Rounddrop

Privacy policy

Version 2026-10-18

This English version is a courtesy translation. If it differs from the Spanish version, the Spanish version prevails.

1. Who processes your data

FOS Systems Solutions S.L., with Tax ID B87180022 and registered address at C. de Cristóbal Bordiú, 49, 28003 Madrid, is the controller of the data we process in Rounddrop. For anything about your data, write to us at [email protected]. We don't have a data protection officer because the law doesn't require one; requests are handled directly by the company's management.

2. What data we process

  • Your account: your email address, your name, your language and your preferences (notifications and reminders).
  • If you sign in with Google or Apple: your account identifier, your name and your email (if you choose to hide it with Apple, the relay address Apple gives you), and with Apple a token we only use to revoke its permission if you delete your account.
  • What you add to your groups: people's names, expenses and payments with their amounts, dates, categories and currencies, notes, comments and the photos and documents you attach. Photos are stored without location or camera data.
  • Scan receipt: the photo of the receipt, which is sent to an artificial intelligence service only to read the amount, the date and the shop. It then stays attached to the expense.
  • Your phone number for Bizum, if you add it. It is stored encrypted and only the people in your groups see it, if you choose to show it.
  • Notifications: if you turn them on, the address your browser gives or your phone's identifier to send them to you.
  • Technical data: IP address, browser, time and what is requested from the server, to keep your session, prevent abuse and fix errors.
  • If you send us your CV through «Work with us»: your name, your email, the area you're interested in, the link and message you choose to add, and the CV with whatever it contains.
  • Public website statistics: if you accept its cookies, Google Analytics records which pages of the website you visit, your type of device and browser, where you came from and your approximate area, with an identifier of your browser. If you don't accept them, it only receives signals without identifiers. It isn't used inside the app.
  • Acceptances: which version of the terms and of this policy you accepted, when and from which connection.

We don't ask for health data or other specially protected data. Please don't put it in notes or attachments.

3. Data other people give us

Someone in a group may add you by your name even if you don't have an account, add expenses you take part in or invite you by email. That person gives us that data. If you want it corrected or deleted, tell them or write to us.

4. What we use it for and on what basis

  • Providing the service: creating your account and letting you sign in, keeping your groups' accounts, showing them to their members, reading receipts when you ask, sending the invitations you send and letting you know about changes in your groups. Basis: the contract you accept when signing up (Art. 6.1.b GDPR).
  • Phone or browser notifications: only if you turn them on. Basis: your consent (Art. 6.1.a), which you withdraw whenever you want by turning them off.
  • Sunday reminder if you owe something. Basis: our legitimate interest in helping you keep your accounts up to date (Art. 6.1.f). You can turn it off in Profile.
  • Assessing your application, if you send us your CV. Basis: your consent (Art. 6.1.a), which you withdraw whenever you want by writing to us.
  • Public website visit statistics: to know which pages are useful and improve them. Basis: your consent (Art. 6.1.a), which you withdraw whenever you want in «Cookie settings».
  • Security and proper operation: attempt limits, bot checks, error and performance logging. Basis: our legitimate interest in protecting the service and its users (Art. 6.1.f).
  • Keeping proof of what you accepted and handling your requests and those of the authorities. Basis: compliance with legal obligations (Art. 6.1.c).

We don't sell your data or build advertising profiles. If there is ever advertising in Rounddrop, we will explain it here first and won't use your data to personalise it without your permission.

We don't make automated decisions that significantly affect you. The artificial intelligence only suggests the content of an expense, and you are the one who checks and saves it.

5. Who else sees it

What you add to a group is seen by the people in that group. Anyone with a group's invitation link can join it.

To provide the service we use these providers, which process data on our behalf and under contract:

  • Laravel Cloud (Laravel Holdings Inc., USA): hosting of the app and the database, on servers in the European Union, and error and performance monitoring (Laravel Nightwatch).
  • Cloudflare (Cloudflare, Inc., USA): network, protection against attacks and bots, storage of photos and documents, and forwarding of the email you send us.
  • Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg): sending emails, from servers in the European Union.
  • Google (Google Ireland Ltd. and Google LLC) and Anthropic (Anthropic, PBC, USA): reading receipts with artificial intelligence, only if you use "Scan receipt".
  • Google (Google Ireland Ltd. and Google LLC): public website statistics (Google Analytics), only if you accept its cookies.
  • Google or Apple (Apple Distribution International Ltd., Ireland), if you sign in with their account; and Apple, for notifications in the iPhone app.
  • Your browser's notification services (Google, Mozilla, Apple or Microsoft), which deliver notifications to your device.
  • jsDelivr (Prospect One sp. z o.o., Poland): when you open an attached PDF, your browser downloads the PDF viewer from there, and jsDelivr receives your IP address.

Some of these providers are based in the United States and may access data from there. Those transfers are made with the safeguards of the GDPR: the adequacy decision of the EU-US Data Privacy Framework, for certified companies, or the European Commission's standard contractual clauses.

We will only give data to the authorities when a law requires us to.

6. How long we keep it

  • Your account (email, name, phone, preferences and notifications): while you have it. If you delete it, it is deleted immediately.
  • What was added in groups with other people: while the group exists. If you delete your account, your expenses and comments stay in the group under your name, unlinked from your account, because they are part of other people's accounts. Before leaving you can remove your comments and attachments.
  • Sign-in codes: 10 minutes.
  • Technical and error logs: up to 30 days.
  • CVs sent through «Work with us»: 12 months from when you send them; then they are deleted.
  • Website statistics: the period set in Google Analytics, 14 months at most.
  • Backups: renewed within a maximum of 30 days.
  • Proof of what you accepted: while you have the account and, afterwards, blocked for 5 years, only to handle possible claims (Art. 32 of the Spanish Data Protection Act). After that period, it is deleted.

7. Your rights

You can access your data, correct it, delete it, object to its processing or ask us to restrict its use, ask for it in a format you can take to another service and withdraw your consent whenever you want (Arts. 15 to 22 GDPR).

  • From the app: change your name and phone in Profile, download each group's expenses, turn off notifications and the reminder, and delete your account (explained in Delete your account).
  • For anything else, write to us at [email protected] from your account email, saying which right you want to exercise.

We reply within one month at most, or three if the request is complex, letting you know within the first month. It's free. If you think we aren't handling your data properly, you can complain to the Spanish Data Protection Agency (aepd.es).

8. Security

All connections are encrypted (HTTPS). There are no passwords to steal: you sign in with a one-time code, with Google or with Apple. The Bizum phone number and tokens are stored encrypted. Photos and documents are in private storage and only the people in the group can see them. Each group is kept separate from the others, and we check this with automated tests.

9. Age

You must be at least 14 years old to use Rounddrop, the age from which Spanish law allows you to consent to the processing of your data (Art. 7 of the Spanish Data Protection Act).

10. Changes

Last updated: 19 October 2026, to describe the public website statistics with Google Analytics, which are only turned on if you accept them, and the CVs sent through «Work with us».

If we change this policy, we will publish the new version here with its date. If the change affects you significantly, we will let you know in the app and by email before it applies and will ask you to accept it again.