Legal

Data Protection and Privacy Policy

Last updated: October 2026

Introduction

Etapik — Early Childhood Development Mobile Application

Policy version: 1.0.6

Legal framework: Law 1581 of 2012 (Colombia)

1. Scope and Application

This Data Protection and Privacy Policy describes how Arttic S.A.S. ("Etapik", "we") collects, uses, stores, transfers and protects the personal data of those who use the mobile application Etapik (package com.arttic.etapik on Android and iOS), including the data of children whose profiles are created within the app.

This policy is issued in compliance with Colombian Statutory Law 1581 of 2012, Decree 1377 of 2013 (now compiled in Unified Regulatory Decree 1074 of 2015) and other applicable norms, as well as Article 15 of Colombia's Political Constitution regarding the right to habeas data.

Etapik is also distributed outside Colombia through Google Play and App Store. Section 17 explains how we serve users located in other jurisdictions.

2. Data Controller

Legal Name	Arttic S.A.S.
Tax ID (NIT)	902111689-2
Address	Santa Marta, Colombia
Email for personal data matters	[email protected]
Application covered	Etapik — `com.arttic.etapik` (prod) / `com.arttic.etapik.dev` (internal)

3. Definitions

For purposes of this Policy, and in line with Article 3 of Law 1581 of 2012:

Authorization: prior, express and informed consent of the Data Subject to process their personal data.
Privacy notice: communication directed to the Data Subject explaining the existence of this Policy.
Database: organized set of personal data subject to processing.
Personal data: any information linked to one or more determined or determinable natural persons.
Sensitive data: data that affects the intimacy of the Data Subject or whose misuse could generate discrimination. In Etapik, photos and videos of children, and any health data associated with prematurity, are processed with enhanced standards.
Data Processor: one who, on behalf of the Controller, processes personal data (see section 9).
Data Controller: one who decides on the database and/or processing (see section 2).
Data Subject: natural person whose data is processed. In Etapik there are two: the adult person who creates the account, and the child whose profile that person registers.
Processing: any operation on personal data, such as collection, storage, use, circulation or deletion.
Child's profile: set of data that the adult person registers within Etapik about their child (name, date of birth, gender, avatar, prematurity status).
Memory: photo or video that the adult person takes, records or selects from the phone's gallery to associate with a completed activity.

4. Governing Principles

The processing of personal data in Etapik is governed by the principles of Article 4 of Law 1581 of 2012:

Legality: processing is subject to this Policy and applicable law.
Purpose: data is collected for the purposes described in section 8, disclosed to the Data Subject.
Freedom: processing requires prior authorization; using Etapik without creating a child's profile does not require providing such data.
Veracity or quality: information must be truthful, complete, accurate and up-to-date; it is the responsibility of whoever registers it to maintain it so.
Transparency: the Data Subject may obtain information from the Controller at any time about data concerning them.
Access and restricted circulation: data, especially that of children, is only accessible to those authorized in this Policy.
Security: reasonable technical, human and administrative measures are applied (see section 14).
Confidentiality: those involved in processing are obligated to guarantee information confidentiality.

5. Who Can Use Etapik and Who Authorizes Processing

Etapik is designed to be used by an adult — mother, father, caregiver or guardian — on behalf of a child. The account is created with Google Sign-In and belongs to that adult, who is the one who logs in and manages the app.

When accepting the welcome screen, the adult declares themselves to be the legal representative (mother, father or guardian) of the children they register in Etapik and acts on their behalf with respect to this Policy, granting the authorization required by Article 9 of Law 1581 of 2012 for both their own data and that of the registered child. Etapik does not offer or permit a child to create, log into or manage their own account.

6. Personal Data We Collect

Etapik collects only the data necessary to provide its functions. Below is the complete breakdown by category.

6.1 Account Data (Authentication)

Email address, name and profile photo that Google provides when you sign in.
Unique user identifier assigned by Firebase Authentication.

6.2 Child's Profile Data

Name, date of birth, gender and chosen avatar.
Prematurity status and, if applicable, gestational weeks — only to calculate corrected age for activity and milestone filtering.

6.3 Usage, Progress and Gamification Data

History of completed activities and milestones, with date and time (UTC).
Streaks, gold stars, weekly trophies and game statistics — all calculated from previous history, not captured separately.

