PayPlea Privacy Policy

PayPlea (the “App”) and these web pages are operated by Ayudante Digital, established in Spain (“we”, “us”). We are the controller of the personal data described in this policy under the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), Spanish Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights (“LOPDGDD”), the UK GDPR, and the U.S. state privacy laws listed in section 14.

Contact for every privacy matter: hola@ayudantedigital.es. We have not appointed a Data Protection Officer because the law does not require one for our activity; your messages to this address are handled directly by the people responsible for PayPlea. We answer in English or Spanish.

This policy applies to the PayPlea apps for iPhone and Android, to PayPlea accounts, and to the PayPlea pages published on this website. It does not apply to the services of PayPal, Revolut, Cash App or Venmo, Apple, Google or any other company you visit from PayPlea. Those companies are independent controllers and their own privacy policies apply.

PayPlea is only for adults aged 18 or older. See section 16 for children.

PayPlea lets adults publish personal requests for help and lets other adults choose to send an optional gift directly to the person who asked. When you tap a payment option, PayPlea opens the recipient’s personal PayPal, Revolut, Cash App or Venmo link outside the App. The payment happens entirely inside that provider’s service. PayPlea never receives, holds, routes, pools or withdraws those funds, never takes a fee from them, and never sees your card, bank or provider login credentials.

The only payment PayPlea itself receives is optional support for the developer, purchased through the Apple App Store or Google Play. Apple or Google processes that purchase; we receive only the information described in section 4.

Data you give us

• Account data: name, email address, password (stored only as a salted hash by our authentication provider), and your confirmation that you are 18 or older. If you use Sign in with Apple, we receive a unique Apple user identifier and the name and email address you choose to share, which may be an Apple private relay address.
• Profile data: display name, profile photo, short bio, country and city (entered by you; we do not collect GPS location).
• Requester data: if you publish a request, your phone number, private contact details and the personal payment links or handles you choose to add for PayPal, Revolut, Cash App or Venmo.
• Request content: the story, category, goal amount and currency, images and any private supporting document (image or PDF) you upload.
• Gift records: when you return to PayPlea after giving, the amount, currency, provider and recipient you declare, and the receipt image you upload.
• Community content: comments, direct messages, reports and blocks.
• Support correspondence: the messages you send to hola@ayudantedigital.es and our replies.

Data created when you use PayPlea

• Identifiers: your PayPlea user ID and, if you allow notifications, a push-notification token issued by Apple (APNs) or Google (Firebase Cloud Messaging) and linked to your account.
• Product interaction: requests you save or pass on, filters and preferences, notification settings and read status.
• Verification results: the status of each gift record (pending, verified or rejected) and the result of the assessment described in section 7.
• Purchase records: for optional developer support, the product purchased, the store transaction identifier, date and status. We never receive your card or bank details.
• Technical and security logs: IP address, timestamps, app version, operating system and request logs kept by our hosting providers to secure and operate the service.

Data we do not collect

PayPlea does not collect precise location, contacts, browsing or search history outside the App, audio, or fitness data. It contains no advertising SDKs, no advertising identifier (IDFA/AAID) and no third-party analytics or tracking tools.

Some requests involve health, family or financial hardship. Information about health, or other special categories of data under Article 9 GDPR, is processed only when you choose to include it in a request, a supporting document or a message. Before you publish, PayPlea asks for your explicit consent to process that information (Article 9(2)(a) GDPR). Information you choose to include in the public part of a request is information you have manifestly made public (Article 9(2)(e) GDPR).

Include only what is necessary. Do not publish other people’s health information, identity documents or account numbers. Our moderators may redact or remove sensitive details from public requests to protect you or third parties. You can withdraw your consent at any time by editing or deleting the request; this does not affect processing that took place before.

• Creating and running your account, publishing requests, showing payment links, comments, messages and progress, to provide the service you asked for. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• Reviewing requests before publication, assessing receipts, and keeping progress figures accurate, so that the confirmed totals shown to the community are reliable. Legal bases: contract (Article 6(1)(b)) and our legitimate interest in the integrity of the platform (Article 6(1)(f)).
• Moderation, preventing fraud and scams, safety, handling reports, enforcing our Terms, and security. Legal bases: legitimate interests in protecting users and the service (Article 6(1)(f)) and compliance with legal obligations, including the EU Digital Services Act (Article 6(1)(c)).
• Push notifications about messages, comments and request progress. Legal basis: your consent, given through your device’s notification permission and withdrawable at any time in your device settings (Article 6(1)(a)).
• Sensitive information you include: your explicit consent or information you have made public (section 5), and the establishment or defence of legal claims (Article 9(2)(f)).
• Optional developer support records: contract (Article 6(1)(b)) and legal accounting and tax obligations (Article 6(1)(c)).
• Answering support and privacy requests: contract or legitimate interest (Article 6(1)(b) and (f)) and legal obligations for rights requests (Article 6(1)(c)).
• Service emails such as account confirmation, password reset, security alerts and policy changes. Legal basis: contract and legitimate interest. We do not send marketing emails.
• Responding to lawful requests from authorities and protecting legal rights: legal obligation (Article 6(1)(c)) and legitimate interest (Article 6(1)(f)).

