Privacy Policy — Laura's Latin Love (Cita con Laura)

1. Who we are

Laura's Latin Love (also shown in-app as "Cita con Laura") is operated by Laura Santiago, contactable at hola.laurasantiago@outlook.com. Full legal entity details are available in our Aviso Legal (Legal Notice).

For the purposes of GDPR, we are the "data controller" for the personal data described below.

2. What data we collect

• Gameplay progress — chapters completed, points, streaks, purchases, and choices made in the game. Stored on your device (browser local storage) always, and additionally in our database if you create an account to save progress across devices.
• Account details (optional) — if you choose to sign in to save your progress, we collect the email address and password (or Google account identifier, if you use "Continue with Google") needed to create and secure your account.
• Email address for keepsakes (optional) — at two points in the game you can choose to receive an email: a recap of your first chapter, and a bilingual wedding invitation at the end of the game. We only collect this if you type it in and submit it; skipping these prompts collects nothing.
• Payment information — when you buy style points or an item with a card, payment is handled entirely by Stripe on Stripe's own checkout page. We never see or store your card number, expiry, or CVC. We receive only confirmation that a payment succeeded and what was purchased.
• Technical data — standard web request data (IP address, browser type, device type) that any website receives, used only for security and keeping the app running. Once you accept our cookie banner, we also collect basic first-party visit analytics (pages viewed, general device/browser info) through our hosting platform, Lovable, to understand how the site is used — see §11.
• Advertising data — if you choose to watch a rewarded ad, Google Ad Manager may collect data under its own advertising policies to select and measure that ad. See §5.

We do not use any third-party analytics or tracking beyond what's listed above. Our hosting platform may inject a small first-party analytics script as part of its own infrastructure; app code cannot prevent it from loading. When you decline the cookie banner, we immediately delete any identifiers or cookies it sets and remove analytics-related entries from localStorage — nothing analytics-related is kept after the decline.

3. Why we use it

• To run the game and save your progress.
• To send the keepsake emails you specifically request (nothing else — no marketing emails unless you separately opt in somewhere, which we'd add explicitly if we build that).
• To process payments and deliver what you bought.
• To keep the service secure and working.
• To show rewarded ads, if and when you choose to watch one.

4. Legal basis (GDPR)

• Gameplay progress, account creation, and payment processing: performance of a contract (you asked us to provide the service/purchase).
• Keepsake emails: consent — you actively opt in each time by typing your email and submitting.
• Security/technical data and first-party analytics: legitimate interest in keeping the service running, safe, and understanding basic usage — subject to your cookie banner choice for the analytics portion.

You can withdraw consent for the keepsake emails at any time by not submitting them. To be clear about what happens to an address you do submit: it is saved as part of your game save data — on your device, and in your cloud save row if you're signed in — and it stays there until that save is deleted. We don't keep a separate mailing list, and we don't use it for anything other than the message you asked for.

5. Who we share data with

• Stripe (payment processing) — stripe.com/privacy.
• Supabase (account authentication and cloud save storage, if you sign in) — supabase.com/privacy.
• Lovable (our website hosting and first-party analytics platform) — lovable.dev/privacy.
• Google Ad Manager (rewarded video ads) — subject to Google's own advertising/privacy policies. Ads are optional and only load when you choose to watch one.
• We do not sell personal data, and we don't share it with anyone else beyond what's needed to run the features above.

6. International data transfers

Some of the providers above (Stripe, Supabase, Lovable, Google) may process data outside your country, including the US. Where that happens, they do so under their own standard contractual clauses / adequacy mechanisms — see their privacy policies linked above for details.

7. How long we keep data

• Account and progress data: kept while your account is active; deleted on request (see §8).
• Keepsake emails: an address you submit is stored inside your game save (on your device, and in your cloud save if you're signed in) and kept for as long as that save exists — there is no separate deletion schedule for it. It is used only for the message you requested, never for marketing, and never shared with anyone. Deleting your account and progress (see §8) deletes the address with it.
• Payment records: retained as required by Stripe/tax law (typically several years) for accounting purposes.

