Privacy Policy — Settha

SETTHA TECHNOLOGIES S.A.S. operates two distinct applications on the same platform: • Settha, for travelers who discover and book tours, on Android (com.dodderware.settha) and on iPhone (App Store). • Settha Agencies (com.dodderware.settha.agency), on Android, for the agencies and creators who publish those tours and manage their bookings. This policy applies to both. Sections 3 to 5 separate what each one collects, and we point out where the iPhone version works differently. We also publish a per-application version with the same content: • Travelers: https://settha.com/privacy/travelers • Agencies and creators: https://settha.com/privacy/creators Both applications use the same account and the same server, which is why one policy covers them.

SETTHA TECHNOLOGIES S.A.S. (NIT 901984471-6), based in Medellín, Antioquia, Colombia, is the controller of your personal data. Privacy contact: [email protected] Traveler support: [email protected] Creator support: [email protected]

Account data you provide when registering: • First and last name. • Email address. • Phone number. • Gender. • Profile photo, if you choose to add one. If you sign in with Google or with Apple (Sign in with Apple is available on iPhone), that provider gives us your name, your email address and an identifier for your account with that service; Google also gives us your profile photo. With Apple, the email may be a private Apple relay address if you chose to hide yours, and the emails we send you reach you through it. We also keep an encrypted Apple token that lets us revoke Settha's access to your Apple ID when you delete your account. Content you create: • Messages and photos you send through the in-app chat. Data collected automatically: • Device information: model, operating system version (Android or iOS) and app version. • IP address, for security and abuse control. • Crash reports and performance diagnostics (Sentry): the stack trace, the layout of the on-screen elements at the moment of the crash without their text or images, and your recent steps in the app. No screenshots or screen recordings are attached, and the provider's default personal-data option is turned off. • Product analytics (Mixpanel, Android applications only): a pseudonymous identifier and which screens are opened. It does not include the content of your tours or your messages. • A push notification token (Firebase Cloud Messaging), to tell you about messages and booking changes. On iPhone, Firebase delivers those notifications through Apple Push Notification service (APNs).

• Bookings: the tour, the date and time, the number of people and any add-on services you choose. • Payments: processed by Wompi (Bancolombia S.A.). Settha does NOT store card numbers. For each payment we keep a reference, the status, the payment method, the amount and the gateway transaction identifier. • Reviews and ratings you post. These are public and visible to other users and to the agency. • Favorites, searches and interactions with tours. • Reports and blocks: the reports you send about tours, reviews or users, with their reason and details, and the accounts you block. On iPhone you can also report a chat message; we then keep a copy of that message to review it. • Browsing without an account (iPhone): if you explore tours without signing in, the app sends a random installation identifier to keep your place in the feed. It is not linked to any account or to other device data. When you book, we share with the agency what it needs to provide the service: your name, the number of spots and the booked time.

• Agency or creator details: legal name, tax ID (NIT or cédula), Colombian National Tourism Registry (RNT) number and business address. • Banking details for payouts: bank, account type, account number and the holder's identification document. • Published content: videos, photos, descriptions, pricing and availability of your tours. This content is public in the travelers application. To record or choose a tour video, the application asks for camera and microphone access and opens the operating system's photo picker. The system picker hands us only the file you select: the application has no access to the rest of your gallery.

Both applications may ask for the device's location, always explaining what it is used for and always optionally. It is used in two distinct ways in the applications; the settha.com website uses a third, described in point 3. 1. Travel time (both applications). To show how far a tour or a stop is from you and how long it takes to get there, the device sends the location directly to a maps service: Google Maps Platform on Android and Apple Maps (MapKit) on iPhone. That request does not pass through Settha's servers. 2. "Near me" feed ranking (travelers application only, on Android and iPhone). To order tours by proximity, the travelers application does send a location to Settha, but it is rounded before it leaves the device: it is snapped to a 0.1 degree grid, roughly 11 km. In other words we receive the approximate area, not your exact position. The rounding happens on the device, before the request is built, so an exact coordinate never reaches the network, our logs, or any intermediary. 3. "Near you" tours on the settha.com website. Without asking for permission, the website uses the approximate location that our hosting provider (Cloudflare) infers from your connection's IP address, rounded to the same 0.1 degree grid before Settha is queried. Only if you tap "Use my exact location" does your browser ask for permission, and the location is rounded in the browser before it is sent. The website does not link it to you or store it in cookies. The agencies application sends NO location to Settha's servers. In neither case is your location shared with other users or with agencies, and in neither case is your position published. If you decline the permission both applications still work: cards show no travel time, and "Near me" ranks tours without taking proximity into account.

• We do not collect the Android Advertising ID (AD_ID) or Apple's advertising identifier (IDFA), and the iPhone app does not ask for tracking permission. The applications show no advertising and do no ad tracking. • We do not access your contacts, SMS, call logs, calendar, health data or biometrics. • We do not scan your gallery: photo and video access goes through the operating system's picker, which gives us only the file you selected. • We do not store card numbers. • We do not sell personal data.