When you upload a receipt, PayPlea checks whether the image is consistent with the provider, amount, currency and recipient you declared. This check is performed automatically with the help of OpenAI’s API. Clear matches can be marked verified automatically; uncertain cases stay pending until a human administrator reviews them. A pending record never increases confirmed progress or closes a request.

This assessment only decides whether a gift is counted in the public confirmed total of a request. It does not determine whether a payment provider settled a transaction, it does not affect your legal rights, and it is not used to profile you. You can always ask for a human to review any result, explain your point of view and contest the decision by writing to hola@ayudantedigital.es.

Public to other PayPlea users: your display name, profile photo, bio, country, published requests (story, category, images you mark as public, goal and confirmed progress), comments, and the payment options you added to a request, which other users need in order to give to you.

Never public: your email address, phone number, private contact details, supporting documents, receipt images, the amounts declared in individual gift records, your saved or passed requests, your blocks and your reports. Direct messages are visible only to the participants in the conversation and, when a conversation is reported, to our moderators.

When you open a payment link, the provider receives the information inherent to that link and anything you enter in its service, under its own privacy policy.

We share personal data only with the following recipients and only as needed for the stated purposes:

• Supabase, Inc.: authentication, database, file storage and server functions (processor).
• OpenAI, L.L.C. / OpenAI Ireland Ltd.: automated assessment of receipt images (processor). Under OpenAI’s API terms, data sent through the API is not used to train its models.
• Apple Inc. / Apple Distribution International Ltd.: Sign in with Apple, push notifications (APNs) and App Store purchases. Apple acts as an independent controller for the App Store.
• Google LLC / Google Ireland Ltd.: Firebase Cloud Messaging for Android notifications and Google Play billing. Google acts as an independent controller for Google Play.
• Vercel Inc.: hosting of these web pages (processor).
• Our email service provider: hosting of the mailbox hola@ayudantedigital.es (processor).
• Other PayPlea users: the public information described in section 8.
• Authorities, courts and advisers: when required by law, to respond to valid legal process, to report suspected crimes or imminent threats to life or safety (including under Article 18 of the Digital Services Act), or to establish or defend legal claims.
• A successor: if PayPlea is transferred, merged or reorganised, the recipient will be bound by this policy, and we will tell you in advance.

Our processors act only on our documented instructions under data processing agreements (Article 28 GDPR). We do not sell personal data, rent it, or share it for advertising.

Some of the providers listed above process data in the United States or other countries outside the European Economic Area. When this happens, we rely on an adequacy decision of the European Commission (including the EU–U.S. Data Privacy Framework where the recipient is certified) or on the Standard Contractual Clauses approved by the European Commission, together with the UK Addendum for UK data, plus the provider’s additional security measures. You can request a copy of the relevant safeguards at hola@ayudantedigital.es.

• Account, profile, requests, comments, messages and preferences: while your account is active. When you delete your account, we delete this data from our active systems within 30 days.
• Receipts and supporting documents: until 12 months after the related request closes, or until you delete your account, whichever comes first.
• Data under an open report, fraud investigation or legal claim: until the matter is resolved and then for up to 12 months, or longer only if a law, court or authority requires it.
• Moderation decisions and statements of reasons: 12 months after the decision.
• Accounts banned for fraud or abuse: a one-way hash of the email address for 24 months, only to prevent re-registration.
• Developer support purchase records: 6 years, as required by Article 30 of the Spanish Commercial Code and tax law.
• Support and privacy correspondence: 24 months after the last message, and records of rights requests for 3 years to demonstrate compliance.
• Technical and security logs: up to 90 days.
• Backups: deleted data may remain in encrypted backups for up to 30 days until they are overwritten.
• Push tokens: deleted when you sign out, delete your account, or the token becomes invalid.

We protect data with encryption in transit (HTTPS/TLS), encryption at rest provided by our hosting providers, row-level access controls in the database so each user can only access their own private data, private storage for receipts and documents, least-privilege administrator access, and secret keys kept only on the server. No system is perfectly secure. If a personal data breach is likely to result in a risk to you, we will notify the Spanish Data Protection Agency within 72 hours and, where required, inform you without undue delay.

