Settha Privacy Policy (Travelers)

SETTHA TECHNOLOGIES S.A.S. (NIT 901984471-6), based in Medellín, Antioquia, Colombia, is the data controller. Privacy contact: [email protected]

Data you give us: • Account: first and last name, email, gender and, if you choose to add it, phone number. If you sign in with Google, Google gives us your name, email, account identifier and profile photo. If you sign in with Apple (on iPhone), Apple gives us your name, email (or a private Apple relay address, if you chose to hide yours) and account identifier, and we keep an encrypted token that lets us revoke Settha's access to your Apple ID when you delete your account. • Profile photo (optional): the image you pick with the system photo picker (Android or iPhone). The app receives only that photo; it does not access the rest of your gallery. • Bookings: the tour, date, time, number of people and add-on services you choose, and the payment status. • Messages you exchange with agencies through the in-app chat, and the availability or cancellation requests you send them. • Reviews and ratings of tours you took. Reviews are public inside the app and are shown with your name and profile photo. • Reports and blocks: the reports you send about tours, reviews, messages or users (reason and details; if you report a chat message, a copy of that message), and the list of accounts you block. The account you block is told that it can no longer message you, so it knows to use another channel if you have a booking in progress. • Problem reports you send us from the app, together with the technical device information attached to them. • Preferences: language, notifications and automatic translation. • Payment data: when you pay for a booking, your card details are collected by Wompi, our payment processor, on its own payment page. Settha never receives or stores card numbers or CVV; it only receives the payment status and reference. Data we collect automatically: • Location: if you grant location permission (approximate or precise), the app uses it for two things. First, to show the estimated driving time to a tour's meeting point: the app sends your coordinates directly from your device to Google Maps Platform (Routes API) on Android, or to Apple Maps (MapKit) on iPhone, without going through Settha's servers. On Android, the app keeps the travel times it has already calculated on your device for up to 24 hours, together with your location rounded to about 100 meters; that information never leaves the device and is excluded from backups. Second, to rank the "Near me" feed by proximity: the app sends Settha your location rounded on the device to a 0.1 degree grid (about 11 km), so we receive the approximate area and never your exact position. On the settha.com website, the "Near you" tab uses, without asking for permission, the approximate location that our hosting provider (Cloudflare) infers from your IP address, rounded to the same grid; only if you tap "Use my exact location" does your browser ask for permission, and the location is rounded in the browser before it is sent. The website does not link it to you or store it in cookies. We do not store it in your account or share it with agencies or other users. • App activity: the screens and tours you view, your likes, saves, shares and searches, to run and improve the service and its recommendations. • Device identifiers: a push-notification identifier (Firebase Cloud Messaging token) used to send you notifications, and pseudonymous installation identifiers used by our analytics and crash-monitoring tools. On iPhone, Firebase delivers notifications through Apple Push Notification service (APNs), and if you explore tours without signing in the app also sends a random installation identifier to keep your place in the feed, which is not linked to any account. • Technical and diagnostic information: device model, operating system version (Android or iOS), app version, crash reports (stack traces, the layout of the on-screen elements at the moment of the crash without their text or images, and your recent steps in the app) and performance metrics. We do not take screenshots. • IP address and connection data, for security, abuse control and session management (for example, the signed-in devices you see under Manage Account). Our analytics provider may infer an approximate location (city, region and country) from the IP address. Data we do not collect: • We do not collect the Android Advertising ID (AD_ID), Apple's advertising identifier (IDFA) or any other advertising identifier, and on iPhone we do not ask for tracking permission. The app shows no ads. • We do not access your contacts, SMS, call logs, health data or biometric data, or your photo gallery beyond the photo you pick.

• Provide the service: show tours, manage bookings and payments, enable chat with agencies, show the travel time to a tour, and rank "Near me" by proximity. • Give the agency you book with the information it needs to run the tour. • Personalize recommendations based on your activity. • Send transactional notifications and emails: verification codes, booking confirmations, new messages and reminders. • Moderate content: review reports, remove content that breaks our rules, and enforce the blocks you set. • Prevent fraud and abuse, and keep the platform and your sessions secure. • Diagnose crashes, measure app usage in aggregate and improve stability. • Meet legal, tax and tourism obligations. We do not use your data for advertising and we do not sell it.

We process your data based on: • Your prior, express and informed authorization (Colombian Ley 1581 de 2012, Art. 9, and Decreto 1377 de 2013, compiled in Decreto 1074 de 2015), which you give when you create your account and accept this policy, and the system location and notification permissions, which you can revoke at any time. • Performance of the service contract and of your bookings. • Compliance with legal obligations, such as keeping tax and tourism records. • Our legitimate interest in security, fraud prevention and crash diagnostics. For users in the European Union, these bases correspond to GDPR Art. 6(1)(a), (b), (c) and (f).

