Privacy policy

1.1. The controller of the personal data referred to in this policy is XLYNX, the entity that owns the rebelde application and the website through which it is distributed, contactable for these purposes at legal@xlynx.com.

2.1. This policy applies to the rebelde application and to the website from which it is distributed.

2.2. This policy does not apply to processing carried out by third parties outside XLYNX, and in particular to processing by the User's telecommunications carrier, by the website hosting provider or by the payment processor, each of which is governed by its own policy.

3.1. The application does not declare the internet access permission. This is verifiable by any interested party in the manifest of the APK file and is enforced by the device operating system, not by a setting of the application itself.

3.2. In consequence, the application lacks the technical capacity to transmit information of any nature to XLYNX or to any third party. XLYNX does not receive, collect or process any data originating from the application.

3.3. The application requires no registration and creates no user accounts. XLYNX holds no identifiers, credentials, profiles or contact details of users of the application.

3.4. Messages are encrypted on the device and stored encrypted on the device. They are not transmitted to or stored on any XLYNX system. XLYNX cannot access their content or recover it in the event the device is lost.

3.5. The application does not request access to the contact list, storage, media files or device location, and does not request the READ_SMS permission, and therefore has no access to messages already present on the handset.

4.1. Encryption protects the contents of messages but not the traffic data associated with their transmission.

4.2. The User's telecommunications carrier has access to the originating number, destination number, date and time, frequency and size of each transmission. That processing is carried out by the carrier as an independent controller, is necessary for the provision of the telephony service, and is outside XLYNX, which neither takes part in it nor can prevent it.

4.3. In certain jurisdictions ownership of the SIM card is linked to an identity document, a circumstance likewise outside the control of XLYNX.

5.1. The website uses no cookies, local storage, session storage or equivalent terminal storage technology.

5.2. The website incorporates no analytics tools, tracking pixels, browser fingerprinting techniques, advertising or social network components.

5.3. The website makes no requests to third-party domains. Typographic resources are served from the site's own domain, so that no connection with external providers occurs as a result of loading the page.

5.4. The demonstration feature that reproduces a console log from text entered by the visitor executes entirely in the browser. That text is not transmitted to any server and does not persist after the tab is closed.

6.1. The website is hosted on the infrastructure of Vercel Inc., which as a processor records the technical data inherent to every HTTP request, including the originating IP address, timestamp, resource requested and user agent details.

6.2. The legal basis for that processing is the legitimate interest of XLYNX in ensuring the operation, availability and security of the website, and in detecting and preventing abusive use.

6.3. Downloading the APK file generates a record of this nature, on identical terms to the loading of any other resource. XLYNX does not associate that record with any additional identifier and does not cross-reference it with other sources of information.

7.1. Use of the donation feature results in the transmission to Stripe, Inc. of the amount selected, the interface language and, where applicable, any free text entered by the user, for the sole purpose of generating the payment session.

7.2. The legal basis for that processing is the performance of the relationship requested by the user themselves through the voluntary activation of the feature.

7.3. Payment processing is carried out entirely on the systems of Stripe, Inc. Payment instrument data is supplied directly to that entity and is at no point received, processed or retained by XLYNX.

7.4. Making a donation creates no user account and permits no linkage to use of the application, given that the latter establishes no communication with XLYNX systems in accordance with clause 3.

8.1. The only recipients of data are the processors and independent controllers identified in this policy: Vercel Inc., in respect of technical logs, and Stripe, Inc., in respect of donations.

8.2. Both entities operate infrastructure in various countries, including the United States of America, so the processing described may involve international transfers of data, subject to the safeguards each provider has established.

8.3. XLYNX does not disclose personal data to third parties for commercial, advertising or profiling purposes, and sells no data.

9.1. The technical logs referred to in clause 6 are retained for the period established by the hosting provider under its own terms.

9.2. Data associated with donations is retained by the payment processor for the period required by the tax and accounting legislation applicable to it.

9.3. XLYNX does not itself retain files of personal data of users of the application, having no mechanism by which to obtain them.

10.1. Under the legislation applicable by reason of the data subject's residence, they may hold rights of access, rectification, erasure, restriction of processing, objection and portability, as well as the right not to be subject to automated decision-making.

10.2. The exercise of such rights may be requested by communication addressed to legal@xlynx.com.

10.3. It is expressly noted that the material scope of such rights against XLYNX is limited by the absence of processing described in clause 3. The only data susceptible of processing are the technical logs referred to in clause 6. As those logs are not associated with any identifier, identifying those corresponding to a particular data subject may prove impossible, and XLYNX will not request additional information for the purpose of attempting such identification.

10.4. The data subject has the right to lodge a complaint with the competent data protection supervisory authority of their place of residence.

11.1. Neither the application nor the website is directed at minors. XLYNX does not knowingly collect personal data of minors, a circumstance deriving from the general absence of collection of identifying data described in this policy.

12.1. This policy may be amended. The version in force shall at all times be the one published on this page, identified by its update date.

12.2. No individual notifications of amendments will be made, XLYNX holding no contact details of users in accordance with clause 3.