Privacy and security

Last updated: November 2, 2026

1. Who we are

Poquet is an app operated by Bite Panama, S.A., a company incorporated in the Republic of Panama (“Poquet”, “we”). We are the data controller for the personal data described here. For any privacy matter, email support@poquetapp.com.

2. What data we collect

Only what Poquet needs to work:

Your account: email address and, if you sign in with Apple or Google, the name those services share with us. If you create a password, our authentication provider stores it encrypted; we can’t see it.
Your statements: the PDFs you upload or forward, exactly as your bank issues them, and the data we read from them: bank, product, last 4 digits of the card, balances, credit limit, cut-off and due dates, transactions and installment purchases.
What you record in the app: payments, corrections to data or categories, names and colors you give your cards and, if you have additional cards, the name you type to identify each cardholder.
Emails you forward to your Poquet address: sender, subject and attachments, so we can process them. If you set up Gmail forwarding, also the confirmation link or code Google sends.
If you use the Poquet Advisor: your questions, its answers, any rating you give them and anything you ask it to remember (goals, preferences or events).
Technical data: your phone’s notification identifier and your language; which notices we sent you and whether you opened them, so we don’t repeat them and learn which ones help; and, when you report a bug, what you write plus the app version, the operating system and your phone model.
Crash reports: if the app crashes, a technical report (which screen and which error, app version and phone model) is sent so we can fix it. It doesn’t include your name, your email, your IP address or any data from your cards or statements.
How you use the app: which screens you open and which actions you start or leave half done (for example, uploading a statement or setting up forwarding), so we know what to improve. Never amounts, merchants, banks, card numbers or anything you type. Before you create your account, this data goes with a random identifier kept on your phone. It’s deleted after 12 months.
On this website: aggregated, anonymous visit statistics (page views, country, device type), without cookies and without identifying you.

We don’t collect: your bank usernames or passwords, your full card numbers, your location, your contacts or data from other apps. Your Face ID and your PIN never leave your phone.

3. How we use it

To read your statements and show you your cards, balances, spending and installment purchases.
To categorize your purchases with artificial intelligence and learn from your corrections to read your next statements better.
To answer your questions in the Poquet Advisor, only if you give permission inside the app. To answer, your question, the current conversation and the card data needed (balances, dates, transactions and categories) are sent to Anthropic; never your name, email, card numbers or PDFs. Its answers are AI-generated, informational and can be wrong.
To send you reminders about due dates, statements ready to review and, if you turn it on, the weekly summary.
To answer your questions and reports, and to keep the service secure.

We don’t use your data for advertising or build profiles for third parties.

6. International transfers

Our providers process and store data mainly in the United States. By using Poquet you consent to this transfer, which we make with providers that apply security measures equal to or stronger than those required in Panama.

7. How we protect your data

Encryption in transit (HTTPS/TLS) and at rest.
Each account can only see its own data: access is restricted per user in the database.
Optional app lock with Face ID or a 6-digit PIN.
When you report a bug, the attached statement is sent without card number or name.

No system is 100% secure. If an incident compromising your data ever happens, we’ll notify you as soon as possible, as the law requires.

8. How long we keep it

Your statement PDFs are deleted automatically 90 days after you upload or forward them. The data we read from them (balances, dates and transactions) stays in your account. After that, you can no longer open the original PDF or have Poquet read it again.

The rest of your data is kept for as long as you have an account. You can delete your cards, statements and transactions at any time from More → Data. If you delete your account from More → Data → Delete my account, we erase all your data right away, except what a law requires us to keep. Backups are deleted on their normal rotation cycle.

9. Your rights

Under Law 81 of 2019 you have the right to access your data, rectify it, cancel it (delete it), object to its processing and to portability (receive it in a commonly used format). You can:

Export your transactions to CSV from More → Data.
Correct any data directly in the app.
See and delete what the Advisor remembers, delete your conversations or withdraw your permission from the Advisor → Memory.
Delete your cards and statements from More → Data.
Delete your account and all its data from More → Data → Delete my account.
For anything else, email support@poquetapp.com from your account’s email address.

We reply within 10 business days, free of charge. If you’re not satisfied, you can contact Panama’s National Authority for Transparency and Access to Information (ANTAI).

10. Minors

Poquet is intended for people 18 and older. We don’t knowingly collect data from minors; if we learn an account belongs to a minor, we delete it.

11. Changes to this policy

If we make significant changes, we’ll let you know in the app or by email before they apply. The date of the last update is shown above.

12. Contact

Bite Panama, S.A. · Panama City, Republic of Panama · support@poquetapp.com