Deshincha Comprehensive Privacy Notice

This is a translation of the Spanish original. If there is any conflict, the Spanish version prevails.

This notice explains what personal data we collect when you use the Deshincha app and the deshincha.com website, what we use it for, who we share it with and how you can exercise your rights. We wrote it in plain language on purpose. If anything is unclear, write to us at hola@deshincha.com.

The rules about your facial data are explained in more detail in our Biometric Data Policy, which is part of this notice.

1. Who is responsible for your data

The controller responsible for processing your personal data is Noles Technology Inc. ("Deshincha," "we," "us"), a corporation organized in the State of Delaware, United States, with its address at 46 Avenue B, New York, NY 10009, United States.

Contact for everything related to privacy and personal data: hola@deshincha.com

2. What data we collect

2.1 Data you give us when you create and use your account

• Identification and contact: your email address and, if you use "Sign in with Apple," the identifier Apple gives us, your name (only if you choose to share it) and your email or Apple's private relay email.
• Age: we ask for your date of birth only to confirm that you are 18 or older. We store that the check was done and when, not your date of birth.
• Preferences: the plan you chose (Him or Her), your answers to the initial questionnaire, the time you want to spend each day, your language and your reminder settings.

2.2 Data about your face (biometric data)

Only after you give your express consent for biometric data:

• Photos of your face that you take inside the app for your scans and progress comparisons.
• Facial points and proportions: the position of reference points on your face (for example, jawline, cheekbones and eye area) and the proportions we calculate from them.
• Your results: the definition index, the zone scores and the quality of each scan.

The analysis of your face is done on your phone using Apple's technology. The points, proportions and results are stored in your account to show you your progress. Your photos are stored on your phone and are only backed up to our servers if you turn on cloud backup.

2.3 Habit and wellness data

If you choose to log them: hours of sleep, glasses of water, salt level and the foods you chose, alcoholic drinks and, only on the Her plan and if you indicate it, the day of your menstrual cycle. We also store the routines you complete, their duration and your streaks.

Some of this data may be considered sensitive personal data (for example, your menstrual cycle). It is always optional: you can use the app without logging it and delete it whenever you want.

2.4 Purchase data

Subscriptions are paid through Apple. We never receive your card details. Through our subscription provider, we receive the product you bought, your subscription status, the start, trial, renewal and cancellation dates, the store country and the transaction identifiers.

2.5 Usage and technical data

• App usage events (for example, "scan completed" or "routine finished"), device model, iOS version, app version, language and region, and error reports.
• We never include photos, facial data or scan results in our analytics tools. We do not record your screen or your sessions.

2.6 If you write to us

Your email address and the content of your message, so we can reply to you.

2.7 Website

deshincha.com does not use advertising cookies or tracking tools. Our hosting provider may log basic technical data (such as your IP address) for the security and operation of the site.

3. What we use your data for

Purposes necessary to provide the service

1. Create and manage your account and keep your progress saved across devices.
2. Verify that you are 18 or older.
3. Calculate your definition index and your zone scores, and show you your progress and your photo comparison.
4. Build your daily routine plan from your questionnaire, your logs and your scans.
5. Show you observations about your own habits (for example, how your index changes on days you sleep more), using only your own data.
6. Send you the reminders you turned on.
7. Manage your subscription, free trial and access to Pro features.
8. Reply to your messages and support requests.
9. Keep the app secure, prevent fraud and comply with legal obligations.

Optional purposes (only with your consent, and you can withdraw it whenever you want)

10. Cloud photo backup, so your progress photos aren't lost if you change phones.
11. Improving our models: using de-identified photos of you (separated from your name, email and account) to improve the accuracy of the scan. This option is off by default and the app works the same without it.
12. News and promotional emails from Deshincha.
13. Usage analytics to understand which parts of the app work best and improve it.

If you don't want us to use your data for purposes 10 to 13, you can say no from the start or at any time in Profile > Settings > Privacy, or by writing to us at hola@deshincha.com. Saying no does not affect the core service.

