---

Owner and Data Controller

ASOCIACIÓN JUNIOR EMPRESA SYNKRO
Plaza de San Martín, 1, Madrid, 28013 Madrid, Spain
VAT/Registration Number: ESG75285965
Data Controller contact: info@backtolife.site

What Data We Collect

Personal Data We Collect

An account is required to use BackToLife. When you create your account, we collect:

• Email address: To create your account, authenticate you, send you important app updates, and communicate with you about the service
• Name: To personalize your experience and communicate with you

You cannot use BackToLife without creating an account; providing your email and name is necessary to access the service.

Anonymous Analytics Data (Optional)

With your explicit consent, we collect minimal, anonymized usage data without using any third-party data analytics provider:

• App feature usage (which filters are most commonly used)
• App interactions (inside the app, not the WebView)
• Technical data: device type, OS version, app version
• Session statistics: session length, frequency

This data is:

• Fully anonymous and aggregated
• Cannot be linked to you personally or your account
• Not connected to your email or name
• Collected only with your consent, which you can withdraw at any time

How we anonymize: We process this data without persistent identifiers. No device IDs, advertising IDs, or user IDs are collected. IP addresses are not collected. Data is aggregated before storage. Re-identification is technically infeasible. This ensures data is truly anonymous under GDPR Recital 26.

Data We Do NOT Collect

We explicitly do not collect and technically cannot collect:

• Your browsing history within Instagram or YouTube
• The content you view or your interactions with these platforms
• Your contacts, photos, or other personal content
• Location data
• Biometric data
• Device identifiers that can personally identify you (beyond anonymous analytics)
• Any special categories of personal data (health, race, religion, politics, sexual orientation, etc.)
• Crash reports or diagnostic telemetry from any third-party crash-reporting service (we do not use any)

No Advertising Trackers

BackToLife contains no advertising and no advertising trackers. Your activity is not monitored for advertising purposes. We do not engage in:

• Targeted advertising
• Profiling for advertising purposes
• Sale or sharing of personal data for advertising
• Cross-context behavioral advertising

Legal Basis for Processing (GDPR Article 6)

We process your personal data based on the following legal grounds under GDPR Article 6:

How Your Data is Stored

Account Data Storage

Your email address and name are stored securely on our servers located in Europe (France). We implement the following security measures:

• Encryption in transit: All data transmitted to/from our servers uses HTTPS encryption
• Encryption at rest: Data is encrypted using AES-256
• Access controls: Strict access controls limit who can access your data. Only our own server owners can access the data.

How We Use Your Data

Account Data

We use your email address and name to:

• Create and maintain your account
• Authenticate you when you log in
• Send you essential service communications (e.g., security alerts, critical updates)
• Send you optional updates about new features, improvements, or app announcements (with your consent)
• Respond to your support requests
• Comply with legal obligations

Anonymous Analytics

Anonymous analytics data is used solely for:

• Understanding how the app is used to improve user experience
• Identifying and fixing bugs
• Analyzing app performance and stability
• Making product decisions about new features

We do NOT use your data for:

• Advertising or marketing purposes
• Selling or renting to third parties
• Profiling or behavioral analysis that affects you
• Automated decision-making that produces legal or similarly significant effects
• Any purpose unrelated to app improvement

Data Sharing and Third Parties

Third-Party Service Providers (Data Processors)

We use the following third-party services that process data on our behalf as Data Processors under GDPR Article 28. We have Data Processing Agreements (DPAs) with all processors ensuring they:

• Process data only on our instructions
• Maintain appropriate security measures
• Do not use data for their own purposes
• Notify us of any data breaches
• Delete or return data when services end

Hostinger Privacy Policy: hostinger.com/legal/privacy-policy

WebView Privacy & Third-Party Platforms

BackToLife uses WebView technology to display Instagram and YouTube with content filters applied.

Third-party platform data processing: When you access Instagram or YouTube through BackToLife, you interact directly with those platforms. These platforms may set cookies and process data under their own privacy policies. Instagram/YouTube cookies remain isolated within the WebView. We do not control third-party data processing. You remain subject to Instagram's and YouTube's respective Terms of Service and Privacy Policies.

Platform terms compliance: Using BackToLife to modify Instagram/YouTube interfaces may violate their Terms of Service. Users acknowledge and accept this risk. We cannot guarantee that platforms won't detect or restrict modified access.

No Data Sales or Sharing

We do not sell, rent, or trade your personal data to anyone. We do not engage in:

• Sale of personal data (as defined by GDPR, CCPA, and other privacy laws)
• Sharing for cross-context behavioral advertising
• Data brokerage
• Any monetization of your personal information

International Data Transfers

Your account data (email, name) is processed within the EU only.

On-Device Data

Stored on your device until you delete it or uninstall the app. We have no access to this data and cannot delete it remotely.

Anonymous Analytics

Retained according to our internal policies (typically 14–26 months for aggregate data). Because this data is completely anonymous and aggregated, it cannot be individually deleted and does not constitute personal data under GDPR.

