PRIVACY POLICY

1. Introduction

Welcome to SuperBuho ("we", "our", or "us"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and related services (collectively, the "App"). Please read this policy carefully. If you do not agree with its terms, please discontinue use of the App.

2. Information We Collect

We may collect the following categories of information:

• Account Information: Username, institutional email address, CIP code, and role within the organization, provided at the time of account creation.

• Profile Information: First name, last name, police rank, and assigned organizational unit.

• Authentication Data: Hashed passwords, two-factor authentication (2FA) secrets, and recovery codes. We never store plain-text passwords.

• Device Tokens: Expo Push Tokens generated by your device to enable push notifications. These tokens are linked to your user account and to your device's platform (iOS, Android, or web).

• Usage Data: Log data such as IP addresses, access timestamps, session identifiers, and actions performed within the App, collected for security and audit purposes.

• Field Reports: Operational data submitted through the App, including report content, submission timestamps, and associated geographic point identifiers.

3. How We Use Your Information

We use the information we collect to:

• Authenticate your identity and maintain the security of your account.

• Deliver push notifications to your device when the App is in the background or closed.

• Provide, operate, and improve the features and functionality of the App.

• Generate operational reports and consolidations for authorized personnel.

• Maintain audit logs in compliance with institutional security standards (ISO 27001, NIST).

• Detect, investigate, and prevent fraudulent or unauthorized activity.

• Send administrative communications related to your account or the App.

4. Push Notifications

The App uses Expo Push Notifications to send alerts and updates to your device. To enable this feature, we store your device's Expo Push Token on our servers. This token is:

• Associated with your user account and device platform.

• Removed automatically when you log out of the App.

• Not shared with third parties beyond Expo's notification delivery infrastructure.

You may disable push notifications at any time through your device's system settings. Disabling notifications does not affect your ability to use the App.

5. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information. We may share data only in the following circumstances:

• Service Providers: With trusted third-party providers (such as Expo for push notifications) that assist in operating the App, under strict confidentiality agreements.

• Institutional Authorities: With authorized supervisors or administrators within your organization, as required by the operational nature of the App.

• Legal Requirements: If required to do so by law or in response to a valid legal process (e.g., a court order or government request).

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the App's services. Device tokens are deleted upon logout. Audit logs may be retained for longer periods as required by applicable security and compliance standards.

7. Data Security

We implement industry-standard security measures to protect your information, including encrypted storage of credentials, mandatory two-factor authentication, session-based audit trails, and access controls based on roles and permissions. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.

• Request correction of inaccurate or incomplete data.

• Request deletion of your account and associated personal data.

• Withdraw consent for optional data processing at any time.

To exercise any of these rights, please contact us using the information in Section 10.

9. Children's Privacy

SuperBuho is intended for use by authorized institutional personnel only. The App is not directed to individuals under the age of 18, and we do not knowingly collect personal information from minors.

10. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at:

SuperBuho Support Team

Email: dirin.pi3@policia.gob.pe

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Continued use of the App after any changes constitutes your acceptance of the revised policy. We encourage you to review this page periodically.