Skip to content
Alfolia

Privacy policy

What data Alfolia keeps, what for, where, for how long and what rights you have, in plain words.

Last updated: November 7, 2026.

Draft. This policy is published before the app comes out and is being reviewed by our lawyer. If anything important changes, we will publish it here with its date.

Alfolia is an app for running several businesses in one place. We wrote this policy with Ecuador’s Personal Data Protection Law (LOPDP) in mind.

1. Who we are

Alfolia belongs to Zuhuan Software S.A.S. (tax ID in process), based in Camilo Ponce Enríquez, Azuay province, Ecuador. For anything to do with your data, write to us at [email protected].

There are two different cases:

  • The data a company loads into Alfolia about its businesses and its people (for example, details of its workers or its customers). Here the client company is the controller of that data and Zuhuan Software is the processor: it stores and processes the data only to provide the service and according to the company’s instructions.
  • Account data (the email of the person who administers it), data from this website and data from the “Let me know when it’s out” list. Here Zuhuan Software is the controller.

2. What data we keep

In the app

  • Account: email of the person who administers it, company name, country, currency and language.
  • Entities and businesses: names, tax ID (RUC), ownership percentages, cash boxes, income, expenses, collections, payments, transfers, debts, property, output, weighings, animals, inventory and rentals.
  • People (administrators, managers, workers, partners and accountant): name, ID document, phone, role, days worked, wages, payments and, if they are registered, their social security (IESS) details. The PIN is not stored as is: only an encrypted version that cannot be read.
  • Customers and suppliers: the details entered to collect from them, pay them or issue them an SRI document (name, tax ID or ID card number, email, address).
  • Photos: of receipts, of weighings and any added to a record.
  • SRI documents and electronic signature: the documents issued (XML, the SRI’s response and PDF) and the electronic signature file, stored encrypted.
  • History: who did each thing, from which phone, when and what changed. No one can edit or delete it.
  • Technical data: phone model and system, app version, crash reports and the code that lets us send notifications to the phone.
  • Payments: charged by Apple or Google. We never see your card: we only know whether the subscription is up to date, how many phones it covers and which tax IDs have invoicing.

On this website

  • “Let me know when it’s out”: only what you choose to give us (email, WhatsApp, country and how many businesses you run; at least your email or WhatsApp), the page language and the date. To stop abuse we also keep, for one hour, an encrypted fingerprint of your connection.
  • No cookies, no advertising and no tools that track you from one page to another.

3. What we use it for

  • To make the app work: store and show what each person records, according to their role, and keep the data safe with backups.
  • To issue and store the SRI documents your company requests, and email them to its customers.
  • To send service emails and notifications: sign-in codes, activity in your businesses, due dates, payments and deletion notices.
  • To help you when you write to us.
  • To protect security, find bugs and prevent abuse.
  • To comply with what the law requires of us.

We don’t sell your data, we don’t rent it and we don’t use it for advertising.

4. On what legal basis

  • The contract with the client company (the terms of use), to provide the service.
  • Your consent, for the “Let me know when it’s out” list and for phone permissions (camera, notifications). You can withdraw it at any time.
  • Legitimate interest in keeping the app secure and free of bugs.
  • Legal obligations, such as keeping tax documents.

When a company loads data about its people or its customers, it is that company that must have a legal basis to do so and tell them how it uses it.

5. Who else sees it

Within each company, each person sees only what their role allows. Outside the company, we use these providers, who work for us, only to provide the service:

  • DigitalOcean (United States): the server, the database, photos and documents.
  • Cloudflare (United States): this website, the “Let me know when it’s out” list and an encrypted backup.
  • Resend (United States): automatic emails, such as sign-in codes and SRI documents.
  • Google Firebase: phone notifications and crash reports.
  • RevenueCat: checking the status of subscriptions.
  • Apple and Google: the stores, where the app is downloaded and paid for, and the cloud where you keep your backup.
  • The SRI: receives the electronic documents your company issues, because the law requires it.
  • Google Workspace: the email we reply to you from.

Since several of them are in the United States, your data leaves Ecuador. We only work with providers that commit by contract to protect the data and use it only for what we ask. If an authority asks us for data, we hand it over only when the law obliges us to.

6. How we protect it

  • Everything travels encrypted (HTTPS), between the phone, the server and the website.
  • SRI documents and the electronic signature are stored encrypted, and the server cannot delete them before 7 years.
  • The database only accepts connections from our server; backups are made every day and a weekly copy goes, encrypted, to another provider.
  • Each person signs in with their PIN (or their fingerprint or face) and sees only what their role allows. The administrator can remove someone’s access instantly.

7. How long we keep it

  • While the account is active.
  • If a payment fails, the company becomes read-only: it can see and download its data. If it doesn’t catch up within 90 days, its businesses’ data is deleted, with email notices beforehand.
  • SRI documents are kept for 7 years from when they were issued, even if the subscription is canceled, because the law requires keeping them.
  • If account deletion is requested, it is deleted within 30 days at most, and from backups within 90 more days at most (except SRI documents, which are kept until the 7 years are up).
  • “Let me know when it’s out”: until we tell you about the launch and, at most, 12 months from when you signed up.

Your data is yours: the administrator can download all of it, in Excel and PDF, at any time.

8. Your rights

Under the LOPDP you can ask to: see your data, correct or update it, delete it, object to our using it, suspend its use, take it to another service, and not be subject to decisions made solely by a machine.

Write to us at [email protected]. We reply within 15 days at most. If your data was loaded by a company, ask that company first; if it doesn’t reply, write to us and we’ll help you. How to delete an account is explained in help.

If you are not satisfied with our reply, you can file a complaint with Ecuador’s Superintendency of Personal Data Protection.

9. Minors

Alfolia is a work tool and is not made for people under 18.

10. Changes and language

If we change this policy, we publish the new version here with its date, and if the change is important we let you know beforehand by email or in the app. If there are differences between languages, the Spanish version prevails.