Privacy and Personal Data Policy — doble

Last updated: October 20, 2026
Version: 2.3

Note: This is an English courtesy translation. The Spanish version is the legally binding one; in the event of any discrepancy, the Spanish version prevails.

1. Data controller

HNTR S.A.S. ("doble", "we", or "the Controller"), a company identified with tax ID (NIT) 901.633.274-6, domiciled in Medellín, Colombia, is responsible for processing the personal data collected through the doble application and the website doble.money.

For any matter relating to the processing of your personal data, you can contact us at: soporte@doble.money

This policy is issued in compliance with Law 1581 of 2012, Decree 1074 of 2015, and other applicable Colombian regulations on the protection of personal data.

2. Who this policy applies to

doble is intended exclusively for people over 18 years of age. We do not knowingly collect data from minors. If we discover that we have collected a minor's data, we will delete it.

By creating an account, you declare that you are of legal age and authorize the processing of your data in accordance with this policy.

3. What data we collect

3.1 Registration and account data

• The name you choose to display.
• Email address (for authentication and service communications).
• A unique forwarding address assigned to your account.
• A record of your acceptance of this policy and of the Terms and Conditions (date and version).

3.2 Financial data

doble works from the transaction alerts your bank sends you by email and that you voluntarily forward to your unique doble address. From those emails, and from the information you enter manually, we process:

• The amounts, currency, and exchange rate of your transactions.
• The name or description of the transaction's counterparty.
• The counterparty's identifier when the email includes it (for example, the last digits of a destination account).
• The originating bank, product type (savings account, card, etc.), and the last four digits of the product.
• The date, category, and nature of the transaction (income, expense, or internal transfer).
• Information about your accounts, cards, loans, savings goals, and budgets that you record.

What doble NEVER asks for or stores

doble does not ask for, does not receive and does not store your bank credentials. Specifically, and without exception:

• The password, username or access code for your online banking or your banking app.
• The full number of a card or an account.
• The card's security code (CVV, CVC, or the three or four digits on the back).
• The card's expiry date.
• The PIN of the card or for ATMs.
• One-time codes that your bank sends you by text message or email (OTP), nor tokens or dynamic passwords.

If someone asks you for any of that claiming to be from doble, it is not doble. We will never ask you for them through any channel: not in the support chat, not by email, not by phone, not by message.

The only thing doble asks for in order to recognize a product is the last three or four digits, which is the same fragment your bank prints on your statement and shows in its alerts. They serve one purpose: knowing which of your accounts a transaction belongs to. The app does not accept more digits than necessary —the field trims them— and our database rejects any value that is not three or four digits, so a full number cannot end up stored even if someone tries.

Why that fragment is not sensitive data:

• It cannot be used to pay or to move money. A transaction requires the full number together with the expiry date and the security code, and doble has none of the three.
• It does not identify your account outside doble. Thousands of cards end in the same four digits; on their own they point to no particular person or product.
• It is the fragment that the payment card industry standard (PCI DSS) itself allows to be displayed. That standard requires the number to be masked and sets the first six and last four digits as the maximum that may be shown; doble stores less than that, because it never keeps the first six.
• It is not "sensitive data" within the meaning of article 5 of Colombia's Law 1581 of 2012, which reserves that category for data revealing racial or ethnic origin, political orientation, religious or philosophical convictions, union or organization membership, health, sex life and biometric data. Nor is it a special category under article 9 of the European GDPR.

That does not mean we treat it with any less care. Linked to your account it remains your personal data, protected by this policy and by the same security measures of section 9, and you keep all the rights of section 7 over it.

3.3 Forwarded emails

In order to process your transactions, we temporarily store the content of the bank alert emails you forward. This content is retained for a maximum of 60 days, after which it is automatically deleted, keeping only the record of the already-processed transaction. Emails that are not bank alerts are deleted within a maximum of 15 days.

3.4 Voice dictation

The application lets you record a transaction by saying it out loud. In that case:

• The audio never leaves your device. Speech recognition is performed by your phone's own operating system and produces text; we do not receive, transmit, or store the recording.
• The resulting text is sent to our servers and, from there, to our artificial intelligence provider (Anthropic), for the sole purpose of extracting the transaction data from the text: amount, nature (income or expense), counterparty, and suggested category.
• The text is processed transiently for that single purpose, is not used to train models, and is not retained once the transaction has been extracted. What is stored in your account is the transaction you confirm, not the sentence you dictated.
• Use of the microphone and of speech recognition requires your express permission, which your phone asks for the first time and which you may revoke at any time in your system settings.

3.5 Subscriptions

When you purchase a paid plan, we process your doble account identifier, the plan purchased, its status (trial, active, cancelled, or expired), and the date through which you have access. We do not receive or store your payment method details: billing is handled by the App Store (Apple), Google Play or Paddle, depending on where you purchased. If you purchased from your browser, billing is handled by Paddle, acting as merchant of record: it receives your payment method details, the country you are purchasing from — which determines the applicable tax — and your email address, and issues your invoice. So that we can find your subscription when you write to support, our subscription provider (RevenueCat) also receives your email and your name.

