VinclaAt Vincla, your data belongs to you. Here we explain what data we store, what for, who it is shared with and how to exercise your rights. If you have any questions, write to us at soporte@vincla.eu.
1. Who the controller is
Alejandro Agustín García Almodóvar, a private individual, residing at Avenida de Orihuela 120, 03006 Alicante, Spain, with tax ID (NIF) 48732306K. Privacy contact: soporte@vincla.eu.
2. What data we process
| Type | What data | Where it comes from |
|---|---|---|
| Account | Email address and encrypted password, or sign-in with Google (Google gives us your email and, if you have one, your name). If you turn on two-step verification, the secret key for those codes | You, when you sign up |
| Profile | Your name (optional), month and year of birth, gender, account type, average cycle and period length, app preferences | You, when you sign up and in Settings |
| Health and sex life (special categories) | Period and flow, mood, symptoms, pain, energy, sleep, sex drive, sex and contraception method if you log them, cervical mucus, ovary, pills, exercise, alcohol, medication (only the type, such as painkiller or iron, without doses), notes, any symptoms you add yourself, what affects your cycle (for example PCOS or endometriosis), whether you want to see your fertile window, your “What helps me” notes and whether you did your breast self-exam each month | You, when you log them |
| Bond | Invitation code, who you are linked with, what you call them, what you decide to share and when each shared item was last updated | You and the other person |
| Ask for something and quick messages | What you ask for with “Ask for something” (for example “I need some cuddles”), the reply (“On my way”, “Done”), the quick messages you send each other (for example “Thinking of you”) and thank-yous, with their date. Only the two people in the bond can see them | You and the other person |
| Premium | Plan, dates, whether it renews, the weeks earned by inviting others and, if it is a gift, who pays for it and who receives it. Never your card details | Google Play, when you pay or are given Premium |
| Achievements | The achievements and levels you reach (calculated from what you already store), your badge and your frame, whether you show your level, and a few markers that are only used for achievements: which “Learn” articles you have opened, on which days you have checked how your bond is doing, and whether you have opened your history or prepared the report for your doctor. Your bond sees your badge and your frame, your level only if you turn it on, and the achievements you earn together; the rest of your achievements are yours alone | You, when you use the app |
| Invitations | Your invitation code, whether you used someone else’s and when we gave you both the week of Premium. The person who invited you only sees your name in the app and your achievements badge, none of your other data | You, when you invite someone or use a code |
| Plans | The plans you note down (a short title and a date), so we can let you know if they coincide with your period. Only you can see them; your bond cannot | You, when you note them down |
| On your phone | The report for your doctor (PDF) and the “Your month in Vincla” image are created on your phone and only leave it if you save or share them. If you add the Vincla widget, its texts are stored on your phone: by default they say nothing about your cycle; with “Detailed widget” they show your cycle day, phase and when your period is due | Your phone |
| Usage analytics (optional) | Only if you turn it on: which parts of the app are used (for example “the calendar was opened”, “a log was saved”, “a quick message was sent” or the steps of a purchase), at most once a day each, with the day, your age bracket (14-17, 18-24, 25-34, 35-44, 45 or over), how long you have had the account (in ranges), account type, whether it is free or Premium, the operating system (Android) and the app version. Without your name, your email or any identifier of yours, and never the content of what you log. To cap events at 60 per day per account, your identifier is stored alongside the day, and that list is emptied every day | Your phone, if you give permission |
| Reason for leaving (optional) | If, when deleting your account, you choose why you are leaving (for example “I don't use it any more”), that reason is stored anonymously, with your age bracket, how old the account was and whether it was Premium | You, when you delete your account |
| Studies (optional) | If you tick “Let me know if there's ever a study”, we only store that yes or no. Nothing is shared: if there is a study, we will let you know and you will decide then | You, when you sign up or in Settings |
| Reports | What you write in “Report a bug or an idea” and, if you leave it ticked, the app version and your phone’s operating system version | You, when you send it |
| Technical | Phone identifier for notifications, technical security logs from the server, the check that you are not a robot when you sign in or create your account (IP address and technical data from the app’s built-in browser, processed by Cloudflare) and, if the app crashes, a technical crash report (app version, phone model and operating system, and which part of the code failed; never health data) | Your phone and our providers |
| Consent | When you agreed to the processing of your health data, which version of the text, that you confirmed you are at least the minimum age in your country, and that country (the app takes it from your phone’s region, only to know which minimum age applies) | You, when you start |
To use the app you only need your account details, your month and year of birth and to accept the processing of health data. Everything else you log only if you want to: if you don’t, the app simply doesn’t take it into account.
3. What for and on what legal basis
| What for | Legal basis |
|---|---|
| Making the app work: storing your logs, estimating your cycle, showing you your history and your patterns, and preparing the report for your doctor if you ask for it | Your explicit consent for health and sex life data (Art. 9(2)(a) GDPR) and providing the service you request (Art. 6(1)(b)) |
| Sharing with your bond what you turn on, plus “Ask for something” and quick messages | Your consent, item by item, which you can withdraw whenever you want |
| Notifications on your phone | Your consent (notification permission) |
| Account emails: confirming your email, changing your password, welcome and account-deleted notice. We do not send advertising by email | Providing the service (Art. 6(1)(b)) |
| Premium, your own or a gift, if you take it out | The contract (Art. 6(1)(b)). Payment is handled by Google Play |
| Ads in the free version | Your consent, which Google asks for in its own form before showing any ad (you can change it in Settings). Ads are always non-personalised: no profile of you is built for advertising and health data is never used. With Premium there are no ads |
| Usage analytics, to find out which parts of the app are used and improve them | Your consent (Art. 6(1)(a)), which is turned off by default and which you can change in Settings at any time |
| Understanding why people leave, if you choose a reason when deleting your account | Your consent, when you choose it (it is optional) |
| Letting you know about studies, if you ask us to | Your consent |
| Reading your bug reports and ideas to fix and improve the app | Your consent, when you send them |
| Detecting and fixing app crashes | Legitimate interest (Art. 6(1)(f)): making sure the app works properly. Reports do not contain health data |
| Security and preventing abuse (for example, the check that you are not a robot and limits on attempts) | Legitimate interest (Art. 6(1)(f)) |
We do not take automated decisions with legal effects on you, nor do we build commercial profiles. Cycle estimates are for guidance only: Vincla does not diagnose and is not a method of contraception. Vincla does not use artificial intelligence with your data.
