Last updated: August 2026
1. Data controller
The controller responsible for the personal data collected through the Apuntao application is:
Fernando González García
Email: apuntao.privacidad@tindeka.com
2. Data we collect
When you use Apuntao we collect the following personal data:
- Name and email address, needed to create and manage your account.
- Group data, namely the group name and the members it comprises (name and email).
Additionally, when you scan or add products to the shopping list, we record the product name and its barcode in a fully anonymised way for statistical purposes. This data is never linked to your identity.
When you add a product to the group's shopping list, that product is associated with your name (as “added by”) and is visible to the other members of your group, as is inherent to a shared list. This data is part of the active list and is deleted when you remove the product or when you delete your account.
When you mark a product as bought (removing it from the list), we record that product —its name, barcode if it has one, quantity, supermarket and date— associated with your group, in order to build your group's purchase history. Unlike the statistical data above, this record is linked to your group while your account remains active, and it is what enables the “Buy again” feature and viewing your group's history.
3. Purpose of processing
Personal data is used exclusively to:
- Let you access your account and use the application.
- Manage the group and share the shopping list among its members, indicating who adds each product.
- Provide your group's purchase history and suggestions to re-buy the products you buy regularly.
Anonymised product data is used to produce aggregate consumption statistics. It is never associated with identified or identifiable individuals.
4. Legal basis
The processing of your data is based on the performance of the contract you accept when registering (Art. 6(1)(b) GDPR) and on your explicit consent given during the registration process (Art. 6(1)(a) GDPR).
In particular, your group's purchase history is processed on the basis of the performance of the contract and our legitimate interest (Art. 6(1)(b) and 6(1)(f) GDPR) in offering you useful features such as “Buy again”, without requiring separate consent.
5. Data retention
Your personal data is kept for as long as you maintain an active Apuntao account. If you delete your account, all of your personal data is erased immediately and irreversibly. Your group's purchase history is retained in anonymised form, dissociated from your identity, for aggregate statistical purposes. Likewise, if your group is dissolved, its history is kept anonymised. We do not retain any history linked to identifiable individuals once they delete their account.
6. Sharing data with third parties
Your personal data is not shared or sold to third parties. We do not use analytics or advertising services that access your personal data.
Optional sign-in via Google is handled by Google LLC under its own privacy policy. In that case, Google only provides us with your name and email address in order to create your account.
Optional sign-in via "Sign in with Apple" is handled by Apple Inc. under its own privacy policy. In that case, Apple only provides us with an identifier and, if you authorise it, your name and an email address — which may be an Apple private relay alias if you choose to hide your email — in order to create your account.
7. Your rights
Under the GDPR and Spanish data protection law (LOPDGDD), you have the right to:
- Access: know what data we hold about you.
- Rectification: correct inaccurate data.
- Erasure: delete your data ("right to be forgotten"), available directly in the app under My profile → Delete my account and data.
- Portability: receive your data in a structured format.
- Objection and restriction of processing.
To exercise any of these rights, write to us at apuntao.privacidad@tindeka.com.
If you believe the processing does not comply with the GDPR, you have the right to lodge a complaint with the Spanish Data Protection Agency or with the supervisory authority in your country of residence.
8. Security
Data is stored on servers located in the European Union. Passwords are stored encrypted using bcrypt and never in plain text. Communications between the app and the server use HTTPS.
9. Changes to this policy
Any material change to this policy will be notified to users through the application.