Privacy Policy — Finca 4 Caballos App
Version: 14 July 2026. This policy covers the “Finca 4 Caballos” Android app (gate control and sensor display) and its programming interface (API).
1. Controller
Controller within the meaning of the GDPR: Blockfinance ECO AG (R&D), Rhigass 1, 9487 Bendern, Liechtenstein, e-mail: google-f4c@blockfinance-eco.li.
2. What data we process
- Account: login identifier, display name, role. Passwords are stored exclusively as Argon2id hashes, never in plain text.
- Login sessions: time, IP address, device label and app version — to protect against unauthorised access. Access and refresh tokens are stored as hashes only.
- Gate operations (security log): who opened or closed the gate and when, including IP address and outcome. Required to protect the property (legitimate interest, Art. 6(1)(f) GDPR).
- Guest access codes: label, validity and uses of each code including time and IP address of redemption. Codes are stored as HMAC hashes only.
- Sensor data: battery voltage, temperature, gate state and similar — pure device data without personal reference.
- Diagnostic data: only if you actively submit it via the support function.
Location data: the current app version does not collect location data. A future optional feature (“auto-open on approach”) will only ever be enabled with the explicit, revocable consent of the person concerned (Art. 6(1)(a) GDPR) and will be described in this policy before introduction.
3. Push notifications
The current app version does not include push notifications. Once they are introduced, the Play Store version will use Google Firebase Cloud Messaging (FCM). Google receives a device push identifier; transfers to the USA are based on the EU Standard Contractual Clauses. Message content is deliberately minimal (e.g. “Gate opened”) and contains no names and no location data. Every notification type can be switched off individually in the settings.
4. Recipients and processors
- Server hosting: own self-managed server in the EEA, hosted at FL1 (Telecom Liechtenstein AG), Liechtenstein.
- The Things Industries (LoRaWAN sensor network, EU cluster) — device data only.
- Google Ireland Ltd. / Google LLC (Play version only: FCM push).
5. Retention
- Gate and access logs: 12 months, then deleted.
- Login sessions: until logout or expiry, then 90 days.
- Account: until account deletion.
- Sensor data without personal reference: unlimited (archive).
6. Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR), and the right to lodge a complaint with a supervisory authority of your choice (Art. 77 GDPR) — for example where you live or work. The authority responsible for the controller is the Datenschutzstelle of the Principality of Liechtenstein (www.datenschutzstelle.li); in Spain it is the Agencia Española de Protección de Datos (www.aepd.es).
Delete your account: by e-mail to google-f4c@blockfinance-eco.li (an in-app deletion function will follow in an upcoming version). Deletion removes the account, sessions and personal links; logs required by law or for security are deleted once the retention periods above expire.
7. Security
Encrypted transport (TLS), hashed passwords and tokens, role-based permissions, logging of security-relevant events, and documented technical and organisational measures under Art. 32 GDPR.
Legal notice
Blockfinance ECO AG (R&D) · Rhigass 1, 9487 Bendern, Liechtenstein · E-mail: google-f4c@blockfinance-eco.li