Privacy Policy

1. Information We Collect

2. How We Use Your Information

We use your personal information solely to:

• Facilitate booking and appointment management
• Verify your identity and age for service use (when date of birth is provided)
• Contact you about your bookings and services (when phone number is provided)
• Authenticate your access to the application via Firebase Authentication and Google Sign-In
• Improve user experience in the application
• Send notifications about your bookings
• Provide technical support when necessary
• Improve our services based on actual usage
• Synchronize bookings with Google Calendar: Create automatic events in your calendar when you make or cancel bookings (only if you enable this feature)
• Respect your preferences: We only synchronize if you explicitly authorize this integration in the application

3. Legal Basis for Processing

The legitimacy for data processing is based on the following legal grounds:

4. Storage and Security

Your data is stored on secure Google Firebase servers and protected through:

• Complete encryption: Data encrypted in transit (HTTPS) and at rest
• Protected passwords: Passwords are fully encrypted. Citali cannot access them; only Firebase allows users to change them upon request
• Secure Google Authentication: Google Sign-In uses OAuth 2.0 and OpenID Connect for secure authentication without sharing passwords
• International certifications: ISO 27001, SOC 1, SOC 2, and SOC 3
• Restricted access: Only authorized employees with two-factor authentication
• Regulatory compliance: Compatible with GDPR, CCPA, and international privacy frameworks
• Data isolation: Your data is logically separated and protected

5. Information Sharing

We do not sell, rent, or share your personal information with third parties, except:

• With establishments where you make bookings (only your name, email address, and phone number)
• With Google, when you use Google Sign-In, according to Google's terms of service and privacy policy
• With Firebase (Google Cloud Platform) for secure processing and storage of authentication data

5.1 Google Calendar Integration

• With Google Calendar API: Only when you explicitly authorize synchronization of your bookings
• Citali does NOT share your calendar data with third parties
• Google Calendar acts only as a synchronization tool under your control

6. Limited Use of Google Calendar Data

In accordance with Google's API Services User Data Policy, Citali's use of information received from Google APIs is limited to the specific purposes described in this Privacy Policy. Specifically:

• We access Google Calendar data only to create, view, and manage booking events on the calendars you explicitly authorize.
• We do not use Google Calendar data to develop, improve, or train AI/ML models.
• We do not share, sell, or transfer Google Calendar data to third parties for any purpose other than providing the booking synchronization service.
• Users can revoke Citali's access to their Google Calendar at any time through their Google Account settings or directly within the Citali app.

This policy adheres to Google's Limited Use requirements as outlined in the Google API Services User Data Policy.

7. Data Retention Periods

Personal data will be retained according to the following criteria:

In case of specific legal obligations, some data may be retained for legally established periods.

8. Recipients

During the processing of your data, Citali may only transfer data to:

• Companies affiliated with Citali for the provision of booking services
• Technical service providers (Firebase, notification services)
• Competent authorities when legally required

9. Your Rights

Data subjects may exercise the following rights at any time and free of charge:

• Access your personal information and view your complete booking history
• Modify your profile data
• Delete your account and associated data
• Control the notifications you receive and your integration with the device calendar
• Control Google Calendar integration: You can enable or disable synchronization at any time from the application
• Revoke Google Calendar access: You can revoke access from your Google account (Google Account Settings → Connected apps & sites) or from the Citali application

To exercise these rights, you can send a written request to the email address indicated in the contact section. You may be asked for your ID to verify your identity.

In case of violation of your rights, you can file a complaint with the Spanish Data Protection Agency through www.aepd.es.

10. International Transfers

Citali does not perform international data transfers. If necessary, the level of protection of the destination country will be verified and the guarantees required by applicable regulations will be adopted.

11. Data Accuracy

The user guarantees that the data provided is true, accurate, complete, and up-to-date, committing to inform of any changes. They will be responsible for any damage that may be caused by non-compliance with this obligation.

Optional fields: Date of birth and phone number are optional fields that enhance your experience when provided. The accuracy of this data is important for proper service delivery when you choose to share it.

If you provide third-party data, you declare that you have the consent of the interested parties.

12. Data Retention

We retain your personal information while your account is active or as necessary to provide you with services. You may request deletion of your data at any time.

13. Changes to this Policy

We may update this Privacy Policy occasionally. We will notify you of significant changes through the application or by email.