Privacy Policy

Last updated: March 2026

At Spendi (operated by Util Apps) we take your privacy seriously. This policy describes what data we collect, how we use it, and what rights you have over it.

1. Data We Collect

To provide our enterprise expense management service, we collect the following data:

  • Account data: name, email address, role within the company.
  • Company data: business name, tax ID, fiscal address (provided by the administrator).
  • Expense data: amounts, descriptions, categories, receipts (photos of receipts/invoices), CFDI files.
  • Usage data: access logs, actions performed, device and operating system.
  • Authentication data: managed through Firebase Authentication (Google).

2. How We Use Your Data

We use your information exclusively to:

  • Operate the platform: process expense requests, approval workflows, and reimbursements.
  • Authentication and security: verify your identity and protect your account.
  • Service improvement: analyze usage patterns to enhance the experience.
  • Communications: send you notifications about the status of your requests and relevant service information.

3. Storage and Security

Your data is stored on secure servers with encryption in transit (TLS) and at rest. We use Firebase (Google Cloud) as our primary infrastructure, which complies with international security standards (SOC 2, ISO 27001). Receipts and files are stored in Firebase Storage with restricted access. We implement multi-tenant access control so that each company can only view its own data.

4. Data Sharing

We do not sell or share your personal data with third parties for advertising purposes. We only share information with: infrastructure providers (Google Cloud/Firebase) to operate the service; competent authorities when required by law; within your organization, according to permissions configured by your company administrator.

5. Your Rights

You have the right to:

  • Access: know what data we hold about you.
  • Rectification: correct inaccurate data.
  • Erasure: request the deletion of your data.
  • Objection: object to the processing of your data for specific purposes.

6. Cookies and Similar Technologies

We use essential cookies to maintain your active session and preferences (language, theme). We do not use tracking cookies or third-party advertising cookies.

7. Children

Spendi is a business service aimed at adults. We do not intentionally collect data from anyone under 18 years of age.

8. Changes to This Policy

We may update this policy periodically. We will notify you of significant changes through the platform or by email.

9. Contact

If you have questions about this privacy policy or wish to exercise your rights, contact us at info@util.biz.