3.6 Technical data

• Session data to keep your account active (stored as strictly necessary cookies on the website, and in the device's secure keychain in the application).
• Application preferences (visual theme, language, and base currency), stored locally on your device and in your profile.
• A device identifier for sending push notifications, when you authorize them. You can revoke it by turning off notifications in your phone's settings.
• When you send us a comment from the Feedback section, we automatically attach the application version, device model, operating system version, and language, so that we can reproduce what you report.
• Each time you open the application, we record the platform (iOS, Android, or web), the doble version, the device model, the operating system version, and the language. We use this to know which versions are still in use and to support you.
• Our authentication provider keeps, for security, the date of each session and the application or browser from which it was started. We use this technical data only in aggregate, to count how many people use doble and on which platform.

Inside the doble app (iOS, Android, iPadOS and macOS) and on the website screens you reach while signed in, we do not use analytics tools, advertising, third-party trackers, or behavioral profiling. Your financial information is never shared with advertising providers.

3.7 Support conversations

The app includes a chat for talking to our support team. When you use it, we store:

• The text of the messages you write and of the replies we give, along with the date and time of each one.
• Any images you choose to attach, and those we send you.
• Technical data from the moment of sending: the app version, the platform and the language, so we can understand what you are seeing on screen.

Who can read that conversation. Only you and the people on our team authorized to handle support. It is not a public channel and it is not visible to other users, and our team's access is limited to handling your request, in accordance with section 9.

Never write your credentials to us. Our team will not ask you for your bank password, the full number of a card, its security code or a one-time code, and does not need them in order to help you. If you write them in the chat on your own, they will be stored in the conversation like any other message: that is why we ask you not to.

Think before attaching an image. A screenshot of your bank may contain account numbers, balances and third-party names. Attach only what we need in order to help you, and hide what is not necessary. Images are stored in a private space: they have no public address and cannot be viewed without being signed in as part of that conversation.

How long they are kept. Images are deleted automatically after 90 days, counted from the last message in the conversation; the message remains, indicating that the image has expired. The text of the conversation is kept for as long as your account exists, because it is the record of what you asked and what we answered, and it is deleted together with your account in accordance with section 8.

Notifications. So that you know we have replied, we send you a push notification that includes the name of whoever is writing and the beginning of the message; you can turn it off from your phone's notification settings. Internally, our team receives an email notice when someone opens a new conversation.

3.8 Public website (doble.money)

The public pages of the site — the home page, Pricing, Download, dobletab, Apple Pay and these legal documents — use the Meta pixel to measure how many people visit them and how many continue to the App Store or Google Play.

• Scope: those public pages only. The pixel is not present in the app or on any screen reached while signed in, such as Transactions, Accounts, Reports or Shared.
• Data sent to Meta: the address of the public page visited, the IP address, the browser and device, and an event when you tap a link to an app store. No financial data, email address, name or user identifier is sent.
• Consent: if you visit us from the European Union, the European Economic Area, the United Kingdom or Switzerland, the pixel is not loaded until you accept it. If you decline, it is not loaded at all and the site works the same. You can change your decision by clearing the site data in your browser.
• Purpose: measuring the effectiveness of our communication and advertising. It is not used to make decisions that affect you.

3.9 Conversations with the assistant

doble includes an assistant that answers questions about your own finances. From 20 October 2026, that conversation is saved so that you find it again when you come back, like any chat. We store:

• The text of your questions and of the assistant's answers, each with its date and time.
• The figure cards the assistant shows beneath an answer, and the proposals it presented to you, with the outcome of each one: whether you confirmed it or it expired without being confirmed.

Who can read that conversation: only you. This is not the situation described in section 3.7: there, a person from our team is on the other side; here there is nobody. Our support team has no access to your conversations with the assistant.

How long it is kept. For as long as your account exists, or until you delete the conversation, whichever comes first. Deletion is permanent and immediate: we do not keep a copy. You can delete it at any time from the assistant's own screen, and it is deleted together with your account in accordance with section 8.

The figures stay as they were written. If you later change your base currency, the amounts shown in an earlier conversation are not recalculated: a conversation is the record of what you asked and of what we answered at that moment.

If you would rather it was not saved. You can turn the assistant off in Settings → Preferences; while it is off it does not answer and nothing new is saved. What was already saved remains until you delete it.

4. Why we use your data (purposes)

We process your personal data to:

1. Provide the service: automatically process and organize your financial transactions.
2. Authenticate your identity and keep your account secure.
3. Enable the shared-finances features ("circles"), when you choose to share information with other people.
4. Send you necessary communications about the service (access codes, important notices).
5. Manage your trial period and your subscription: check whether you have active access, activate the plan you purchase, and administer shared plans.
6. Comply with legal obligations and respond to requests from competent authorities.
7. Answer the questions you put to the doble assistant and prepare the actions you ask it for, always subject to your confirmation, as described in section 6.

We do not use your data for purposes other than those stated here without your prior authorization.

