Privacy Policy

This policy applies to the Tavu mobile application for Android, the tavuapp.com website, and the processing activities associated with the provision of the service, support, security, Premium subscriptions, and technical operation.

Where a third-party service has its own privacy policy, that policy may additionally apply to the processing carried out by that third party acting as an independent controller.

Tavu adopts as reference principles: lawfulness, fairness, and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and proactive accountability.

The application is designed with a privacy- and security-oriented approach, but no system connected to the Internet can guarantee absolute security against all risks.

The application is designed to minimize the data necessary to register and use the service. Depending on the feature used and the system’s actual configuration, the following categories of data may be processed:

• Account data: code, username, or identifier chosen by the user, internal account identifier, and credentials or elements necessary to authenticate the account.
• Usage data: interaction events, sessions, features used, dates and times of activity, and other information necessary to analyze and improve operation.
• Technical data: operating system, application version, device model or characteristics, technical identifiers, connection information, security logs, and diagnostic data, when generated by the infrastructure.
• Communications content: messages, images, videos, or other files that the user chooses to transmit through Tavu. This content may require temporary processing or storage to enable its delivery.
• Group and relationship data: group membership, participant identifiers, blocks, and settings necessary to provide the requested features.
• Notification data: technical information necessary to send push notifications when the user has this feature enabled.
• Premium subscription data: information necessary to verify subscription status and provide Premium features. Full payment data may be managed by Google Play or other payment providers and is not necessarily received or stored directly by Tavu.
• Support data: data arising from support requests, complaints, or communications with Tavu.

Under the ordinary operation currently described, Tavu does not require the user to provide a phone number, an email address, or a SIM card to create an account.

The absence of such data does not mean the service cannot process other personal data or technical identifiers. Data may be personal even if it does not publicly reveal the user’s real name.

Tavu’s reviewed project infrastructure uses Google Firebase services, including Firebase Analytics, Realtime Database, Storage, and Cloud Functions. These services enable, among other functions, analyzing usage, storing information temporarily or persistently depending on the feature, managing files, and running automated processes.

Google and the technology providers acting as processors or sub-processors may process data on Tavu’s behalf to the extent necessary to provide the contracted services. The legal relationship, processing locations, international transfer safeguards, and specific retention periods must be verified against the contracts and configurations currently in force.

Tavu will seek to configure third-party services in accordance with the principles of minimization, security, and privacy by design.

Data may be processed for the following purposes:

• Creating, authenticating, maintaining, and protecting accounts.
• Enabling the sending and receiving of messages and content.
• Managing groups, blocks, user searches, and other requested features.
• Applying privacy, security, camouflage, and account protection features.
• Sending technical and service notifications.
• Detecting, preventing, and investigating fraud, abuse, unauthorized access, and uses contrary to the Terms.
• Fixing errors, maintaining availability, performing maintenance, and improving performance.
• Obtaining usage statistics through Firebase Analytics when this feature is enabled.
• Managing Premium subscriptions, billing, status checks, and support.
• Complying with legal obligations and handling claims, requests from authorities, or judicial proceedings.

The legal basis will depend on the specific purpose. In general, the following may apply:

• Performance of a contract: processing necessary to create the account and provide the features requested by the user.
• Legal obligation: where it is necessary to retain or disclose information in order to comply with a legal obligation.
• Legitimate interest: for certain security, fraud prevention, legal defense, maintenance, and service improvement operations, always subject to the corresponding balancing test.
• Consent: where a particular operation legally requires it, such as certain commercial communications or non-essential technologies that depend on consent.

Acceptance of this privacy policy does not, by itself, constitute generic consent for any processing. Where consent is the legal basis, it will be requested specifically, separately, and in a manner that can be withdrawn.

Tavu includes message self-destruction mechanisms. According to the functionality currently described, messages are designed to be automatically deleted after being read by the recipient, with an operational reference period of 60 seconds.

For a communication to be delivered, the content may need to remain temporarily on Tavu’s technical infrastructure. Automatic deletion should not be interpreted as a guarantee of the instantaneous deletion of every technical record, backup copy, cache, log, or information generated by providers.

Photographs, videos, and other files may use temporary technical storage. Automated maintenance and deletion processes may be run through Cloud Functions or other mechanisms configured by Tavu.

The user must understand that the recipient may take screenshots, photographs of the screen using external means, transcriptions, or reproductions of the content outside Tavu’s control, except for such technical limitations as the application may apply.

