Privacy Policy

Version 0.1.0-draft — last updated: 2026-04-26

Note: This version is a structural draft prepared for legal review. It reflects the planned data processing but requires validation by an attorney licensed in Florida and in the target user jurisdictions before public launch. In case of conflict between this English translation and the Spanish version, the Spanish version prevails.

1. Data controller identity

The controller of your personal data is:

TAP Consulting Services LLC 3625 NW 82nd Ave Suite 318, Doral, FL 33166, United States

Operating under the Ganaderos brand.

Account deletion and data deletion requests: https://ganaderos.app/account/delete Privacy contact: privacy@ganaderos.app Support contact: hola@ganaderos.app

2. Information we collect

2.1 Information you provide directly

• Account data: name, email, password (stored hashed), country of residence, preferred language.
• Farm/operation data: farm name, geographic location (optional), currency, species managed.
• Animal data: identification (tag, breed, sex, date of birth), parents (lineage), sanitary and reproductive events, production records, photographs.
• Financial data: income, expenses, budgets by category — all at the operational level, not banking data.
• Support communications: emails, forms, in-app messages.

2.2 Information collected automatically

• Usage data: features used, frequency, session duration.
• Device data: model, operating system, application version, anonymized installation identifier.
• Error data: technical failure logs for diagnosis (managed through Sentry, without farm content).
• Cookies and similar technologies: see Section 11.

2.3 Information from third parties

• Payments: RevenueCat informs us of your Pro subscription status (active, cancelled, expired), but we do not receive your card or payment account data — those are processed directly by Apple App Store or Google Play.
• Social sign-in (when available): if you choose to sign in with Google or Apple, we will receive the basic data those providers share according to the scope you authorize (typically: email, name, profile photo).

2.4 Information we do NOT collect

• Banking or credit card data directly.
• Continuous background GPS location (only point location when you provide it).
• Phone contacts.
• Camera or gallery access without explicit user action.

3. How we use the information

We use the information to:

1. Operate the Service: create and maintain your account, synchronize your data across devices, generate reports and reminders.
2. Process subscriptions: verify your Pro plan status through RevenueCat.
3. Service communications: send you functional notifications (calendar reminders, event alerts) and administrative communications (changes to terms, security alerts).
4. Marketing communications (optional, with consent): newsletters, news, promotions — only if you explicitly check the corresponding box at registration or activate it later in settings.
5. Improve the product: aggregated and anonymized usage analysis to identify popular features or problems.
6. Support: respond to your inquiries and resolve technical problems.
7. Security: detect and prevent fraud, abuse, or unauthorized access.
8. Legal compliance: comply with legal obligations or requirements from competent authorities.

4. Legal basis for processing

We process your data based on:

• Contract performance: to provide the Service you contract by creating an account.
• Consent: for marketing communications, optional push notifications, and sharing with optional third parties (see Section 5).
• Legitimate interest: to improve the product, prevent fraud, and maintain security.
• Legal obligation: when a law requires us to retain or disclose data.

5. Sharing data with third parties (sub-processors)

Ganaderos uses the following providers (“sub-processors”) to operate the Service. Each is subject to contractual confidentiality and security obligations equivalent to ours.

We do not sell your data. We do not share it with data brokers. We do not use it for advertising profiling outside the Service.

6. International transfers

Your data is primarily stored on servers located in the United States. If you reside outside the United States, this implies an international transfer. For users in the European Union, this transfer is carried out based on informed consent when using the Service and, where applicable, on standard contractual clauses approved by the European Commission.

7. Data retention

• Active account data: retained while your account is active.
• Farm data: retained while your account is active.
• After account deletion: data is deleted within 30 days following the request, except in security backups which are purged within a maximum of 90 days.
• Accounting/tax data: we may retain minimum records required by law (typically 5 years) in a separate system without operational use.
• Security logs: up to 12 months.
• Anonymized data: we may retain aggregated data indefinitely that does not allow you to be identified.

8. Your rights

Regardless of your jurisdiction, you have the following rights over your personal data:

• Access: obtain confirmation and a copy of the data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Deletion (“right to be forgotten”): request the deletion of your data.
• Restriction of processing: restrict how we process your data.
• Portability: receive your data in a structured, machine-readable format (CSV/JSON).
• Objection: object to processing based on legitimate interest.
• Withdrawal of consent: when processing is based on consent (marketing, optional notifications), you may withdraw it at any time without affecting the lawfulness of prior processing.

8.1 Region-specific rights

• European Union (GDPR): in addition to the above, the right not to be subject to automated decisions with significant effects, and the right to lodge a complaint with your national data protection authority.
• Mexico (LFPDPPP): ARCO rights (Access, Rectification, Cancellation, Opposition); you may approach INAI if you consider your rights have not been respected.
• Colombia (Law 1581 of 2012): right to file complaints with the Superintendency of Industry and Commerce.
• California (CCPA/CPRA): right to know, delete, correct, and not be discriminated against for exercising your rights. We do not sell personal information.
• Brazil (LGPD): rights equivalent to those of the GDPR; you may contact the ANPD.

8.2 How to exercise your rights

To exercise any right, use https://ganaderos.app/account/delete or write to privacy@ganaderos.app from the address associated with your account. We will respond within 30 calendar days (or the period your specific jurisdiction requires if shorter). Some functions (account deletion, data export) are available directly from the application under Settings → Account.

9. Security

We apply reasonable technical and organizational measures to protect your data:

• Encryption in transit (HTTPS/TLS 1.2+) between the application and our servers.
• Encryption at rest in the database.
• Password hashing with modern algorithms (bcrypt/argon2).
• Restricted access to authorized personnel under the principle of least privilege.
• Security monitoring and incident response.
• Periodic backups.

Despite these measures, no system is invulnerable. Should we become aware of a security breach affecting your data, we will notify you within the timeframes required by law applicable to your jurisdiction.

10. Minors

The Service is not directed to minors under 18 years of age. We do not knowingly collect personal data from minors. If you are a parent or guardian and you become aware that a minor has provided us with personal data, contact us at privacy@ganaderos.app to delete it.

11. Cookies and similar technologies

The mobile application uses:

• Secure local storage: to keep your session active and data offline (not strictly a “cookie” but serves a similar function).
• Device advertising identifier (IDFA on iOS, AAID on Android): only on the free plan, to display advertising. On iOS, we will request your express consent through the App Tracking Transparency (ATT) prompt before use. If you decline, you will see non-personalized advertising.
• Anonymous installation identifier: for aggregated application usage analysis.

12. Changes to this policy

We may update this Privacy Policy to reflect changes to the Service, legal requirements, or new sub-processors. Material updates will be notified within the application at least 15 days before their effective date. The “last updated” date at the top will indicate the current version.

13. Contact

For privacy questions, to exercise your rights, or to file complaints:

• Account deletion and data deletion requests: https://ganaderos.app/account/delete
• Privacy contact: privacy@ganaderos.app
• Support contact: hola@ganaderos.app
• Address: TAP Consulting Services LLC, 3625 NW 82nd Ave Suite 318, Doral, FL 33166, United States

If you reside in the European Union and consider that the processing of your data infringes the GDPR, you also have the right to file a complaint with the data protection authority of your country of residence.