COOKIE, TRACKING TOOLS & TELEMETRY POLICY

1. SCOPE AND DISTINCTION OF TECHNOLOGIES

This Policy describes how SWOOPP, provided by Emanuele Cresta (empresario individual / trabajador autónomo under Spanish law, operating in his own name and under his own tax identity, NIF/NIE: Y8922606T, exclusive owner of EU trademark "SWOOPP"; "we", "us", "our"), utilizes web cookies, local storage, device technical identifiers, and Software Development Kits (SDKs) across the mobile app and website, taking into account the ePrivacy Directive (2002/58/EC as amended), applicable Spanish law (LSSI-CE Art. 22.2), and guidelines from the EDPB and the Spanish Data Protection Agency (AEPD).

Because technologies differ across platforms:

• On the Website: Standard session and persistent HTTP cookies, web beacons, and browser caches may be used;
• On the Mobile Application: Traditional HTTP browsing cookies are not used. Instead, local storage keys (e.g., AsyncStorage on Android, UserDefaults/Keychain on iOS), technical installation IDs, and software libraries (SDKs) for diagnostic telemetry may be employed.

2. CLASSIFICATION OF TECHNOLOGIES USED

Pursuant to Article 5(3) of the ePrivacy Directive and Article 22.2 LSSI-CE, technologies are classified into three categories:

A. Strictly Necessary Technical Technologies (No Prior Consent Required)

• Purpose: Ensure fundamental operation of the App and website, manage authentication, store essential user preferences (interface language, default selected currency), and defend server infrastructure against cyberattacks (rate limiting, load balancing, DDoS mitigation).
• Legal Basis & Statutory Ground: For access to strictly necessary information on the user's terminal, the consent exemption under Article 22.2 LSSI-CE applies. Where such access involves the processing of personal data, processing is based on the performance of the service requested by the User (Art. 6.1.b GDPR) or the legitimate interest of the Controller in infrastructure security (Art. 6.1.f GDPR).
• Types and Examples: Local storage keys (local storage / SharedPreferences / UserDefaults) for default currency and temporary cache of rates, session tokens, and essential telemetry.
• Duration: Limited to the session or strictly necessary duration (or until app uninstallation/cache clearing by User).

B. Analytical, Statistical, and Performance Telemetry Technologies

• Purpose: Measure Application performance, verify exchange rate API latency, and analyze aggregated feature usage to optimize user experience.
• Nature of Data: User interaction events are linked to pseudonymized technical IDs. These constitute pseudonymized personal data under the GDPR.
• Legal Basis & Consent: The qualification of analytics as "first-party privacy-preserving" (with IP truncation/masking, no cross-database linking, and no cross-device tracking) and reliance on legitimate interest are subject to documented pre-launch technical verification. Where applicable law or instrument configuration mandates consent, prior consent will be collected.
• Pre-Selection Principle: No third-party analytical SDK will be activated in production without prior technical verification of compliance with ePrivacy and GDPR.
• Duration: Analytical logs automatically expire or are de-identified within 12 months.

C. Advertising Identifiers and Installation Attribution (Prior Consent Required)

• Purpose: Measure promotional campaign effectiveness (attribution tracking) or display customized partner offers.
• Identifiers: Apple Identifier for Advertisers (IDFA) and Google Advertising ID (GAID).
• Legal Basis & Coordination: Processing and access to advertising identifiers require valid, prior, freely given, and informed consent (Art. 6.1.a GDPR and Art. 22.2 LSSI-CE). On iOS, operating system authorization via App Tracking Transparency (ATT) constitutes a separate OS-level technical gate and does not replace GDPR consent. SWOOPP does not access or track these IDs without a valid legal basis.

3. THIRD-PARTY TOOLS & SDK OVERVIEW

Google Analytics 4 on the website

The SWOOPP website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), to obtain aggregated statistics about visits and how the website is used. Google Analytics is loaded only after the user accepts the "Analytics" category in the cookie banner. If the user rejects it or makes no choice, no Google Analytics script is loaded and no Google Analytics cookie is set.

Legal basis: consent (Art. 6(1)(a) GDPR and Art. 22.2 of the Spanish LSSI).
Data processed: pseudonymous online identifiers, pages visited, approximate location derived from the IP address (Google Analytics 4 does not log or store IP addresses), and device and browser information.
International transfers: Google LLC may access the data from the United States. These transfers are covered by the EU-U.S. Data Privacy Framework, under which Google LLC is certified, and by Standard Contractual Clauses.
Withdrawal of consent: the user can withdraw consent at any time through the "Cookie settings" link in the footer of every page. Google Analytics cookies are then deleted and no further data is sent. Withdrawal does not affect the lawfulness of processing carried out before it.
More information: How Google uses information from sites that use its services.

4. MANAGING CONSENT AND USER PREFERENCES

Users may manage non-essential technology preferences through the following mechanisms:

1. Apple iOS Tracking Management (ATT Framework):
   Users may grant or deny tracking via the native App Tracking Transparency (ATT) prompt ("Ask App not to Track"). Settings can be modified at any time in iOS Settings > Privacy & Security > Tracking.
2. Google Android Advertising ID Management:
   Users may reset or delete their GAID in Android device settings under Privacy > Ads.
3. Web Browser Cookie Management:
   SWOOPP's website utilizes a compliant consent banner where non-essential cookies are blocked by default until explicit consent is given. Users can accept, reject, or customize preferences with equal ease, and adjust settings anytime via the "Cookie Settings" link in the website footer.
4. Geolocation (GPS):
   GPS localization is an operating system permission, not a cookie technology. Geolocation is processed in volatile memory without profile linkage, pursuant to Section 7 of our Privacy Policy.

5. POLICY UPDATES AND CONTACTS

This Policy is updated periodically alongside platform enhancements. Material changes will be communicated via the Application or website.

For questions regarding tracking tools and cookies:

• Privacy & Cookie Inquiries: privacy@swooppapp.com
• Legal Department: legal@swooppapp.com
• Official Website: https://swooppapp.com