Your Rights Under GDPR

As a user in the EU/EEA (or UK), you have the following rights regarding your personal data:

To exercise any of these rights, contact us at info@backtolife.site. We will respond within 30 days (1 month as required by GDPR).

Your Rights Under Other Privacy Laws

CCPA/CPRA (California Residents)

California residents have rights under CCPA/CPRA including:

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt-out of the sale of personal information (we do not sell)
• Right to non-discrimination for exercising your rights
• Right to correct inaccurate information
• Right to limit use of sensitive personal information (not applicable — we don't collect sensitive PI)

We do not engage in: (1) Sale of personal information, (2) Sharing for cross-context behavioral advertising, (3) Targeted advertising, or (4) Profiling with legal/significant effects.

UK GDPR (United Kingdom)

UK users have the same rights as EU/EEA users under UK GDPR. UK supervisory authority: Information Commissioner's Office (ICO) — ico.org.uk

LGPD (Brazil)

Brazilian users have rights under LGPD similar to GDPR, including access, correction, deletion, and portability. Contact us to exercise these rights.

Other US State Laws

Residents of Virginia, Colorado, Connecticut, Utah, Montana, and other US states with comprehensive privacy laws have similar rights. We do not engage in targeted advertising, profiling, or sale of personal information as defined by these laws.

Data Protection by Design and Default

We implement privacy principles throughout our product development:

• Data minimization: We collect only the data necessary (email and name for account functionality).
• Purpose limitation: Data is used only for specified, explicit purposes.
• Storage limitation: Data is deleted when no longer needed.
• Privacy by default: Analytics are opt-in, not opt-out. Most operational data stays on your device by default.
• Security by design: Encryption, access controls, and secure storage are built into our architecture.

Security Measures

We implement appropriate technical and organizational measures to protect your data:

Technical Measures

• HTTPS/TLS encryption for all data in transit
• AES-256 encryption for data at rest
• Secure password hashing for Parental Lock PINs
• Secure device storage (Keychain/Keystore) for sensitive local data
• Regular security updates and patches

Organizational Measures

• Strict access controls limiting employee access to personal data
• Data Processing Agreements with all processors
• Employee training on data protection and security
• Incident response procedures
• Regular review of security practices

Your Responsibilities

You are responsible for:

• Securing your device with a passcode/biometric lock
• Keeping your device's operating system updated
• Protecting your device from unauthorized access
• Keeping your account credentials confidential
• Not sharing your device with unauthorized users

Data Breach Notification

In the unlikely event of a data breach affecting personal data:

• We will notify the relevant supervisory authority within 72 hours (as required by GDPR Article 33)
• We will notify affected users without undue delay if the breach poses a high risk to their rights and freedoms (GDPR Article 34)
• Notification will include: nature of the breach, categories and number of affected users, likely consequences, and measures taken to address the breach

Children's Privacy

Age Requirements: You must meet the minimum age required by the platforms you access through BackToLife:

• Instagram: 13+ (or 16+ in certain EU countries)
• YouTube: 13+ (or the digital consent age in your jurisdiction)

If you are under 18 or the age of majority in your jurisdiction, you represent that you have obtained parental or guardian consent to use the App.

BackToLife does not permit users who do not meet the age requirements of the underlying platforms. If we discover that a user has created an account without meeting these requirements, we will terminate that account immediately.

We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without proper parental consent, we will delete it promptly.

If you believe a child has provided personal data to us, please contact us at info@backtolife.site immediately.

Special safeguards for children: If we introduce features specifically for children in the future, we will implement age-appropriate consent mechanisms and enhanced protections as required by GDPR and applicable laws.

App Permissions

BackToLife requests the following permissions:

• Internet access: Required to load Instagram and YouTube content within the app
• Local storage: Required to save your preferences and settings
• Notifications
• Screen time

We do NOT request access to:

• Contacts
• Photos/Media (unless specifically needed for an optional feature)
• Microphone
• Location
• Calendar
• SMS

If we add features requiring additional permissions in the future, we will request your explicit permission and explain why the permission is needed.

Cookies and Tracking Technologies

BackToLife itself does not use cookies or tracking technologies for analytics or advertising.

However, when you access Instagram or YouTube through BackToLife:

• Those platforms may set their own cookies according to their privacy policies
• These cookies are isolated within the WebView and managed by the platforms
• We do not control, access, or process these cookies
• You can manage cookie preferences within each platform's settings

Do Not Track & Global Privacy Control

We respect user privacy signals:

• Global Privacy Control (GPC): If your browser/OS sends a GPC signal, we will automatically prompt you to confirm your analytics preferences.
• Do Not Track (DNT): While DNT is not legally binding in most jurisdictions, we treat it similarly to GPC where technically feasible.

Automated Decision-Making and Profiling

We do not engage in:

• Automated decision-making that produces legal or similarly significant effects (GDPR Article 22)
• Profiling for advertising or behavioral manipulation
• Any processing that would require special safeguards under GDPR

All decisions affecting your account are made by humans or with human oversight.