5. Shared finances (circles)

doble lets you create "circles" to share financial information with other people (partner, family, friends). When you share a transaction with a circle, the other members of that circle can see:

• The amount you contribute to the circle.
• The counterparty or description of the transaction.
• The category assigned within the circle.
• The bank, the product type, and the last four digits of the product.
• The date and the nature of the transaction.
• Your profile name and email.

The other members cannot see your private category or, when you contribute only a fraction of an income, the total amount of that income.

You decide which transactions you share and with which circle. Sharing is always a voluntary and reversible action.

6. Who we share your data with (data processors)

To operate the service we use technology providers that act as data processors under our instructions:

International data transfers: some of these providers process data on servers located outside Colombia. By accepting this policy, you authorize such international transfers, which are carried out with providers that offer adequate levels of security and under data processing agreements.

We do not sell or transfer your personal data to third parties for commercial purposes.

Artificial intelligence processing: we use an artificial intelligence provider (Anthropic) in three cases, and solely for the purpose stated in each one:

1. When our automated systems cannot read a bank alert email, the text of that email is sent in order to obtain the amount, date, merchant, and last four digits. Already-processed emails are kept for a maximum of 60 days.
2. When you dictate a transaction by voice, the text produced by your phone is sent — never the audio — in order to obtain the amount, nature, counterparty, and suggested category, as described in section 3.4.
3. When you write to the doble assistant, your question is sent together with whichever of your account data is needed to answer it: amounts, dates, categories, and the names of the merchants, accounts, or circles involved. Your email address, your ID document, your passwords, your forwarding address, the text of your bank emails, and your images are never sent. The assistant only acts when you write to it: it does not review your information on its own initiative or in the background. Figures are computed by doble, not by the model. Before creating or changing anything, the assistant shows you what it is going to do and waits for your confirmation; nothing is written automatically. The assistant comes switched on and you can switch it off at any time in Settings → Preferences; while it is off, the assistant cannot read any of your data, and that restriction is enforced on the server.

In all three cases this is automated, narrowly scoped processing, the data is not used to train models — this is agreed contractually with the provider, which also deletes it within the following 30 days — and no decision with legal effects on you is made: the result is always a proposal — a transaction, an answer, or an action — that you review, correct, or discard.

7. Your rights as a data subject

Under Law 1581 of 2012, you have the right to:

• Know, update, and rectify your personal data.
• Request proof of the authorization you granted.
• Be informed about how your data has been used.
• File complaints with the Superintendency of Industry and Commerce (SIC) for violations of the law.
• Withdraw your authorization and/or request the deletion of your data, where no legal or contractual duty prevents it.
• Access your personal data free of charge.

How to exercise your rights

You can exercise these rights by writing to soporte@doble.money. We will handle inquiries within a maximum of ten (10) business days and complaints within a maximum of fifteen (15) business days, as required by law.

In addition, the application lets you delete your account directly from Settings, at any time.

Users outside Colombia: if you are in the European Union, the United Kingdom, Brazil, or another jurisdiction with data protection laws, you also have the rights granted by your local law (access, rectification, erasure, portability, and objection), and you can exercise them by writing to soporte@doble.money. International transfers of your data are carried out with the appropriate safeguards provided by those laws.

8. Account deletion and data retention

When you request the deletion of your account:

• A 15-day grace period begins, during which you can cancel the deletion by logging in again.
• Once that period has elapsed, we permanently delete your transactions, processed emails, accounts, budgets, goals, categories and your support conversations, including any images attached to them, and your conversations with the assistant.
• Information you have shared in circles (contributions or shared expenses) is kept anonymously, identified as "Deleted user", for the sole purpose of not altering the balances of the other circle members.

We retain your data only for as long as necessary to provide the service or to comply with legal obligations. Billing and subscription records that we must keep by law (accounting and tax obligations) are retained for the period required by law, dissociated from your financial information.

Subscriptions: deleting your doble account does not cancel or refund an active subscription, because billing is managed by the App Store or Google Play. You must cancel automatic renewal from your account settings in the store; the procedure is described in section 7.5 of the Terms and Conditions.

9. Information security

We protect your information with encryption in transit and at rest, authentication with strong password requirements, and per-user isolation at the database level: the access rules live on the server, so the application can only read and write the data of the account you signed in with. Administrative access to our systems is protected with two-step verification.

Access by our team. In order to categorize your transactions, generate your reports and provide you with support, doble needs to process your information, and therefore a small number of authorized people can access it. That access is limited to what is strictly necessary to operate the service, respond to a support request from you, or comply with a legal obligation. Support conversations are accessible only to the people authorized to handle them. We do not sell your information, nor do we use it for advertising.

No system is completely infallible. We review our security measures periodically and fix what we find.

10. Supervisory authority

The Superintendency of Industry and Commerce (SIC) is the authority responsible for personal data protection in Colombia. You may file complaints with the SIC whenever you consider it necessary.

11. Changes to this policy

We may update this policy to reflect changes in the service or in applicable regulations. We will inform you of material changes through the application. The current version will always be available within the app.

12. Acceptance

By creating an account and using doble, you declare that you have read and accepted this Privacy and Personal Data Policy, and you authorize the processing of your data in accordance with what is set out here.