Privacy Policy

PERSONAL DATA PROTECTION AND PROCESSING POLICY — SENTIRA

Data Controller

G&B Digital SAS, a company duly constituted under the laws of the Republic of Colombia, with its principal address in Bogotá D.C. (hereinafter, the “Company”), is the data controller responsible for the processing of personal data collected through the SENTIRA application (hereinafter, the “App”).

For inquiries related to the processing of personal data, contact: info@sentira.com.co

Introduction

In compliance with current regulations on the protection of personal data, G&B Digital SAS adopts this Personal Data Processing Policy. Respect for privacy and the right of data subjects to know, update, rectify, delete, or dispute the information held in our systems is a fundamental pillar of SENTIRA.

This Policy governs the processing of personal data in all processes and services offered by the App and is mandatory for G&B Digital SAS and any third party involved in the processing of information under our responsibility.

1. Definitions

• Authorization: Prior, express, and informed consent given by the data subject for the processing of their personal data.
• Database: An organized set of personal data subject to processing.
• Processing: Any operation or set of operations performed on personal data, including collection, storage, use, circulation, or deletion.
• Data Processor: Natural or legal person who processes data on behalf of the controller.
• Data Controller: Natural or legal person who decides on the database and the processing of personal data.
• Data Subject: Natural person whose data is being processed.
• Personal Data: Information linked to or that can be associated with an identified or identifiable natural person.
• Sensitive Personal Data: Information that affects the privacy of the data subject or whose misuse may generate discrimination. This includes mental health data.
• Users: People registered on SENTIRA who access the digital services offered by the App.

2. Principles of Personal Data Processing

The processing of personal data at SENTIRA is governed by the following principles:

• Legality: Processing will be carried out in accordance with applicable regulations.
• Purpose: Data will be processed for legitimate purposes informed to the data subject.
• Freedom: Processing requires the consent of the data subject, except for legal exceptions.
• Truthfulness and Quality: Data will be truthful, complete, up-to-date, and understandable.
• Transparency: The data subject may know the information processed at any time.
• Restricted Access and Circulation: Data will only be accessible by authorized persons.
• Security: Technical and administrative measures will be implemented to protect the information.
• Confidentiality: Information will be treated with strict confidentiality, even after the relationship with the data subject has ended.

3. Information We Collect

We collect the following information when you use SENTIRA:

• Account information: Your name, email address, and authentication credentials (via email/password or Google Sign-In).
• Chat messages: The text messages you send to and receive from Luna, our AI wellness companion.
• Journal entries: Written reflections you create within the App.
• Mood and wellness data: Daily check-in responses including mood, stress, sleep, and energy ratings, and any notes you add.
• App preferences: Your notification settings, conversation style preferences, and display settings.
• Usage data: Interaction patterns with wellness tools (e.g., breathing exercises, grounding exercises) to personalize your experience.
• Device information: Information about your device and digital interactions for functionality and security purposes.
• Payment data: When applicable, payment information processed through our payment provider (see Section 7).

4. How We Use Your Information

We use your information for the following purposes:

• To provide AI-powered wellness conversations through Luna, our chat companion.
• To generate personalized mood insights and identify emotional patterns based on your check-in data.
• To suggest relevant wellness tools and journaling prompts tailored to your emotional state.
• To maintain conversation continuity by summarizing prior chat context.
• To manage accounts and billing processes.
• To communicate with you about your account, app updates, and support requests.
• To improve the quality and relevance of our services.
• To conduct quality and satisfaction analyses.
• To ensure the security of the App.
• To manage requests, complaints, and claims.
• To comply with legal and regulatory obligations.

Sensitive data will be processed solely for purposes related to the user’s well-being and the provision of the Services, within the limits authorized by the data subject.

5. Third-Party AI Service

SENTIRA uses OpenAI, a third-party artificial intelligence service, to power the Luna AI chat feature. When you interact with Luna, the following data is sent to OpenAI for processing:

• Your chat messages and conversation history.
• A summary of prior conversations (not the full text) to maintain context.
• Wellness data (mood scores, energy, sleep, stress levels, and any notes you add to check-ins) to personalize responses.
• Excerpts from your journal entries (excluding entries you mark as private) to provide relevant support.
• Wellness tool session data (e.g., thoughts from reframing exercises, situations from thought analysis) to inform conversations.

