Privacy Notice

1. Identity and address of the Data Controller

The party responsible for processing your personal data is:

RICARDO ULISES ESLAVA VENTURA, sole proprietor (persona física con actividad empresarial), with address in APODACA, NUEVO LEÓN, Mexico, hereinafter referred to as “Wishpoints”, “we”, “us” or “the Controller”.

Contact details for privacy matters:

• Email: hola@wishpoints.mx
• General support email: hola@wishpoints.mx
• Website: https://wishpoints.mx

2. Personal data we collect

In order to provide you with the Wishpoints service, we collect the following personal data:

2.1 Identification and contact data

When you create an account:

• Name or display name
• Email address
• Password (stored as a cryptographic hash — we never have access to the plain text)
• Country of residence (optional)
• Avatar photo (optional)

If you sign in with Google or Apple Sign In, we additionally receive from those providers:

• Your name and email address associated with that account
• Your public profile picture (if applicable)
• A unique identifier for that account

If you use Apple’s “Hide My Email” option, we will receive an anonymous relay address generated by Apple instead of your real email address.

2.2 Platform usage data

As you use Wishpoints, the following data is generated:

• Places you save as “want to go” or “visited” (wishpoints)
• The category automatically assigned to each wishpoint
• Personal tags you add to each wishpoint
• Personal notes you write on each wishpoint
• Photos you upload to your wishpoints
• The date on which you mark a place as visited
• The emotion associated with a visited wishpoint (if you choose to add one)
• “Favorite” marks on your wishpoints
• Countries counted in your digital passport

2.3 Geolocation data

• Geographic coordinates and address of the place you save as a wishpoint (this is the location of the place, not your real-time location)
• If you enable the “My location” permission on the map: your approximate location at that moment, used solely to center the map. We do not store your personal location on our servers unless you choose to save it as a wishpoint.

2.4 Technical data

As part of the app’s normal operation and for security purposes:

• The IP address you connect from
• A client identifier (X-Client-Id) generated locally by the app
• An installation identifier (installationId), an anonymous, persistent identifier generated when you install the app, used exclusively to associate your device with push notifications
• A push notification token (Firebase Cloud Messaging), required in order to send notifications to your device
• Operating system and version, device model
• Application version
• Activity logs relevant to security and auditing (authentication logs, failed attempts, password changes, account deletion, etc.)
• Encrypted session tokens

We do not use behavioral analytics, advertising, or third-party tracking tools (for example, Firebase Analytics, Crashlytics, or advertising SDKs). Firebase is used solely to deliver push notifications.

2.5 Transaction data

When you purchase a Premium subscription:

• We neither receive nor store your bank card details. Payments are processed directly by the Apple App Store or Google Play, depending on your device.
• We receive from the payment processor (via RevenueCat): your subscription status, the plan purchased, the start date and the renewal or cancellation date, and an anonymous purchaser identifier.

2.6 Sensitive data

We do not request or knowingly collect sensitive personal data (racial or ethnic origin, health status, genetic information, religious, philosophical or moral beliefs, union membership, political opinions, sexual preference). However, the photos you upload may contain your image or that of third parties. This is addressed in section 6.

3. Purposes of processing

3.1 Primary purposes (necessary for the service)

Without these purposes we cannot provide you with Wishpoints. By using the application you consent to processing for the following purposes:

• Creating, maintaining and managing your user account
• Authenticating you when you sign in
• Displaying the wishpoints you have saved and allowing you to edit or delete them
• Displaying your digital passport of visited countries
• Processing and validating your Premium subscription if you choose to purchase one
• Displaying the map with the places you have saved
• Allowing you to share wishpoints publicly when you voluntarily choose to do so
• Sending you transactional and service push notifications, if you have granted the corresponding permission
• Preventing fraud, abuse and unauthorized access, and protecting the security of the platform and of other users
• Complying with legal obligations and responding to requests from competent authorities
• Responding to support requests you send us

3.2 Secondary purposes (optional, you may object)

You may object to the following purposes without this affecting the provision of the service:

• Sending email communications about new features, improvements, editorial content related to travel, and tips on using Wishpoints
• Sending promotional and reminder push notifications (non-transactional) about Wishpoints or related products from the same Controller
• Aggregate, anonymous statistical analysis of application usage in order to improve the service

You may object at any time by revoking the notification permission in your device settings, adjusting your preferences in the app’s Settings screen, or by following the procedure in section 7 (ARCO Rights).

4. Transfers of data to third parties

In order to operate the service, we transfer some of your data to the following third parties, which act as data processors and are contractually obliged to process it solely for the purposes described and in accordance with applicable law.

Sharing wishpoints publicly: if you choose to enable the sharing feature for a wishpoint, a public link is generated with no expiration date. The content that becomes accessible to anyone with the link is:

• The name of the place, its category, city and country
• The exact geographic coordinates and address of the place (information that belongs to the place, not to you)
• The first photo of the wishpoint, if it has one
• Your display name and your avatar

The following are not made public: your personal notes, your tags, the associated emotion, the exact date of your visit, or any additional photos (from the second one onward).

The link stops being available when you delete the corresponding wishpoint or your account.

We do not sell your personal data to third parties. We do not share data with advertisers or data brokers, or for any purpose other than those described in this Notice. Wishpoints does not display advertising.