6.4 Memories: Photos and Videos

Photos or videos that the adult takes, records or selects from the phone's gallery for a specific activity.
Metadata of that record: type (photo or video), associated activity and child, date.

These files are not uploaded to any server. They are copied to the app's own documents folder within the phone. Etapik has no backend for memories and does not sync them to the cloud: if you change phones without manual backup, they are not preserved.

6.5 Technical and Notification Data

App version, operating system and flavor (dev/prod), for support and diagnostics.
Local scheduling of activity reminders — does not require a token sent to an external server.

7. Where and How Data Is Stored

Etapik has no backend. The vast majority of data lives only on the user's phone:

Data	Where it lives
Profiles, progress, settings	Local device storage (SharedPreferences)
Activity completion history	Local Hive database, within the phone
Memories (records)	Local Hive database, within the phone
Memories (photo and video files)	App documents folder, within the phone
Login credentials	Firebase Authentication servers (Google)

Each Etapik installation is isolated by the phone's operating system: no other app can directly read these files.

8. Purposes of Processing

The data described in section 6 is used exclusively to:

Authenticate the adult and identify them as the account holder.
Display the activity catalog appropriate for the child's age — or corrected age.
Record and display progress: history, streaks, gold stars and weekly trophies.
Save the memories that the adult chooses to keep within an activity.
Schedule and display local activity reminders.
Provide technical support and diagnose failures.
Comply with legal obligations and respond to competent authority requests.

Etapik does not use this data for third-party advertising purposes, does not create marketing profiles with it, and does not sell or transfer it in exchange for any consideration.

8.1 Declaration on Artificial Intelligence

Etapik does not use artificial intelligence, machine learning, or generative AI algorithms in the processing of personal data, nor in the selection or recommendation of activities. The activity catalog is filtered solely by the child's age or corrected age, using simple and deterministic rules programmed in the application code — not by trained AI systems.

8.2 Privacy Label for App Stores

Data that Etapik collects and declares in Google Play and App Store:

Email address and profile name (necessary for authentication)
Name, date of birth and gender of the child (necessary to personalize content)
History of completed activities (necessary to display progress)
Photos and videos recorded by the family (stored locally, not uploaded)
App and operating system version (for technical support)

Data that Etapik does NOT collect: Location, contacts, calendar, search history, financial information, health information (beyond voluntarily registered prematurity), biometric data, advertising identifiers.

All information is stored only on the user's device, with the exception of authentication credentials (Firebase).

8.3 Responsibility for User-Generated Content

Etapik does not provide functionality to upload content to Arttic servers. The only files users can create — photos and videos of "Memories" — are saved only in the local storage of the device (private app documents). These files:

Are never transmitted to Etapik servers or third parties, unless the user manually saves them to the phone's camera roll (an OS operation, not an app operation).
Are not published, shared or circulated outside the device.
Are the sole responsibility of the user who captures them.

Therefore, Arttic S.A.S. is not responsible for violations of copyright, trademarks, privacy of third parties or other inappropriate content in files that remain under user control, as provided by applicable law.

9. Third Parties Involved in Processing

Etapik relies on a small number of providers (Data Processors), each limited to what is strictly necessary for their function:

Provider	What it receives	Purpose
Google LLC / Firebase	Email, name, profile photo, user identifier	Sign-in (Google Sign-In, authentication)

No provider receives photos or videos of "Memories". These files never leave the phone, except if the adult themselves saves them to the device's camera roll — a local operating system operation, not transmission to Etapik or a third party.

International Data Transfer

When using Firebase, account data (section 6.1) may be processed on servers located outside Colombia. This transfer takes place under Article 26 of Law 1581 of 2012, adopting the contractual guarantees and data protection certifications that each provider publishes for its service.

10. Children's Data

Etapik processes data of minors only through the profile that a responsible adult registers on their behalf, never directly. The following guarantees apply to this processing, in addition to what is already stated in section 5:

Best interests of the child: data collected is limited to what is necessary for the app's purpose (customize activities, measure progress, save memories the adult chooses to keep) and is not used for any other purpose.
No external profiling: Etapik has no social features or public profiles — the child's name, photo or data are not visible to other app users.
Permanent adult control: from the app, the adult can at any time edit the child's profile, delete a specific memory or delete the entire account.
Corrected age without guessing: if the profile is marked as premature but gestational weeks are not indicated, Etapik does not correct age — it avoids constructing health data based on assumption.

