Privacy and personal data policy

Last updated: October 6, 2026

This is a reference translation: if there is any difference, the Spanish version prevails. Read in Spanish

Here we tell you what data Oslo Finanzas collects about you, what for, who it's shared with, how long it's kept and how to exercise your rights. This policy complies with Law 1581 of 2012 and Decree 1377 of 2013 (compiled in Decree 1074 of 2015). The short version: Oslo doesn't ask for bank passwords, doesn't move your money, doesn't sell your data and lets you export or delete it with one tap.

1. Data controller

The controller of your personal data is Duván, an individual domiciled in Montería, Córdoba (Colombia), who develops and operates the Oslo Finanzas app and website ("Oslo", "we").

Contact channel for personal data: soporte@oslofinanzas.com.

2. What Oslo is and isn't

Oslo is an app to record and organize your money: expenses, income, goals, debts, installments, accounts receivable and the cash of a small business, for you, as a couple or as a family.

Oslo can be used from any country. Wherever you live, the controller of your data is the same, in Colombia, and processes it according to this policy and Colombian data protection law (Law 1581 of 2012). If your country's law gives you additional rights over your data, write to us and we will handle them through the same channels.

It doesn't connect to your bank or your wallet and never asks you for passwords, verification codes or details to access them. What Oslo knows about your money is what you record: what you say, type, paste or photograph.
It doesn't receive, hold, transfer or lend money, doesn't charge interest and is not an entity supervised by the Financial Superintendence of Colombia or by any other financial authority. It keeps score; the money stays in your bank or your wallet.
It doesn't recommend loans or investments. Oslo's reminders and tips are information about your own records.

3. Data we collect

Your account

Sign-in: with Apple, with Google or with a link to your email. We receive your email, your name and, if the provider shares it, your photo, plus an account identifier. If you use Apple's “Hide My Email”, we receive the email Apple generates. We don't use SMS codes.
Profile and settings: country, currency, time zone, language, your pay cycle (twice a month, monthly or weekly), your reminder time, and your email, voice and sound preferences.

What you record

Transactions: amount, merchant or description, category, date, payment method (cash, digital wallet, card, transfer or other), tags, notes and the source of the entry (voice, by hand, screenshot, receipt, statement or chat).
Goals and challenges: name, amount, progress, deadline, milestones, contributions and challenges.
Debts and fixed bills: lender or person, principal, balance, rate, installment, statement and due dates, payments made, and recurring payments such as rent, utilities or subscriptions.
Accounts receivable: the name of whoever owes you, the amount, since when, partial payments and, if you choose to add it, their mobile number to open the reminder in your WhatsApp. That third party owns their data: record it only if you have a legitimate reason and don't use it for anything other than reminding them of the debt.
Business: sales, expenses, IOUs, suppliers, what's set aside for PILA (Colombian social security) and income tax.
Streak and game: days logged and days marked “I didn't spend today”, grace days used, level, achievements, missions and habit signals.

Voice, screenshots and photos

Voice: speech recognition runs on your phone, only when you tap the microphone. The audio is not sent to our servers; only the resulting text, when it becomes an entry or when you ask the AI for help.
Screenshots from the most popular banks and wallets in your country (for example, Nequi, Mercado Pago, Yape or Ualá): they're read on your phone with the system's text recognition; the image doesn't leave your phone.
Photos of receipts, statements, screenshots from other apps and the photo of the business notebook (AI only): they're sent encrypted so the AI can extract the text, and they're deleted as soon as they're read. We only keep the transactions or debts you confirm.

The chat with Oslo

Your questions, Oslo's answers, the actions you confirmed (for example, a reminder created) and which tool was used to answer.

Purchases and subscriptions

Payments are made in the App Store or Google Play. Oslo doesn't receive or store your card data. We receive from RevenueCat the status of your plan or top-up: product, purchase, renewal and expiration dates, store country and a purchase identifier.

Technical and usage data

Phone model and operating system, app version, time zone and the identifier to send you notifications.
AI usage counters (scans, messages, analyses and voice, with their estimated cost) to apply your credits and daily limits.
App crashes (Firebase Crashlytics): if the app crashes, the technical report (what failed, the phone model and system, and the app version) with your account identifier, so we can fix it.
Usage statistics (Google Analytics for Firebase): events such as opening the app, your first entry, a 7-day streak or viewing the plans, with an installation identifier, your plan, your country, the app language and the type of space you use (personal, couple, family or business). Never amounts, categories or notes, nor your account or advertising identifier. Google infers an approximate location from the IP address. They aren't used for ads and aren't collected from minors.
App performance (Firebase Performance Monitoring): how long the app takes to open, to show a screen, to save and to get the server's response, with an installation identifier, the phone model and system, the app version and the connection type. Never amounts, notes, web addresses or your account identifier. It isn't collected from minors.
Remote configuration (Firebase Remote Config): the app asks Google for its settings (for example, the minimum version or a maintenance notice) with an installation identifier, the app version and the phone's language and country. It doesn't identify you.
App verification (Firebase App Check, with Apple's App Attest and DeviceCheck or Google's Play Integrity): checks that requests come from the genuine app, to stop abuse. It doesn't identify you.