Business Transfers

If BackToLife is acquired, merged, or sells assets, this Privacy Policy will continue to apply. We will:

• Notify you of any ownership change via email and in-app notification
• Give you the option to delete your data before the transfer
• Ensure the new entity complies with this Privacy Policy
• Obtain your consent if the new entity wants to use data for new purposes

Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or new features. Material changes will be communicated:

• Through an in-app notification
• Via email to your registered address
• By updating the 'Last Updated' date at the top of this policy

Material changes include:

• New data collection practices
• New purposes for data use
• New third-party processors
• Changes to international data transfers
• Changes to your rights

For significant changes (such as introducing new data collection practices or materially changing how we use your data), we will request your explicit consent before the changes take effect.

Previous versions of this policy will be archived and available upon request.

Our Business Model

BackToLife may offer paid subscription plans that provide access to premium features, additional functionality, or enhanced digital wellbeing tools within the App.

The specific features included in each subscription plan, the applicable price, billing period, renewal conditions, and any free trial period will be clearly displayed in the App before you complete your purchase.

Subscription Payments

Subscriptions are purchased and managed through the platform from which you downloaded the App, such as the Apple App Store or Google Play Store, unless otherwise stated in the App.

Payments are processed by the applicable app store or payment provider in accordance with their own terms, conditions, and privacy policies.

BackToLife does not directly collect, process, or store your full payment card details, banking information, or other sensitive payment credentials.

Subscription-Related Data

To manage access to paid features, we may receive limited subscription-related information from the applicable app store or payment provider, such as:

• Subscription status, such as active, expired, cancelled, or trial
• Subscription plan or product identifier
• Purchase or renewal date
• Expiration date
• Anonymous transaction or receipt identifiers

This information is used only to verify your subscription status, provide access to paid features, prevent fraud or misuse, handle support requests, and comply with legal obligations.

We do not use subscription-related data for advertising, profiling, or selling your personal information.

Refunds and Cancellations

Subscription cancellations and refund requests are generally handled by the platform where the subscription was purchased, such as Apple or Google, according to their own policies.

Deleting your account or uninstalling the App does not automatically cancel your subscription. You must cancel your subscription through the relevant app store or payment provider.

No Monetization of Personal Data

We commit to never monetizing your personal data. Our business model is based on subscriptions and paid app features, not on advertising, selling data, or tracking users for commercial profiling.

If our business model changes in a way that affects how we process personal data, we will update this Privacy Policy and, where required, seek your consent before the changes take effect.

Legal Disclaimers and Limitations

Disclaimer of Warranties

TO THE MAXIMUM EXTENT PERMITTED BY LAW, WE PROVIDE THIS PRIVACY POLICY AND OUR PRIVACY PRACTICES 'AS IS' WITHOUT WARRANTY OF ANY KIND. WE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF ACCURACY, COMPLETENESS, MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.

Limitation of Liability

To the maximum extent permitted by law, we shall not be liable for any damages arising from:

• Your device being lost, stolen, or compromised
• Unauthorized access to your device by third parties
• Third-party platforms' data practices (Instagram, YouTube, etc.)
• Operating system vulnerabilities or device security failures
• Your failure to secure your device or account
• Any data breaches or exposures from any source
• Third-party service provider failures or breaches

This limitation applies to the fullest extent permitted by applicable law, including GDPR and other data protection regulations.

Contact Us & Data Protection Officer

For questions, concerns, or requests regarding this Privacy Policy or your data:

Data Controller: ASOCIACIÓN JUNIOR EMPRESA SYNKRO
Plaza de San Martín, 1, Madrid, 28013 Madrid, Spain
General inquiries: info@backtolife.site

We will respond to your inquiries within 30 days (1 month as required by GDPR). For complex requests, we may extend this by an additional 2 months, in which case we will notify you.

Supervisory Authorities

EU/EEA users can lodge complaints with their local supervisory authority: edpb.europa.eu/about-edpb/board/members_en

UK users can contact: Information Commissioner's Office (ICO) — ico.org.uk

Other jurisdictions: Contact your local data protection authority or privacy regulator.

Definitions

• Personal Data / Personal Information: Any information relating to an identified or identifiable natural person (GDPR Article 4(1)).
• Data Controller: The entity that determines the purposes and means of processing personal data. For BackToLife, this is ASOCIACIÓN JUNIOR EMPRESA SYNKRO.
• Data Processor: An entity that processes personal data on behalf of the controller (e.g., our hosting provider).
• Data Subject: The individual to whom personal data relates (you, the user).
• Processing: Any operation performed on personal data, including collection, storage, use, disclosure, deletion (GDPR Article 4(2)).
• Anonymization: The process of rendering data permanently non-identifiable, such that re-identification is no longer possible.
• Pseudonymization: Processing data in a way that it can no longer be attributed to a specific person without additional information (which is kept separately and securely).
• Consent: Freely given, specific, informed, and unambiguous indication of agreement to data processing (GDPR Article 4(11)).
• Local-First: Data stored exclusively on the user's device and not transmitted to external servers.
• Service: The BackToLife mobile application and associated services.

---