Privacy Policy
Colato Finance is a personal budget app. This policy explains what information it handles, why, where it is kept, who it is shared with, and how you can remove it. It is written to match what the software actually does.
1. Information we handle
| Information | Where it comes from | Why we need it |
|---|---|---|
| Account: email address, display name, password (stored only as a one-way hash) | You, when your account is created | To sign you in and keep your data separate from everyone else's |
| Budget data: expenses, categories and limits, recurring and yearly payments, savings goals, shopping list, pantry | You, and receipts you send or connect | To provide the app |
| Optional WhatsApp number | You, in Settings | To recognise receipts you send to the assistant on WhatsApp and save them to your account only |
| Google user data (only if you press “Connect Gmail”): your Gmail address, a Google refresh token, and the content of emails from the senders on your list | Google, with your permission | To turn those emails into expenses (see section 2) |
2. Google user data (Gmail)
Gmail access is optional and starts only when you press Connect Gmail and approve Google's consent screen. We request one Gmail permission, gmail.modify, plus your email address (to show which account is connected).
- What we read. Only unread emails whose sender matches an entry on your own sender list (it starts as a copy of a default list of banks and utilities and you can add, pause or remove entries). Emails from any other sender are ignored and not stored.
- What we do with it. From each matching email we use the first part of the text to find the amount, merchant, date and type of transaction, and save that as an expense in your account. We also keep the first 800 characters of the cleaned email text with that expense, and the identifier Gmail gives that message (a short code, not the message itself), as a record of where the entry came from and to avoid saving the same email twice. Afterwards the email is marked as read in your Gmail. We never send, delete, forward or reply to email, and we do not read attachments.
- What we do not do. We do not use Google user data for advertising, we do not sell it, we do not use it to build or train any model, and no person at Colato Corp reads your emails except where you ask for support or where the law requires it.
- Limited Use. Colato Finance's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- Disconnecting. You can disconnect in Settings at any time. That stops reading, deletes the stored token, deletes the automation created for you, and revokes our access at Google. You can also remove access in your Google Account permissions. Expenses already saved stay in your budget until you delete them.
3. Who else handles your email text
To find the amount, merchant and date in an email, the sender, the subject and up to the first 1,500 characters of the body are processed by an automated text-reading service operated by an outside provider. It receives only that text, never attachments and nothing else from your account or mailbox, and we use it only for that purpose. We do not control that provider's own retention practices. We are replacing this step with fixed rules that run only on our own servers, and this page will be updated when that is done. Our servers run on infrastructure operated by Colato Corp in El Salvador, where an automation tool fetches your emails and a database stores your budget. We do not share your data with anyone else, except where the law requires.
4. How data is protected
- Each account's data is kept separate and every request is limited to the signed-in account.
- Your Google refresh token is stored encrypted. Passwords are stored only as hashes.
- All traffic between your browser and the app uses HTTPS.
- Access to the servers is restricted to the operator.
No system is perfectly secure. If a breach affecting your data occurs, we will tell you without undue delay.
5. How long we keep it
Budget data is kept while your account exists. When you disconnect Gmail, the token and the automation are deleted immediately. You can delete individual expenses at any time. To delete your whole account and all of its data, write to gcolato@colatocorp.com from the email address of the account; we will do it within 30 days and confirm by email.
6. Your choices and rights
You can see and edit your data in the app, disconnect Gmail, pause or remove senders, ask for a copy of your data, ask us to correct it, or ask us to delete it, by writing to the address above.
7. Children
Colato Finance is not directed to children under 16 and we do not knowingly collect their data.
8. Cookies and tracking
This website uses no cookies and no analytics. The app stores a sign-in token and your display preferences in your browser so you stay signed in.
9. Changes
If we change what we do with your data, we will update this page and its date, and ask for your permission again where Google requires it.
10. Contact
Colato Corp, El Salvador · gcolato@colatocorp.com