The reviewed configuration shows Firebase Analytics active for Tavu Android. Analytics may generate statistics and events regarding use of the application and may process technical information or identifiers associated with the device or installation, in accordance with its configuration and applicable documentation.

Tavu must not use Analytics to deliberately collect the content of conversations or to include in events any information that reveals unnecessary personal data. The configuration of events, parameters, identifiers, and retention periods must be reviewed periodically.

The observed project configuration shows Realtime Database, Storage, and Cloud Functions active. These services form part of the service’s technical infrastructure.

Realtime Database may be used for application operation data, including data necessary for accounts, communications, or status, depending on the application’s actual structure. Storage may be used for multimedia content or files. Cloud Functions may run automated processes for maintenance, deletion, validation, notification, or other tasks.

The exact description of stored fields and data must be kept up to date in the internal processing inventory and reflected in this policy whenever the technical structure changes.

Tavu may request or use device permissions strictly related to features the user has chosen to use. These may include notifications, camera, microphone, storage, or file selection, depending on the version and enabled features.

Permissions are also managed through the Android operating system. Denying a permission may prevent the corresponding feature from working, without this necessarily resulting in the loss of access to other features.

Promotional communications will be carried out in accordance with applicable regulations. Where consent is required, it will be requested separately, and the user may withdraw it.

Communications strictly necessary for security, operation, service changes, or account management may be sent where a legal basis permits it.

Tavu offers a monthly Premium subscription tier. It may be purchased through Google Play or another expressly enabled channel.

Tavu will process the information necessary to verify subscription status, activate or deactivate Premium features, provide support, and comply with legal obligations. Payment data will be managed by the corresponding payment provider when configured accordingly.

Tavu will retain data for as long as necessary for each purpose and, where applicable, for the periods required by law.

Messages and content subject to self-destruction will be deleted through the automated mechanisms configured for the service. Technical records, security, billing, claims, and other information may be retained for different periods where there is a legitimate purpose or legal obligation.

When an account is deleted, Tavu will apply the available deletion or anonymization procedures, without prejudice to information that must be retained due to legal obligation, security, dispute resolution, or reasonable technical limitations.

Data may be processed by technology providers that offer services necessary for Tavu, including cloud infrastructure, analytics, notifications, hosting, security, and payments.

Data may also be disclosed where there is a legal obligation, an order from a competent authority, or where necessary for the defense of rights and claims.

Tavu does not sell users’ personal data as a commercial activity.

By using international technology providers, certain data may be processed outside the European Economic Area. Where an international transfer of personal data occurs, Tavu will apply the safeguards required by the GDPR that are applicable, such as adequacy decisions, standard contractual clauses, or other legally valid mechanisms.

Information about providers, locations, and safeguards must be kept up to date in accordance with the contracts and configurations actually in force.

Tavu applies reasonable technical and organizational measures proportionate to the risk in order to protect information against unauthorized access, loss, alteration, or disclosure.

These measures may include access controls, authentication, encryption or protection of communications, Firebase security rules, automatic deletion, and maintenance procedures, depending on the specific implementation.

No method of electronic transmission or storage guarantees absolute security. The user must protect their credentials and avoid sharing unnecessary sensitive information.

Where the GDPR applies, the user may exercise the rights of access, rectification, erasure, restriction, objection, and portability, as well as withdraw consent where processing is based on it.

Requests may be sent to privacypolicy@tavuapp.com, providing sufficient information about the account or details necessary to handle the request. Tavu may request reasonable information to verify identity where necessary to prevent unauthorized access.

The user also has the right to file a complaint with the Spanish Data Protection Agency (AEPD) or another competent supervisory authority.

Tavu is not specifically directed at minors under 16 years of age. The controller must configure the application, its Google Play listing, and its access mechanisms consistently with the minimum age it actually intends to admit and with applicable obligations.

If Tavu reasonably detects an account that does not meet the applicable minimum age, it may suspend or delete it and take the legally required measures.

The website may use cookies and similar technologies necessary for its operation. Non-essential cookies, or those used for analytics, advertising, or other purposes that legally require consent, will be managed through the corresponding consent mechanism.

The cookie policy must be kept separate and updated in accordance with the technologies actually installed on tavuapp.com.

Tavu may contain links or integrations with third-party services. Once the user accesses an external service, that service’s processing of data will be subject to the third party’s own terms and policies.

Tavu recommends reviewing the applicable policies before providing information to such services.