These guarantees reflect Article 12 of Decree 1377 of 2013 and the principle of best interests of the child recognized by Colombia's Constitutional Court in matters of children's habeas data.

11. Legal Basis and Authorization

By using Etapik, the adult grants the prior, express and informed authorization required by Article 9 of Law 1581 of 2012, both for the processing of their own data and, in their capacity as legal representative, for the child's data whose profile they register. This authorization may be revoked at any time as stated in section 12.

12. Data Subject Rights

As Data Subject — directly, or as legal representative of the registered child — you have at all times the rights granted by Article 8 of Law 1581 of 2012:

Know, update and correct personal data.
Request proof of the authorization granted.
Be informed of how your data has been used.
File complaints with the Superintendence of Industry and Commerce (see section 19).
Revoke authorization and/or request deletion of data, when there is no legal or contractual obligation to keep it.
Access free of charge personal data that has been processed.

13. Procedure for Requests, Complaints and Rights Assertion

To consult, update, correct or delete data, or revoke authorization, the Data Subject may:

From the app: edit the child's profile from Profile, delete a specific memory from the corresponding activity, or delete the entire account from Profile → Delete Account.
By email: writing to [email protected], indicating the name associated with the account and your specific request.

Response times are as provided by law: requests, ten (10) business days, extendable by five (5) additional business days upon notification of reason; complaints, fifteen (15) business days from filing.

What exactly "Delete Account" removes

It deletes the adult's profile and associated children's profiles, activity and milestone history, and the records and files of all saved memories. A memory already saved to the phone's camera roll outside of Etapik is not affected: it belongs to the user, not the app.

14. Information Security

Communications with Firebase are encrypted (HTTPS/TLS).
Local storage (profiles, history, memories) is isolated by the operating system within the app's own container; no other phone app can directly read it.
Because there is no central server holding all users' data, the surface for potential attack or mass data breach is reduced: each memory and each history lives only on its owner's phone.
Access keys to external services are managed per environment (development/production) and are not exposed in distributed source code.

15. Data Retention and Deletion

Data is retained while the account exists and is necessary for the purposes stated in section 8. When you delete your account from the app, the profile, history and all associated memories (records and files) are permanently deleted.

16. Device Permissions

Permission	What Etapik uses it for
Camera	Take a photo or record a video as a memory of an activity.
Gallery / Photos	Choose an existing photo or video as a memory, or save to camera roll what was captured with Etapik's camera.
Notifications	Show daily activity reminders; turned on or off from Profile.

What is captured with Etapik's camera is also copied to the phone's camera roll, without creating a separate album: this allows requesting only "add" permission, rather than full gallery access that a named album would require. What is chosen from the gallery is not copied again, because it's already there.

17. Users Outside Colombia

The legal framework for this Policy is Colombian data protection legislation. For users located in other countries, Etapik recognizes equivalent rights of access, correction, opposition and deletion, and complies with additional standards required by applicable local law for the protection of children's personal data — for example, principles analogous to those of the General Data Protection Regulation (GDPR) of the European Union or the Children's Online Privacy Protection Act (COPPA) of the United States — to the extent they apply to Etapik's operations as described in this Policy.

18. Changes to This Policy

This Policy may be updated to reflect changes in the app, changes in the providers listed in section 9, or changes in applicable regulations. Material changes will be communicated within the app before they take effect. The date of last update appears at the beginning of this document.

19. Supervisory Authority

The Superintendence of Industry and Commerce (SIC), through its Directorate for Personal Data Protection, is the oversight and supervisory authority in Colombia. Any complaints related to the processing of personal data described in this Policy may be filed with the SIC after exhausting the direct process with Arttic S.A.S. described in section 13.

Superintendence of Industry and Commerce — www.sic.gov.co

20. Contact

For any questions about this Policy or the processing of personal data in Etapik:

Email	[email protected]
Legal Name	Arttic S.A.S.
Tax ID (NIT)	902111689-2
Address	Santa Marta, Colombia