We share data only as far as needed to provide the service: • Tour agencies: when you book, the agency, and any staff or guides it authorizes, receive your name, the booking details and the messages you send them through the chat. Your reviews and profile photo are visible to other users and to the agency you reviewed. • Google LLC: Google sign-in (Credential Manager); travel-time calculation on Android (Google Maps Platform, Routes API), which receives your device coordinates and those of the meeting point; and push notifications (Firebase Cloud Messaging), which receives your device's notification identifier and the content of each notification, such as a snippet of a new message. Policy: policies.google.com/privacy • Apple Inc.: Sign in with Apple (on iPhone); travel-time calculation on iPhone (Apple Maps), which receives your device coordinates and those of the meeting point; and push notification delivery on iPhone (Apple Push Notification service). Policy: apple.com/legal/privacy • Wompi (Bancolombia S.A.): payment processing. Receives the payment details you enter on Wompi's payment page and the amount. Policy: wompi.co/politica-de-privacidad • Mixpanel Inc. (Android only): product analytics. Receives a pseudonymous identifier, app usage events and your IP address, from which it may infer your city, region and country. Policy: mixpanel.com/legal/privacy-policy • Sentry (Functional Software Inc.): crash and performance monitoring. Receives the device model, operating system, stack traces, the screen layout without its content, your recent steps in the app and a pseudonymous identifier. It does not receive screenshots. Policy: sentry.io/privacy • Cloudflare, Inc.: infrastructure and content delivery for the settha.com website. Receives the IP address and request metadata. Policy: cloudflare.com/privacypolicy • Authorities, when the law requires it. We do not sell your personal data or share it for advertising. Transactional emails are sent from our own mail server, and chat messages and automatic translations of tour content are processed on servers we operate.

• Account and profile data: kept while your account is active; deleted or anonymized within 30 days after your deletion request, except where the law requires us to keep it. • Booking and transaction records: 5 years, as required by Colombian tax law (Estatuto Tributario, Art. 632). • Chat messages: 2 years after the last interaction. • Content and user reports: up to 2 years, to handle claims and prevent abuse. Your list of blocked accounts is kept while your account is active. • Crash logs and analytics: 12 months, after which they are anonymized or deleted. • Travel times stored on your device: up to 24 hours.

Under Ley 1581 de 2012 and, where applicable, the GDPR, you have the right to: • Know, update and rectify your personal data. • Request proof of the authorization you gave. • Be told, on request, how your data has been used. • Revoke your authorization and/or request deletion of your data (see §8), where no legal or contractual duty requires us to keep it. • Access your personal data free of charge. • File complaints with the Colombian Superintendencia de Industria y Comercio (SIC). • Where the GDPR applies, object to processing based on legitimate interest and request data portability. To exercise any right, email [email protected] from the address linked to your account. We answer inquiries within 10 business days and claims (rectification, update or deletion) within 15 business days, as set out in Articles 14 and 15 of Ley 1581 de 2012.

You can request the deletion of your account at any time, without having to reinstall the app: • In the app: Settings → Manage Account → Delete my account. • By email: write to [email protected] from the address linked to your account, with the subject "Delete my account". Once we receive the request: 1. If you made it in the app, we close your account immediately: you are signed out on every device and it can no longer be used to sign in. If you use Sign in with Apple, we also revoke Settha's access to your Apple ID. 2. We stop using your data for any new purpose. 3. We delete or anonymize the personal data linked to your account within 30 days, and send a confirmation to the account's email address when it is done. 4. We keep only what the law requires, such as booking and transaction records for 5 years for tax and consumer-protection obligations. That information is kept separately and is not used for routine operations.

• Communication between the app and our servers is encrypted with TLS. • Passwords are stored only as one-way hashes, never in plain text. • Access to personal data is limited to authorized staff who need it to provide the service. • Your card details never pass through our servers. No system is perfectly secure. If a security incident affects your personal data, we will notify the affected users and the Superintendencia de Industria y Comercio as required by Colombian law.

Settha is not directed to children under 13. We do not knowingly collect data from children under 13. If you believe a child has registered, email [email protected] and we will delete the account. In jurisdictions where the minimum digital-consent age is 16 (e.g., parts of the EU), users under 16 must have parental or guardian consent.

Some of our providers (Google, Apple, Mixpanel, Sentry and Cloudflare) process data outside Colombia, mainly in the United States. We make these transfers under Article 26 of Ley 1581 de 2012: to countries that the Superintendencia de Industria y Comercio considers to offer an adequate level of protection, such as the United States, or based on your authorization. Where the GDPR applies, we rely on the Standard Contractual Clauses or equivalent mechanisms offered by these providers.

The settha.com website uses: • A "lang" cookie to remember your preferred language (valid 1 year). • For the "Near you" tab, an approximate location, as explained in the section on data we collect: it is not stored in cookies. • Tour photos and videos loaded from Settha's servers, and some agency profile photos hosted by Google, which receive your IP address as part of the request. The website uses no advertising cookies or analytics tools, and performs no cross-site tracking.

We may update this Privacy Policy. Material changes will be notified by email at least 15 days in advance and shown in the app. The "Last updated" date at the top of this document reflects the current version.

SETTHA TECHNOLOGIES S.A.S. NIT 901984471-6 Medellín, Antioquia, Colombia [email protected]