Data Protection Policy

Last updated: July 2026

1. Data Controller

The data controller responsible for your personal data is:

2. Types of Personal Data Collected

Yayika may collect the following categories of personal data:

Category	Description
Identity	First name, last name, date of birth, profile photo
Contact	Email address, phone number, postal address
Financial	Billing data, payment history, card information (processed by Stripe)
Health / Menstrual Cycle	Cycle data, symptoms, wellness notes (only with explicit consent)
Behavioral	Browsing history, preferences, platform interactions

3. Purposes of Data Processing

Purpose	Legal Basis	Data Categories
Service provision	Contract performance	Identity, Contact, Health
Account management	Contract performance	Identity, Contact
Payment processing	Contract performance	Financial
Service notifications	Legitimate interest	Contact
Experience personalization	Legitimate interest	Behavioral
Service improvement	Legitimate interest	Behavioral
Aggregated health reports	Explicit consent	Health
Legal compliance	Legal obligation	Identity, Financial
Fraud prevention	Legitimate interest	Identity, Behavioral

4. Legal Bases for Processing

We process your personal data under the following legal bases:

• Consent: When you explicitly authorize us (sensitive health data)
• Contract performance: To deliver the contracted services
• Legitimate interest: To improve our services and ensure security
• Legal obligation: To comply with fiscal and regulatory obligations

5. Data Retention Periods

Your personal data will be retained for the following periods:

• Account data: While the account is active and up to 2 years after deletion
• Menstrual cycle data: Until you request its deletion or account closure
• Financial data: As required by applicable fiscal regulations (minimum 5 years)
• Behavioral data: Maximum 24 months from the last interaction

6. Security Measures

Yayika implements technical, administrative, and physical security measures to protect your data, including:

• TLS/SSL encryption on all data transmissions
• Encryption at rest for sensitive data
• Role-based access control
• Continuous security monitoring
• Automated backups
• Periodic security audits

7. International Data Transfers

Provider	Country	Purpose	Safeguards
Supabase	United States	Database storage	Standard contractual clauses
Stripe	United States	Payment processing	Standard contractual clauses, PCI DSS

8. Data Processing Table

Purpose	Legal Basis	Categories	Retention
Main service	Contract	Identity, Contact, Health	Duration of service
Payments	Contract	Financial	5+ years (fiscal)
Marketing	Consent	Contact, Behavioral	Until withdrawal
Analytics	Legitimate interest	Behavioral	24 months
Legal compliance	Legal obligation	Identity, Financial	Per regulation

---

🇪🇸 MEXICO — Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP)

8.1 Supervisory Authority

The competent authority is the Secretaría Anticorrupción y Buen Gobierno (SABG), through the Transparency Unit.

8.2 ARCO Rights

Pursuant to Articles 15 to 47 of the LFPDPPP, you have the right to:

Right	Description
Access	Know what personal data we hold and how we process it
Rectification	Request correction of inaccurate or incomplete data
Cancellation	Request deletion of data when no longer necessary
Opposition	Object to the processing of your data for specific purposes

8.3 Consent

• Sensitive data: Express written consent is required (Art. 9 LFPDPPP)
• Non-sensitive data: Consent may be implicit when a contractual relationship exists

8.4 Simplified Privacy Notice

In accordance with Article 16 of the LFPDPPP, we provide a simplified privacy notice containing the essential elements of data processing.

8.5 Data Protection Contact

To exercise your ARCO rights, contact: admin@yayika.com

---

🇪🇺 EUROPEAN UNION — General Data Protection Regulation (GDPR)

8.6 Legal Basis for Processing

Processing is based on:

• Art. 6(1)(a): Consent of the data subject
• Art. 6(1)(b): Performance of a contract
• Art. 6(1)(f): Legitimate interest of the controller

8.7 Data Subject Rights (GDPR)

Right	Article	Description
Access	Art. 15	Obtain confirmation and a copy of your data
Rectification	Art. 16	Correct inaccurate data
Erasure	Art. 17	Right to be forgotten — data deletion
Restriction	Art. 18	Restrict processing in certain cases
Portability	Art. 20	Receive data in structured format
Object	Art. 21	Object to processing based on legitimate interest

8.8 Data Protection Officer (DPO)

Due to our company size, we are not required to appoint a DPO. However, you may contact us at: admin@yayika.com

8.9 Data Protection Impact Assessment

We will conduct a Data Protection Impact Assessment (DPIA) for the processing of health/menstrual cycle data in accordance with Article 35 of the GDPR.

8.10 Supervisory Authority

Supervisory authorities vary by member state. Examples: CNIL (France), BfDI (Germany), AEPD (Spain). You have the right to lodge a complaint with the authority in your country of residence.

8.11 Data Retention

In accordance with Article 5(1)(e) of the GDPR, data will not be retained longer than necessary for the purposes of processing.

8.12 Cookie Consent

We comply with the ePrivacy Directive regarding cookie usage. We use a cookie banner that allows you to accept or reject non-essential cookies.

---

🇧🇷 BRAZIL — Lei Geral de Proteção de Dados (LGPD)

8.13 National Authority

The competent authority is the Autoridade Nacional de Proteção de Dados (ANPD).