You have the right to:

• access your personal data and receive a copy;
• correct inaccurate or incomplete data;
• have your data erased;
• restrict processing in certain cases;
• receive your data in a portable, machine-readable format;
• object to processing based on legitimate interests;
• withdraw consent at any time, without affecting processing done before;
• not be subject to a decision based solely on automated processing with legal or similarly significant effects, and to obtain human review (section 7).

Many of these can be exercised directly in the App (edit profile, export data, delete account). Otherwise, write to hola@ayudantedigital.es from the email linked to your account. We answer within one month, extendable by two further months for complex requests, and we may ask for information to confirm your identity. Exercising your rights is free.

You can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es) or to the supervisory authority where you live or work. UK residents can contact the Information Commissioner’s Office (ico.org.uk). We would appreciate the chance to resolve your concern first.

This section supplements the policy for residents of the United States, including California (CCPA as amended by the CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island. We extend the rights below to all U.S. users, whether or not a particular law applies to us.

Categories of personal information collected in the last 12 months

• Identifiers (name, email, user ID, push token, IP address).
• Personal records (phone number, payment handles you add).
• Commercial information (gift records you declare, developer support purchases).
• Internet or electronic activity within the App (saved and passed requests, preferences).
• Approximate geolocation (the country and city you type).
• Audio, electronic and visual information (photos, receipts and documents you upload).
• Sensitive personal information: account login credentials, the contents of direct messages, and health information only if you include it.

Sources: you, your device, Apple and Google (sign-in, notifications, purchases) and other users (comments, messages, reports). Purposes: those in section 6. Each category is disclosed for business purposes only to the service providers listed in section 9. Retention: section 11.

No sale, sharing or targeted advertising

We do not sell personal information, we do not “share” it for cross-context behavioural advertising, we do not process it for targeted advertising, and we do not use it for profiling that produces legal or similarly significant effects. We have no actual knowledge of selling or sharing data of consumers under 16. We use sensitive personal information only to provide the service and for the purposes permitted by Cal. Code Regs. tit. 11, § 7027(m), so no “limit” link is required. We honour Global Privacy Control signals as a request to opt out, although there is nothing to opt out of.

Your rights

You may request to know or access the personal information we hold, to correct it, to delete it, to receive it in a portable format, and to opt out of sale, sharing, targeted advertising and profiling. Send requests to hola@ayudantedigital.es or use the export and delete tools in the App. We confirm receipt within 10 business days and respond within 45 days (extendable once by 45 days with notice). We verify requests by matching the email address of your account. You may use an authorised agent with your signed permission. We will not discriminate against you for exercising any right.

If we decline your request, you can appeal by replying with the subject “Appeal”. We answer appeals within 60 days (45 in some states) and explain our reasons. If you are not satisfied, you can contact your state Attorney General.

Other U.S. disclosures

California “Shine the Light”: we do not disclose personal information to third parties for their direct marketing. Do Not Track: because we do not track users across third-party sites or apps, we do not respond differently to browser Do Not Track signals. Nevada: we do not sell covered information.

This section is our consumer health data privacy policy under the Washington My Health My Data Act (RCW 19.373), Nevada SB 370 and Connecticut’s consumer health data provisions.

• What we collect: only health information you choose to include in a request, supporting document, comment or message, for example a description of a medical bill. We do not infer health status.
• How we collect it and why: directly from you, with your consent, solely to publish and review your request, verify progress, moderate content and keep the community safe.
• Who receives it: other users, for information you make public; Supabase and, for receipt images, OpenAI, as processors; authorities only when legally required.
• What we never do: sell consumer health data, use it for advertising, or geofence health care facilities.
• Your rights: confirm whether we hold your consumer health data, access it and the list of recipients, withdraw consent and request deletion, by writing to hola@ayudantedigital.es. Appeals follow the process in section 14.

PayPlea is not directed to children and may only be used by adults aged 18 or older. We do not knowingly collect personal data from anyone under 18, including children under 13 under the U.S. Children’s Online Privacy Protection Act (COPPA). If we learn that a minor has created an account, we delete it. If you believe a minor is using PayPlea, write to hola@ayudantedigital.es.

• Camera: optional, used only when you choose to photograph a receipt or document.
• Photos: optional, used only to pick images you choose to upload.
• Notifications: optional, used for activity alerts.

We will update this policy when PayPlea or the law changes. The date at the top shows the latest version. If a change materially affects how we use your data, we will notify you in the App or by email before it takes effect and, where the law requires, ask for your consent again.

Ayudante Digital, Spain. Email: hola@ayudantedigital.es. See also our Terms of Use, account deletion page and Support.