Your name and email address are NOT sent to OpenAI. OpenAI processes this data solely to generate responses and does not use it to train their models. OpenAI’s data handling is governed by their API data usage policy, which prohibits using API inputs and outputs for model training.

By using the Luna chat feature, you consent to this data being processed by OpenAI. You may choose not to use the chat feature if you do not wish to share data with this third-party service.

6. Data Sharing

We do not sell your personal information. We share data only with the following parties and only as necessary to provide our services:

• OpenAI: Chat messages and wellness context for AI-powered conversations (see Section 5).
• Supabase: Our database and authentication provider, which stores your account and app data under strict data processing agreements.
• Stripe: If you subscribe to a paid plan, Stripe processes your payment information. We do not store your credit card details.

We do not share your data with advertisers or data brokers. All third-party service providers are contractually obligated to protect your data, maintain confidentiality, and use it only for the purposes specified.

G&B Digital SAS may transfer personal data to third parties only when necessary for the provision of the Services, the fulfillment of contractual obligations, or compliance with applicable regulations.

7. Data Security

We implement industry-standard security measures to protect your data:

• All data is encrypted in transit using TLS/SSL.
• Data at rest is encrypted in our database.
• Authentication is managed through Supabase with secure token-based sessions.
• API communications with third-party services use encrypted connections and authenticated API keys.
• Payment processing is handled by Stripe, which implements data encryption protocols, secure authentication, and compliance with international security standards in the payments industry.
• We conduct regular security reviews of our infrastructure.

G&B Digital SAS does not directly process sensitive financial information such as full credit card numbers, security codes (CVV), or bank passwords. The User acknowledges that transmitting information over the internet involves inherent risks; however, using specialized providers significantly reduces these risks through robust security mechanisms.

8. Sensitive Data

The User acknowledges that, by using tools such as the chat or the personal journal, they may provide information related to their mental health, which constitutes sensitive data under applicable regulations.

This information will be processed with strict security measures and solely for the purposes authorized by the data subject. Providing sensitive data is voluntary. However, refusing to provide it may restrict the functionality of certain App tools.

9. Your Rights

Data subjects have the following rights regarding their data:

• Access: View all your data within the App at any time. Access your information free of charge when requested in digital format.
• Export: Download a complete copy of your data from the app settings.
• Update and Correction: Update your personal information through your account settings.
• Deletion: Delete individual journal entries or your entire account and all associated data.
• Proof of Authorization: Request proof of the authorization granted for the processing.
• Revocation: Revoke authorization when the processing does not comply with regulations.
• Opt-out: You may stop using the Luna AI chat feature at any time if you do not wish to share data with OpenAI. Other app features (journaling, mood tracking, wellness tools) do not send data to third-party AI services.
• Complaints: File complaints with the competent authority regarding alleged violations.

Requests related to the exercise of these rights may be sent to info@sentira.com.co, indicating the data subject’s identification and a description of the request. Requests will be processed in accordance with current regulations.

10. Data Retention and Deletion

Your account data, chat history, journal entries, and mood check-ins are retained for as long as your account is active. If you delete your account, all personal data — including chat history, journal entries, and mood logs — will be permanently removed from our systems.

G&B Digital SAS may retain certain data when necessary for compliance with legal or contractual obligations, in accordance with applicable regulations. Aggregated data that cannot be used to identify you may be retained for service improvement purposes.

11. Authorization

Registering with SENTIRA implies acceptance of this Policy and the granting of authorization for the processing of personal data in accordance with the purposes described.

The authorization may be revoked at any time through the mechanisms established in this Policy, without affecting processing carried out previously or those authorized by law.

Providing personal data is necessary to access the Services. Refusal to provide information may limit the use of certain features.

12. Children’s Privacy

SENTIRA is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will take steps to delete that information promptly.

If you are between 13 and 18 years of age, you should review this Privacy Policy with a parent or guardian.

13. Changes to This Policy

We may update this Privacy Policy from time to time when necessary to comply with regulatory changes or improvements in data processing procedures. We will notify you of any material changes by posting the updated policy within the App and through available communication channels.

Continued use of SENTIRA after changes are posted constitutes your acceptance of the revised policy. If you do not agree, you may request the deletion of your account.

14. Contact Us

For privacy-related questions, data requests, or concerns, contact us at:

Email: info@sentira.com.co
Website: https://sentira.com.co

Effective Date: This document was published on April 1, 2026 and is effective from that date.