8. Your rights (EU/UK/California)

If you're in the EU/UK, you have the right to access, correct, delete, or export your data, and to object to or restrict certain processing, under GDPR/UK GDPR. If you're a California resident, you have similar rights under the CCPA/CPRA, including the right to know what personal information we've collected, to request deletion, and to non-discrimination for exercising your rights. To exercise any of these, contact us at hola.laurasantiago@outlook.com. We'll respond within the legally required timeframe (30 days under GDPR).

9. Additional US state privacy rights

If you're a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, Utah, or Virginia, you may have additional rights under your state's privacy law, generally including the right to: know what personal information we hold about you, access or obtain a copy of it, correct inaccuracies, request deletion, and not be discriminated against for exercising these rights. Some of these laws also give you the right to opt out of "sale" of personal information, "targeted advertising," or "profiling" — we do not sell personal information, and we do not currently run targeted/cross-context behavioral advertising (the only advertising feature is optional, user-initiated rewarded video ads, described in §2 and §5). If that changes, we'll update this section and provide an opt-out mechanism as required. To exercise any state-law right, contact us at hola.laurasantiago@outlook.com; we may need to verify your identity before responding.

10. Children's privacy (including COPPA)

This app is not directed at, and should not be used by, anyone under 16. This age minimum is set well above the age thresholds in both the EU/UK (where the "digital consent age" ranges from 13–16 depending on country) and the US (where the Children's Online Privacy Protection Act, COPPA, applies specifically to children under 13).

We do not knowingly collect personal information from anyone under 13, and given our 16+ age requirement, we do not knowingly collect personal information from anyone under 16. We do not have actual knowledge that we are collecting personal information from children under 13 within the meaning of COPPA. If we learn that a child under 13 (or under our stated age minimum) has provided us with personal information, we will delete it promptly. A parent or guardian who believes their child has used the app and provided personal data can contact us at hola.laurasantiago@outlook.com to request review or deletion of that data.

11. Cookies and local storage

We use browser local storage to save your game progress and preferences (like language setting) on your device — this is functional and always on, not tied to consent.

Our hosting platform, Lovable, may inject a small first-party analytics script as part of its own edge infrastructure. Because the script is added at the hosting layer, app code cannot stop it from loading before you have responded to the cookie banner. If you accept, the analytics cookie and any related identifiers may be kept. If you decline, we immediately delete any identifiers or cookies it has set and remove analytics-related entries from localStorage — nothing analytics-related is kept after the decline. Fonts are self-hosted rather than loaded from Google, so no data is sent to Google just from viewing the site.

Google Ad Manager sets its own cookies for rewarded video ad delivery when you choose to watch an ad. You can decline simply by not choosing to watch an ad.

12. PostHog (product analytics and session replay)

If you accept the cookie banner, we use PostHog for product analytics and session replay, so we can see how players move through the game — for example, how many people finish the first chapter. PostHog stores this data on its EU servers. It may include an anonymized recording of your session (what you tapped and how you moved through the screens), with sensitive inputs such as anything you type masked out, so we never see the text you enter. PostHog works out your approximate location from your IP address and then discards the exact address, so we keep only country- and city-level information, never your precise IP. This uses the same accept-or-decline choice described above: if you decline, or change your mind later, PostHog is switched off and any identifiers it stored are deleted from your browser.

13. Do Not Track

Some browsers offer a "Do Not Track" (DNT) signal. There is no accepted industry standard for how websites should respond to DNT, so — consistent with common practice — we do not currently respond to DNT browser signals. If that changes, we'll update this section.

14. Changes to this policy

We'll update the date at the top of this page when we make changes, and post a notice in-app for material changes (e.g. a new payment provider or ad partner).

15. Contact

Questions about this policy or your data: hola.laurasantiago@outlook.com.