4. What we use your data for

To create and manage your account and let you sign in with Apple, Google or a link to your email.
To store your records and calculate your balances, your daily budget, your reports by pay period, month and year, your goals, your streak and your plan to pay off debts.
To send you the reminders you set up: installments, collections, fixed bills, contributions to your goals and your streak, by notification, widget, Live Activity or email.
To read your photos and answer in the chat with artificial intelligence, only when you use those features (section 5).
To run the shared couple, family and business spaces according to what each member decides to share.
To apply your plan, your credits, your top-ups, usage gifts and the automatic pause.
To handle your support requests and your rights as a data subject.
To prevent abuse, fraud and uses that put the service at risk, and to comply with legal obligations.
To improve Oslo with aggregate statistics that don't identify you (for example, how many entries are made by voice).

We don't sell your data, we don't rent it and we don't use it for third-party advertising. Oslo doesn't show ads.

5. Artificial intelligence

Some features use Google's Gemini models through Google Cloud Vertex AI: reading photos of receipts and statements, understanding texts the phone didn't understand, the chat with Oslo, AI missions and summaries and in-depth analyses.

Only if you use it: the free plan sends nothing to the AI. With a top-up or a plan, only what's needed for the feature you requested is sent: the image or text to read, your question and a summary of your financial data that serves as context (for example, your balances for the period or your upcoming installments).
The engine calculates, the AI writes: balances, interest, installments, projections and credits are calculated by Oslo's code; the AI doesn't decide numbers or make changes without your confirmation.
No training on your data: under Vertex AI's terms, Google doesn't use the content we send to train its models.
It can make mistakes: check what the AI reads before confirming it. Every entry can be corrected or undone.

6. Your authorization

By creating your account you accept this policy and authorize the processing of your data for the purposes above. Phone permissions (microphone, camera, photos, notifications and, if you turn them on, phone usage) are requested only when you use the feature that needs them, and you can revoke them in your phone's settings. We keep proof of your acceptance (date and policy version).

Oslo doesn't ask you for sensitive data. If, when logging an expense, you write something that reveals sensitive information (for example, a health expense), you do so voluntarily and we treat it with the same confidentiality as the rest of your records, without using it for anything other than showing it to you.

You can revoke your authorization whenever you want (section 13). If you do, we will delete your account and your data, except what the law requires us to keep.

7. Couples, families and businesses

You decide what you share. In a couple or family space, each transaction and each debt is yours or the household's. The household's is seen by the space's members; yours, only by you.
No surveillance between adults: in a family, adults see the household dashboard, not another adult's details, except what that adult shares.
Whoever pays for a space's plan sees the use of the shared credits (scans and messages), not the content of what others ask.
When you leave a space, what you shared in it may remain visible to the others as part of the household's history; your own records leave with you.
The Business space lives separately from your personal money and only its members can see it.

8. Children and adolescents

You must be of legal age to create your own Oslo account. Minors only take part within a family space created by an adult who is their mother, father or legal guardian, who authorizes the processing of their data. As required by Law 1581 and Decree 1377, we process minors' data respecting their best interests and their rights, and taking their opinion into account according to their maturity.

For a minor, we only process what's necessary: their name or nickname, their virtual allowance, their goals, their challenges, their records and the settings the adult defines.
Minors don't use artificial intelligence and don't receive news emails.
Parental controls are optional and always visible to the minor: approved categories, screen-time goal and what each person sees. If the phone-usage challenge is turned on, Oslo uses the aggregate data the phone's system provides with the permission of the adult and the minor.
The adult can ask us at any time to delete the minor's data.

9. Who we share data with

We don't sell or assign your data. We only share it, as needed, with:

Other members of your spaces

What you decide to share in a couple, family or business space (section 7).