8.14 Legal Bases (Art. 7 LGPD)

• Data subject's consent
• Compliance with legal or regulatory obligation
• Execution of public policies or research
• International data transfer
• Performance of contract or preliminary procedures
• Exercise of rights in legal proceedings
• Protection of life or health
• Legitimate interest of the controller

8.15 Data Subject Rights (Art. 18 LGPD)

Right	Description
Confirmation	Confirm the existence of processing
Access	Access personal data
Correction	Correct incomplete or outdated data
Anonymization	Anonymize, block, or delete unnecessary data
Portability	Request data portability
Deletion	Request deletion of data processed with consent
Information	Know entities with whom data is shared

8.16 Data Protection Officer

Our DPO (Encargado) is: admin@yayika.com

8.17 Sensitive Data

Health data (menstrual cycle) is considered sensitive data under Art. 5(II) of the LGPD and requires specific and highlighted consent.

---

Argentina — Ley de Protección de Datos Personales No. 25.326

If you are in Argentina, your personal data is protected by the Ley de Protección de Datos Personales No. 25.326 and its regulations (Decreto 1558/2001). You have rights of access, rectification, update, and deletion of your data. The regulatory authority is the Agencia de Acceso a la Información Pública (AAIP). You may file complaints before the AAIP or competent courts.

Chile — Ley No. 19.628 sobre Protección de la Vida Privada

If you are in Chile, your personal data is protected by the Ley No. 19.628 sobre Protección de la Vida Privada. You have rights of information, access, rectification, cancellation, and opposition. The regulatory authority is the Servicio Nacional del Consumidor (SERNAC). You may file complaints before SERNAC or competent courts.

Colombia — Ley Estatutaria 1755 de 2015

If you are in Colombia, your personal data is protected by the Ley Estatutaria 1755 de 2015 and the Ley 1581 de 2012. You have rights of access, rectification, update, deletion, and portability. The regulatory authority is the Superintendencia de Industria y Comercio (SIC). You may file complaints before the SIC or competent courts.

Peru — Ley No. 29733, Ley de Protección de Datos Personales

If you are in Peru, your personal data is protected by the Ley No. 29733 and its regulations (Decreto Supremo No. 003-2013-JUS). You have rights of access, rectification, update, deletion, and opposition. The regulatory authority is the Autoridad Nacional de Protección de Datos Personales (ANPDP) under INDECOPI. You may file complaints before INDECOPI or competent courts.

Ecuador — Ley Orgánica de Protección de Datos Personales

If you are in Ecuador, your personal data is protected by the Ley Orgánica de Protección de Datos Personales. You have rights of access, rectification, update, deletion, and portability. The regulatory authority is the Superintendencia de Control del Poder de Mercado. You may file complaints before the Superintendencia or competent courts.

---

🇺🇸 UNITED STATES — CCPA/CPRA (California) and COPPA

8.18 California Consumer Privacy Act (CCPA/CPRA)

If you are a California resident, you have the following rights:

Right	Description
Right to Know	Request the categories and sources of data collected
Right to Delete	Request deletion of personal information
Right to Opt-Out	Opt out of the sale of personal information
Right to Non-Discrimination	Not be discriminated against for exercising your rights

8.19 Categories of Personal Information (CCPA)

• Identifiers (name, email, IP address)
• Commercial information (transaction history)
• Internet information (browsing history)
• Inferences derived from the above

8.20 No Sale of Data

Yayika does not sell personal information to third parties.

8.21 Children's Online Privacy Protection Act (COPPA)

---

🇬🇧 UNITED KINGDOM — UK GDPR + Data Protection Act 2018

8.22 Supervisory Authority

The competent authority is the Information Commissioner's Office (ICO).

8.23 Post-Brexit Legal Framework

The UK GDPR is the version of the GDPR incorporated into UK law through the Data Protection Act 2018. Rights and obligations are substantially equivalent to the EU GDPR.

8.24 Adequacy Decisions

The UK has EU adequacy decisions, allowing data transfers from the EU/EEA to the UK without additional safeguards.

---

🇨🇦 CANADA — PIPEDA

8.25 Supervisory Authority

The competent authority is the Office of the Privacy Commissioner (OPC).

8.26 Meaningful Consent

PIPEDA requires meaningful consent for the collection, use, and disclosure of personal data. Consent must be informed and apply only to the purposes communicated.

8.27 Access and Challenge Rights

You have the right to access your personal data and to challenge its accuracy, completeness, and currency.

---

🇨🇭 SWITZERLAND — New Federal Act on Data Protection (nFADP)

8.28 Supervisory Authority

The competent authority is the Federal Data Protection and Information Commissioner (FDPIC).

8.29 Entry into Force

The nFADP came into force on September 1, 2023, modernizing the Swiss data protection framework.

8.30 Data Protection Impact Assessment

The nFADP requires a Data Protection Impact Assessment for processing that may result in a high risk to personality and fundamental rights.

8.31 Cross-Border Transfers

International data transfers are only permitted if the destination country appears on the Federal Council's adequacy list or if adequate safeguards are established.

---

9. Changes to This Policy

We reserve the right to update this policy. Any changes will be published on this page with the date of last update.

10. Contact