Privacy policy
Who we are
Rucibo is an app for storing purchase invoices and preparing them for your accountant. It is provided by CreativeLoop LLC ("Rucibo", "we" or "us" in this policy). For any question about your data, write to hola@creativeloop.tech.
Rucibo is not affiliated with the DNIT, Paraguay's tax authority. Marangatu and e-Kuatia are DNIT systems.
What data we process
Your account. Your email address and name, which we receive from Google or Apple when you sign in, and the sign-in provider you used.
Your RUCs and related people. For each RUC you add: nickname, RUC, type of taxpayer, tax obligations and, if you add it, your accountant's email. For dependents and contractual links: name and ID (cédula) number.
Your invoices. The images and PDFs you upload and the data we extract from them: supplier and buyer RUC and name, date, timbrado, number, amounts, IVA, category and your notes. Some purchases, for example at pharmacies or clinics, can reveal health information. We handle it with the same care as everything else and never use it for any other purpose.
Your device. The token used to send you notifications, the platform (Android or iOS), the app version and the language.
Google Drive, if you connect it. A permission that only lets us create and manage the files and folders the app itself creates in your Drive. We store that permission encrypted.
Technical data. Error and performance reports from the app and our servers, scrubbed of personal data, with a pseudonymous identifier.
If you contact us. Whatever you send us by email, which we use only to reply.
What we use it for
- To provide the service: store your invoices, read and check their data, sort them by RUC and month, build the package for your accountant and deliver it the way you choose.
- To send you notifications about your invoices and packages, if you allow them. By default they do not show the supplier or the amount.
- To keep the service secure and prevent abuse.
- To support you and fix bugs.
We do not sell your data. We do not use it for advertising. We do not use it to train artificial intelligence models.
Legal basis
We process your data because it is needed to provide the service you asked for when you created your account, because you gave your consent (for example, for notifications or to connect Google Drive), to meet legal obligations, and in our legitimate interest in keeping the service secure. We already apply the principles of Paraguay's personal data protection law, Law 7593/2025, even though it is expected to take full effect in late 2027.
Where it is stored
- On your phone, in an encrypted database that is excluded from system backups.
- On Amazon Web Services, region sa-east-1 (São Paulo, Brazil). That is where our database, your files, our processing queues and our email sending live. Everything is stored encrypted, and transmitted encrypted (HTTPS) between your phone and our servers.
This means international data transfers from Paraguay to Brazil, and to the United States for the providers listed below.
Who we share data with
Only with the providers we need for Rucibo to work, and only what they need:
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Amazon Web Services | Servers, storage, queues, email (Amazon SES) and encryption keys | All service data, encrypted | São Paulo, Brazil |
| OpenAI | Reading the data on each invoice | The image or PDF text of each invoice, per request | United States. Not used to train models; kept for at most 30 days, only for abuse monitoring |
| Sign in with Google, notification delivery (Firebase Cloud Messaging) and Google Drive if you connect it | Your Google identity, the device token with notifications that carry identifiers only, and the files you choose to sync | Global | |
| Apple | Sign in with Apple and notification delivery on iPhone | Your Apple identity and notification delivery | Global |
| Sentry | Detecting errors and performance problems | Technical data scrubbed of personal data, with a pseudonymous identifier | United States. Keeps the reports for 30 days |
Your accountant only receives what you decide to send: a link, an email, a file or a shared Google Drive folder.
We do not share your data with anyone else, unless a competent authority requires it under the law.
How we protect it
- Encryption in transit (HTTPS) between your phone and our servers, and at rest on your phone and on our servers.
- Every request to our servers is limited to your own account's data.
- Our technical logs do not store RUCs, amounts, names or email addresses.
- Links for your accountant expire (14 days by default, 30 at most) and can be revoked.
- Notifications are generic unless you choose to see more detail.
How long we keep it
| Data | Retention |
|---|---|
| Your invoices and images | While you have an account, or until you delete them |
| Invoices you delete | Kept on our servers for 30 more days, then deleted |
| Packages for your accountant | 35 days |
| Links for your accountant | 14 days by default, 30 at most |
| Database backups | 14 days |
| Technical logs (no personal data) | 30 days |
| Error reports in Sentry | 30 days |
| Requests to OpenAI | Up to 30 days, only for abuse monitoring |
In the future we may automatically delete invoices whose tax retention period has ended (31 December of the invoice's year plus 6). We will tell you before turning that on.
Remember that a photo does not replace the original: keeping paper invoices for that period is your obligation as a taxpayer.
Your rights
You can ask us at any time to:
- access your data;
- correct it;
- delete it;
- object to a processing activity;
- receive it in a format you can take to another service;
- have a person review a decision made solely by automated means.
As the app gains these options, you will be able to do many of them yourself: edit any data, export your packages and delete your account. Until then, and for anything else, write to hola@creativeloop.tech. We reply within 30 calendar days.
Security incidents
If an incident affects your data, we will notify you and the competent authority within the time limits the law requires.
This website
rucibo.com does not use cookies, analytics or tracking tools, and loads nothing from other sites. It is delivered by Amazon CloudFront, part of Amazon Web Services, which processes your IP address only to serve the pages and protect them from abuse, and keeps a sample of requests for a few hours for that purpose. We keep no access logs. If you email us from this site, we use that data only to reply.
Minimum age
Rucibo is meant for adults. If you add data about your dependents, such as your children, you do so as the person responsible for them and only for your tax matters.
Changes to this policy
If we change anything important, we will tell you in the app or by email before the change takes effect.
Contact
CreativeLoop LLC. Email: hola@creativeloop.tech.