If in the future we want to use your data for a new purpose, we will ask for your new consent.

4. What we never do

• We do not sell or rent your personal data.
• We do not use your face, your photos or your results for advertising, cross-app tracking, campaign attribution or advertising profiles.
• We do not share your data with advertisers or data brokers.
• We do not use your data to make automated decisions with legal or similarly significant effects on you. The definition index is a visual reference for comparing yourself with yourself, not a medical measurement.

5. Consent

• Personal data in general: when you accept this notice in the app.
• Biometric data: we ask for your express and separate consent before the camera opens for the first time. Without it, no scan is done.
• Sensitive habit data (such as your menstrual cycle): by logging it in the app, you give us your express consent to process it for purposes 3 to 5. You can delete it and stop logging it whenever you want.
• Optional purposes 10 to 12: each one has its own consent, off until you turn it on.
• Usage analytics (purpose 13): it is on by default and you can turn it off at any time in Profile > Settings > Privacy.

We keep a record of each consent, with the date, time and version of this notice.

6. Who we share your data with

We only share data with providers that help us operate Deshincha. They act under our instructions, have confidentiality and security obligations and may not use your data for their own purposes:

We may also disclose data when a law, a court order or a competent authority requires it, to protect our rights or the safety of people, or to a buyer or successor if Noles Technology Inc. sells or transfers the Deshincha business. In that case, the successor will be bound by this notice.

These communications to our providers are remissions and do not require your consent under Mexican law. We do not make transfers of your data to third parties for their own purposes.

7. Where your data is stored

Your data is stored on servers located in the United States. If you live in Mexico, this means your data is sent abroad, which we do with the same protections described in this notice.

8. How long we keep your data

• While your account is active, to provide the service to you.
• If you delete your account: we delete your photos, facial data, results, logs and account data within 30 days at most. Backups are deleted in their normal rotation cycle.
• If you don't use the app for 12 months, we automatically delete your account and all your data.
• If you withdraw your biometric consent, we delete your facial data within 30 days at most.
• Photos used to improve models (if you agreed): if you withdraw that consent, we exclude them from any future training and delete them from our datasets.
• We may keep the minimum information that a law requires us to keep, only for as long as that law requires.

9. How we protect your data

• Encryption in transit and at rest.
• Access rules that prevent one account from seeing another's data.
• Photos in private storage, accessible only through temporary links.
• Facial data kept separate from your identification data.
• Internal access limited to those who need it to operate the service.

No system is 100% secure. If a security breach occurs that significantly affects your rights, we will notify you without delay so you can take action.

10. Your rights

ARCO rights and more (Mexico)

You have the right to:

• Access your data and know how we use it.
• Rectify it if it is inaccurate or incomplete.
• Cancel it (ask us to delete it).
• Object to our using it for specific purposes.
• Revoke your consent at any time.
• Limit the use or disclosure of your data, for example by no longer receiving promotional emails.

Rights in the United States

Depending on the state where you live, you may have the right to know what data we have about you, get a copy, correct it, delete it and object to certain uses. We do not sell personal data or share it for targeted advertising, so there is nothing you need to opt out of in that respect. We will not discriminate against you for exercising your rights.

How to exercise them

• From the app: in Profile > Settings you can change your optional consents, export your data and delete your account.
• By email: write to hola@deshincha.com with the subject "Privacy rights," from your account's email address, stating which right you want to exercise and regarding which data. If necessary, we will ask you for information to confirm your identity.

We will respond within 20 business days at most. If your request is granted, we will carry it out within the 15 business days following our response. If you live in Mexico and are not satisfied with our response, you can go to the competent personal data protection authority.

11. Minors

Deshincha is only for people 18 or older. We do not knowingly collect data from minors. If we discover that an account belongs to a minor, we delete it along with its data. If you believe a minor has given us their data, write to us.

12. Changes to this notice

If we change this notice, we will publish the new version at deshincha.com/privacidad with its date. If the change is significant or involves a new purpose, we will notify you in the app and, when the law requires it, ask for your consent again.