1. Identity and Domicile of the Data Controller In strict compliance with the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) of the United Mexican States and international privacy standards, the user (the "User") is hereby informed that the Data Controller responsible for processing their personal data is Kevin Fabian Gudiño Jacobo, an independent developer with an operational domicile in the municipality of Zapopan, Jalisco, Mexico, and a contact email for privacy and legal matters: kevin.ing.indu@gmail.com.

2. Privacy by Design Architecture (Offline AI vs. Cloud Services) DocuTalk is designed, built, and operated under the fundamental and guiding principles of Privacy by Design and Privacy by Default:

• Strict Local Processing (Offline AI & OCR): When the User utilizes local voice engines or the Optical Character Recognition (OCR) scanner to extract text from images, the App DOES NOT transmit, DOES NOT collect, DOES NOT store, and DOES NOT process the content of the documents (PDF, DOCX, TXT, EPUB) or photographs/images (JPG, PNG) on any external server. All text-to-speech processing and optical reading are executed strictly locally and ephemerally within the RAM and hardware of your device.

• Exception for Voluntary Use of Cloud Services: If the User consciously, affirmatively, and voluntarily chooses to use internet-requiring features (such as HD network voices like Google TTS / Google TTS Pro, or the "AI Summarize" function), extracted text fragments will be transmitted via encrypted API calls to third-party servers (primarily Google LLC or OpenAI). Such processing is governed by the proprietary privacy policies of these infrastructure providers. The developer does not store copies of these transmissions on proprietary servers.

3. Personal Data Collected and Purposes of Processing The Data Controller DOES NOT directly or indirectly collect sensitive personal data, such as real names, physical addresses, phone numbers, bank records, official identifiers, biometric data (the OCR does not perform facial recognition), or precise geolocation data. The only technical, anonymous, or pseudonymized data collected is processed through third-party libraries and SDKs for the following essential purposes:

• Google Play Billing (PRO Subscription Management): Processes anonymous purchase tokens and subscription statuses to enable premium features. The Data Controller has no access to, does not process, and does not store credit/debit card numbers or banking information.

• Google AdMob (Monetization in Free Version): Collects anonymous device advertising identifiers (Advertising ID) and ad interaction metrics to display relevant advertising or manage temporary reward access ("Pro 1H").

• Technical Metrics and Crash Reports (Crashlogs): Anonymous collection of system diagnostic logs (device model, operating system version, processor architecture, and error logs) used exclusively to debug code flaws, optimize the OCR engine, and improve the App's stability.

4. Device Permissions and Justified Purposes For the correct, safe, and efficient performance of its functions, the App will request explicit access to the following local permissions on the User's device:

• Storage and File Access (Media / Scoped Storage / Gallery): Indispensably required to access, read, and subject to OCR the local documents and images explicitly selected by the User (PDF, DOCX, TXT, EPUB, JPG, PNG), as well as to save exported audio files (MP3, WAV, MP4) to local memory. No file is extracted from the device without the User's action.

• Network and Internet Access: Used solely to verify Google Play subscription status, load advertising, query cloud functions (only if activated by the User), and download local voice or language models during the initial setup.

• Notifications and Foreground Services (MediaStyle): Required to keep the media player active when the screen is off or other applications are being used, ensuring uninterrupted playback and displaying reading controls.

5. Data Transfer to Third Parties The Data Controller does not sell, rent, transfer, or commercialize personal data or the content of users' documents under any circumstances. The only transfers of anonymized technical data or text fragments (by user choice) occur due to the direct integration of cloud infrastructure services (Google Play Services, AdMob, Google Cloud TTS, AI APIs) under their own Terms of Service and rigorous international data protection standards.

6. Exercise of ARCO Rights (Access, Rectification, Cancellation, and Opposition) Due to the Offline First architecture of the App, the Data Controller does not maintain personal profiles, user accounts, or databases associated with the real identity of Users on proprietary servers. Therefore, "Cancellation" or "Opposition" to data use is executed immediately and autonomously by the User by uninstalling the App and deleting its local data/cache from their device settings. However, for any legal questions, clarifications, or the exercise of ARCO Rights regarding technical telemetry, the User may send a formal request to the email: kevin.ing.indu@gmail.com.

7. Modifications to the Privacy Notice The Data Controller reserves the right to make modifications or updates to this Privacy Notice at any time to address legislative novelties, jurisprudence, internal policies, or new technological and app store requirements. Updated versions will be publicly and permanently available within the App and on its official website.