4. Who it is shared with
- The people you link with (one, or up to five with Premium): each one only sees what you turn on for them in Your bond, only today’s data and how long ago you updated it. Your sex drive can only be shared with people you mark as a partner (you can have more than one). What affects your cycle is only visible to them if you choose to share it, each condition separately; by default they see none. You can stop sharing everything at once with “Stop sharing everything now”, without them being notified. They never see your history, your daily notes, the details of your sex life or your intimate symptoms. If they give you Premium as a gift, they only see their own gift (plan and dates). If you turn on “Let them know a few days before my period” for that person, they receive a discreet notice a few days before your next estimated period; they do not see the estimated date.
- Data processors, which only process the data on our behalf and under contract:
- Supabase: database and accounts, with servers in Ireland (EU). This is where your health data lives.
- Google: Firebase for notifications to your phone (they never contain health data) and Gmail, which is where the emails you write to us arrive and from where the emails to confirm your account and change your password are sent.
- Resend: sends the welcome and account-deleted emails, with servers in Ireland (EU). It only receives your email address and your name.
- Sentry: technical reports when the app crashes, without health data or data that identifies you, with servers in Germany (EU).
- Cloudflare: the check that you are not a robot (Turnstile) when you create your account, sign in or recover your password. It sees your IP address and technical data from the app’s built-in browser, not your health data.
- OVHcloud (France, EU): the vincla.eu domain and forwarding of the emails you write to us at soporte@vincla.eu.
- Cloudflare Pages: hosts this website and, like any website, sees the IP address of visitors.
- Google as an independent controller (under its own privacy policy), only in these cases and never with health data: sign-in with Google if you use it, Google Play when you pay for or give Premium, and AdMob for ads in the free version (always non-personalised; Google may use the phone’s advertising identifier to count and limit ads and to prevent fraud).
- No one else. We never sell your data. We would only hand it over to an authority if required by law.
5. Transfers outside the EU
Your health data is stored in the European Union and does not leave it. Google and Cloudflare may process phone identifiers, IP addresses, purchase data and the emails you write to us in the United States, with the safeguards of the GDPR: the EU-U.S. Data Privacy Framework and the European Commission’s standard contractual clauses.
6. How long we keep it
For as long as you have your account. If you don't use it for 4 years, we'll email you and, if it still hasn't been used 30 days later, we'll delete it with all its data (unless you have active Premium). If you delete it, all your data is immediately deleted from our servers: this is how it is done, and this is what is kept and why. Automatic database backups delete themselves within 7 days at most. Analytics events and reasons for leaving do not identify you, so they cannot be deleted when you delete your account: they delete themselves after 25 months. A temporary, encrypted copy remains on your phone so you can use the app offline; it is deleted when you sign out (except for changes that have not yet been uploaded, if you choose to keep them to upload next time).
7. Your rights
You can access your data, correct it, delete it, take it with you (Settings → “Export my data”), object to or restrict its use, and withdraw your consent whenever you want (by turning off what you share, analytics or study notices in Settings, or by deleting your account). Withdrawing it does not affect what was done before. Write to us at soporte@vincla.eu and we will reply within one month at most. If you are not satisfied, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).
8. Deleting your account
From the app: Settings → at the bottom, “Delete my account”. Without the app: write to us from your account’s email address. Full details in Delete your account.
9. Minors
Vincla is for people who can already give their consent without a parent or guardian in their country (Article 8 GDPR): in Spain, from the age of 14 (Article 7 of Organic Law 3/2018 on Data Protection, Ley Orgánica 3/2018 de Protección de Datos); in other countries, between 14 and 16 depending on their law (Vincla never goes below 14, and if it does not know the country it requires 16). Below that age the app is not intended to be used and does not let you continue. We ask for your date of birth when you start, but we only store the month and year. If you are a minor, your bond can never see your sex drive, and the app first shows you helplines for minors.
10. Security
Communication is encrypted, your session and the copy of your data kept on your phone are stored encrypted in the phone’s secure storage, each account can only read its own data (row-level security in the database), you can turn on two-step verification and you can add a fingerprint or face recognition lock. If there were ever a security breach affecting your data, we would notify the Spanish Data Protection Agency within 72 hours and, if it posed a high risk to you, you too, as the GDPR requires.
11. Cookies
This website does not use cookies or tracking tools, and the app does not use cookies. That is why there is no cookie notice. The app only stores on your phone what it needs to work (your session, your settings and the copy for offline use); for anything that isn’t necessary, such as ads or usage analytics, it asks your permission first.
12. What Vincla is not
Vincla is not a medical device or a method of contraception, and it does not diagnose. Its estimates (period, fertile window, ovulation) are only a guide: they do not guarantee either getting pregnant or avoiding pregnancy. If you have any health concerns, consult a healthcare professional.
13. Changes
If we change anything important, we will tell you in the app and, if necessary, ask for your consent again. The terms of use are in Terms and conditions.