is unavailable or you prefer to request deletion by email, contact hello@lenaralabs.com. We will delete or anonymize your personal data within a reasonable timeframe, unless we must retain it for legal obligations, dispute resolution, or fraud prevention.

Technical and security logs may be retained for a limited additional period for audit and service protection purposes.

8. Information security

We implement reasonable technical and organizational measures to protect your information against unauthorized access, loss, alteration, or improper disclosure. These include encrypted HTTPS communications, access controls, and secure development practices.

No system is completely infallible. We recommend protecting access to your device, using secure authentication methods enabled by your operating system, and not sharing your credentials with third parties.

9. Your rights

Depending on applicable law in your country, you may have the right to:

Access the personal data we hold about you.
Request correction of inaccurate or incomplete data.
Request deletion of your personal data.
Object to or restrict certain processing.
Request data portability, where applicable.
Withdraw your consent at any time, without affecting the lawfulness of prior processing.

Exercising your rights

To exercise these rights, email us at hello@lenaralabs.com with your request and the information needed to verify your identity. We will respond within the timeframes required by applicable law.

Users in Peru may exercise rights under Law No. 29733 (Personal Data Protection Law). Users in Mexico may exercise ARCO rights under the LFPDPPP. Users in the European Union or United Kingdom, where applicable, may exercise rights under the GDPR. Users in California, where applicable, may have additional rights under the CCPA/CPRA.

10. Minors

Waloop is not directed at individuals under 13 years of age (or under 16 in certain jurisdictions). We do not knowingly collect personal data from minors. If we discover that a minor has provided us with information, we will take reasonable steps to delete it.

11. International transfers

Your data may be processed on servers located outside your country of residence, including countries where Google, Apple, Firebase, and Railway operate. When this occurs, we will take reasonable measures to ensure an adequate level of protection under applicable law.

12. Changes to this Policy

We may update this Privacy Policy from time to time. We will publish the current version at https://lenaralabs.com/en/apps/waloop/privacy (English) and https://lenaralabs.com/es/apps/waloop/privacy (Spanish). When changes are significant, we will notify you through the App or by email.

Continued use of the App after changes are published will constitute acceptance of the updated Policy, unless the law requires additional consent.

13. Contact

If you have questions, requests, or complaints related to this Privacy Policy, you may contact us at:

Email: hello@lenaralabs.com

Website: https://lenaralabs.com

Controller: Lenara Labs