Processors that handle data on Oslo's behalf

Google Cloud and Firebase (Google LLC): sign-in, database (Firestore), server functions, temporary image storage, remote configuration (Remote Config), notification delivery (Firebase Cloud Messaging), crash reports (Crashlytics), app performance (Performance Monitoring), usage statistics (Google Analytics for Firebase) and app verification (App Check).
Google Cloud Vertex AI (Google LLC): the Gemini models that read images and texts and write the chat answers and summaries (section 5).
RevenueCat, Inc. (United States): manages the status of your purchases and subscriptions made in the App Store and Google Play. It receives an identifier of your Oslo account and the purchase data provided by the stores; it doesn't receive your financial records.
Resend, Inc. (United States): sending Oslo's emails (your week, your month, installment and collection reminders, the sign-in link). It receives your email, your first name and the content of each email, which may include amounts, names of your goals or debts and the first name of whoever owes you.
Apple and Google: sign-in with their account, push notifications on iPhone and Android, and the sale of plans and top-ups in their stores. Apple and Google are responsible for the payment data they process under their own policies.

Payment reminders and summaries are shared from your own WhatsApp: Oslo opens the app with the text ready and you decide whether to send it. Oslo doesn't connect to WhatsApp or send data to Meta.

Authorities

When required by law or by an order from a competent authority.

10. International transfer and transmission

Your data is stored on Google Cloud and Firebase servers located in the United States (us-central1 region). Vertex AI, RevenueCat and Resend also process data in the United States. This is an international transmission of data to processors acting on Oslo's behalf, under contractual terms that require them to protect your information with adequate standards. By accepting this policy you authorize this transmission.

11. How long we keep it

Your records, goals, debts, collections, spaces and chat: as long as you have an account.
Photos of receipts, statements and notebooks: only for the time it takes to read them; they're deleted as soon as the AI extracts the text.
Audio: it never reaches our servers.
AI usage counters: as long as you have an account, for your credits and to control costs.
Purchase records: for as long as accounting, tax and consumer protection rules require.
When you delete your account: we delete your data from the database within 30 days at most, except what the law requires us to keep. What you shared in a household space may remain in that space's history without your name.

12. Your rights

As the data subject you have the right to:

Know the data we have about you and how we use it.
Update and correct your data. In Oslo you can correct any entry with one tap.
Request proof of the authorization you gave us.
Be informed about how we use it.
Delete your data and revoke your authorization, when there is no legal or contractual duty to keep it.
Access your data for free: “Export everything” creates a file with your data on your phone, which you can save or share.
File complaints with the Superintendence of Industry and Commerce (SIC), after having made your inquiry or claim to us.

13. How to exercise them

The fastest way is from the app: in Settings, “Export everything” creates a file with your data that you save or share from your phone, and “Delete my account and everything in it” deletes your account. If you no longer have the app, you can request deletion at oslofinanzas.com/eliminar-cuenta. You can also write to us at soporte@oslofinanzas.com with your name, your account's email, what you're requesting and how we should reply. We may ask you to confirm that you are the data subject.

Inquiries (knowing your data): we respond within 10 business days at most. If we can't make it, we tell you why and respond within 5 more business days at most.
Claims (correcting, updating, deleting or revoking): we respond within 15 business days at most. If we can't make it, we tell you why and respond within 8 more business days at most. If the claim is incomplete, we ask you for what's missing within the following 5 days; if you don't complete it within 2 months, it's understood that you withdrew it.

If you're not satisfied, you can go to the Superintendence of Industry and Commerce (www.sic.gov.co).

14. Security

We protect your data with reasonable technical and organizational measures: encrypted connections, data encrypted at rest in Google Cloud, access rules so each person reads and writes only their own data and what's shared with them, credits, plans and gifts that only the server can change, images deleted as soon as they're read and restricted administrative access. No system is infallible: if an incident affects your data, we will let you know and report it to the SIC as the law requires.

Take care of your phone too: Oslo can ask for Face ID or your fingerprint to open if you turn it on in Settings.

15. Notifications and emails

Oslo sends you at most one grouped notification a day, at the time you choose, plus the one on the day an installment is due. Emails (your week, your month, the installment, the collection, the streak and your year) can be turned off one by one in Settings or with the “Unsubscribe from this email” link each one includes. Sign-in link emails and your account's security notices can't be turned off while you have an account. We never send third-party advertising.

16. Website and cookies

This website doesn't use advertising cookies or third-party analytics tools. Fonts are loaded from Google Fonts, which receives technical data from your browser (such as your IP address) to deliver them.

17. Changes to this policy

We may update this policy. We will publish the new version here with its date and, if the change is important (for example, a new purpose or a new processor handling your financial records), we will let you know in the app and ask for a new authorization when the law requires it.

Effective date: this policy is effective from its publication on this website.

18. Contact

Controller: Duván, an individual, operator of Oslo Finanzas
Address: Montería, Córdoba, Colombia
Email for personal data: soporte@oslofinanzas.com