No additional transfers without consent: other than those described above and those provided for by law (article 37 of the LFPDPPP, for example requests from a competent authority), we do not transfer your personal data to third parties without your consent.

5. Data retention periods

6. Photos and user-uploaded content

The photos you upload to Wishpoints are yours. However:

• By uploading them, you grant Wishpoints a limited, non-exclusive and revocable license to store them, display them within your account and, if you choose to share a wishpoint, display the first of them on the corresponding public link.
• You are responsible for having authorization to upload any photo that includes recognizable third parties, and for not uploading content that infringes the copyright, image rights or privacy of third parties.
• Do not upload photos of minors without the consent of their guardian or legal representative.
• Do not upload photos with intimate, sexual, violent, illegal or offensive content (see Terms and Conditions, Prohibited Conduct section).
• When you delete a wishpoint or your account, the associated photos are permanently deleted from our storage.

7. ARCO Rights and how to exercise them

You have the right to Access the personal data we hold about you, to Rectify it when it is inaccurate or incomplete, to Cancel it when you consider it is not necessary for any of the stated purposes, and to Object to its processing for specific purposes (known in Mexico as ARCO rights).

7.1 How to exercise your rights

From within the app itself:

• Access to your basic data: Settings → My profile
• Rectification of name, country and avatar: Edit profile
• Cancellation in full: Settings → Delete my account (immediate and irreversible deletion of all your data, including photos)
• Objection to secondary purposes: Settings → Notification preferences, or by revoking the notification permission in your device settings

By email:

Send a request to hola@wishpoints.mx containing:

1. Your full name and the email address registered with Wishpoints
2. A document proving your identity (a copy of a valid official ID; you may redact any information other than your name and photograph)
3. A clear description of the right you wish to exercise and the personal data it applies to
4. Any other information that helps us locate your data

7.2 Response times

In accordance with the LFPDPPP, we will respond within a maximum of 20 business days from the date we receive your complete request. If your request is granted, we will act upon it within the 15 business days following the date on which we communicate our response.

7.3 Negative or unsatisfactory response

If you are not satisfied with our response, you may file a request for the protection of your rights with the competent data protection authority in Mexico.

8. Account deletion

You may delete your account at any time from Settings → Delete my account within the application.

Deletion is immediate, permanent and irreversible. Upon confirming deletion, the following are definitively erased:

• Your user account
• All your wishpoints (including photos, notes, tags and other content)
• Your digital passport of visited countries
• Your session and refresh tokens
• Your push notification registration (installation identifier and token)
• All public wishpoint links you have generated, which stop being available
• Any other personal data associated with your account

Exception: we may retain certain minimal information in order to comply with legal obligations (for example, records related to subscriptions for tax purposes) for the period required by law. These records are kept in isolation and are not used for any other purpose.

Active Premium subscription: if you have an active Premium subscription, you must first cancel it through the App Store or Google Play before you can delete your account. This prevents future charges after deletion.

9. Withdrawal of consent

You may withdraw the consent you have given us for the processing of your personal data at any time. Withdrawal may be total (account deletion) or partial (objection to secondary purposes).

Withdrawal will not have retroactive effect on processing carried out before the withdrawal, nor does it affect processing that is necessary to comply with legal obligations or that arises from the legal relationship between you and the Controller.

10. Use of cookies, identifiers and tracking technologies

In the mobile application

Wishpoints does not use cookies within the mobile application. We do use:

• An anonymous client identifier (X-Client-Id) generated locally by the app, which allows us to recognize your installation even if you have not yet created an account
• An anonymous installation identifier (installationId), persistent for as long as the app is installed, used exclusively for push notifications
• The push notification token provided by Firebase Cloud Messaging
• Encrypted session tokens stored securely on the device
• Device identifiers provided by iOS and Android

We do not use the device advertising identifier (IDFA / AAID) and we do not track you across third-party apps or websites.

On the wishpoints.mx website

The website may use cookies that are strictly necessary for its operation and, potentially, anonymous and aggregated analytics cookies. If additional cookies are introduced in the future (non-anonymous analytics, advertising or third-party cookies), this Notice will be updated and your consent will be requested in accordance with applicable regulations.

11. Changes to this Privacy Notice

Any substantial change to this Notice will be communicated through:

• A notice inside the application when you sign in
• Publication of the new version at wishpoints.mx/legal/privacidad indicating the date of the last modification
• Where the change involves new purposes or transfers to third parties, we will notify you at least 30 calendar days in advance

Continued use of Wishpoints after the effective date of the changes constitutes your acceptance of the updated Notice.

12. Minimum age of use

Wishpoints is intended exclusively for people over 18 years of age. We do not knowingly collect personal data from minors. If we detect that an account has been created by a minor, we will delete it along with the associated data. If you are a parent, guardian or legal representative and believe we have collected data from a minor in your care, please contact us at hola@wishpoints.mx and we will delete it.

13. Effective date and acceptance

This Privacy Notice takes effect upon its publication at wishpoints.mx/legal/privacidad.

By creating a Wishpoints account, by using the application as an anonymous user, or by continuing to use the service after changes to this Notice have been published, you declare that you have read, understood and accepted its terms.

This Notice is also available in Spanish: Versión en español.

Version: 1.1 Last updated: 11/07/2026

This Privacy Notice is governed by Mexican law. In the event of any discrepancy between this English translation and the Spanish version, the Spanish version shall prevail.