• Create and maintain your account and authenticate you. • Operate the marketplace: publish tours, show them, book them and manage those bookings. • Process payments from travelers and payouts to agencies. • Send transactional notifications: chat messages, confirmations, cancellations and schedule changes. • Verify agencies' legal compliance (RNT, tax registration). • Withhold taxes and issue supporting documents as required by tax regulations. • Prevent fraud and misuse, and moderate reported content. • Understand product usage in aggregate in order to improve it.

We process your data on the basis of: • Performance of a contract (art. 6.1.b GDPR; art. 4(a) Colombian Law 1581 of 2012), to provide the service. • Legal obligation (art. 6.1.c GDPR): RNT registration, tax withholding and retention of transaction records. • Legitimate interest (art. 6.1.f GDPR): security, fraud prevention and content moderation. • Consent (art. 6.1.a GDPR): location, camera, microphone and notification permissions, which you can withdraw at any time from system settings.

Providers that process data on Settha's behalf: • Google LLC: Google Sign-In, maps and route calculation on Android (Google Maps Platform), and push notifications (Firebase Cloud Messaging). Policy: policies.google.com/privacy • Apple Inc.: Sign in with Apple, route calculation on iPhone (Apple Maps), and notification delivery on iPhone (Apple Push Notification service). Policy: apple.com/legal/privacy • Wompi (Bancolombia S.A.): payment and payout processing. Receives payment and billing data. Policy: wompi.co/politica-de-privacidad • Mixpanel Inc.: product analytics in the Android applications, with a pseudonymous identifier. Policy: mixpanel.com/legal/privacy-policy • Sentry (Functional Software, Inc.): crash and performance reporting. Policy: sentry.io/privacy • Cloudflare, Inc.: infrastructure and content delivery. Policy: cloudflare.com/privacypolicy In addition, when a booking is made we share with the agency what it needs to provide the service (section 4), and content an agency publishes is visible to travelers. We do not sell personal data and we do not share it with third parties for advertising.

• Account data: while the account is active; deleted within 30 days of a request, unless a legal retention duty applies. • Booking, payment and payout records: 5 years, under the Colombian Tax Statute (art. 632). • Agencies' legal documents (RNT, tax ID, identity documents): for the duration of the contractual relationship plus 5 years. • Banking details: while the bank account is registered. • Published content: while published plus 12 months for auditing. • Chat messages: 2 years from the last interaction. • Crash reports and analytics: up to 12 months.

Under Colombian Law 1581 of 2012 and, where applicable, the GDPR, you may access, rectify, update, delete and port your personal data, object to its processing and withdraw consents you have given. To exercise any of these rights, write to [email protected]. We respond within 10 business days for queries and 15 business days for rectification or deletion claims. Some data cannot be deleted while a legal obligation remains in force, for example transaction records during the tax retention period. You may also lodge a complaint with the Colombian Superintendency of Industry and Commerce (SIC).

You can delete your account in three ways: 1. In the app: Settings → Manage Account → Delete my account. 2. On the web, without needing the app: https://settha.com/account/delete. We email a verification code to the account address to confirm it is yours. 3. By writing to [email protected]. Once the request is confirmed in the app or on the web, we close the account immediately: you are signed out on every device and it can no longer be used to sign in. If you use Sign in with Apple, we also revoke Settha's access to your Apple ID. We then remove your tours from the marketplace (if you are an agency), cancel pending future bookings and notify those affected, process outstanding payouts, and delete or anonymize personal data within 30 days: your reviews, interactions and blocks are deleted and the messages you sent are blanked. When it is done, we send a confirmation to the account's email address. We keep transaction records for 5 years as required by tax law; these are segregated and not used for routine operations.

• All traffic between the applications and our servers is encrypted with TLS 1.2 or above. The applications do not permit unencrypted traffic. • Passwords are stored as a salted cryptographic digest, never in plain text. • We do not store card numbers: payment details go directly to the gateway. • Crash reports do not include screenshots. • Internal access is restricted by role, with access to banking data especially limited. We notify affected users and the Colombian Superintendency of Industry and Commerce within 72 hours of detecting a personal data breach.

Both applications are intended for adults (18 or older). The account holder enters into a payment or tourism services contract, which requires legal capacity. Tours may be suitable for minors and may be booked for them, but always by an adult account holder. We do not knowingly collect data from minors; if we identify a minor's account we delete it.

Your data may be processed outside Colombia, because some of our providers operate globally (Google, Apple, Mixpanel, Sentry and Cloudflare, mainly in the United States and the European Union). For these transfers we rely on Standard Contractual Clauses, on the providers' privacy certifications and, where the law requires it, on your explicit consent.

We may update this policy. Material changes are notified by email at least 15 days in advance and are visible in the application. The "Last updated" date at the top indicates the version in force.

SETTHA TECHNOLOGIES S.A.S. NIT 901984471-6 Medellín, Antioquia, Colombia Privacy and rights requests: [email protected] Traveler support: [email protected] Creator support: [email protected]