PSICOTEDDY PRIVACY AND PERSONAL DATA PROTECTION POLICY

Last updated: October 23, 2026

Name: PsicoTeddy

Email: support@psicoteddy.online

Website: psicoteddy.online

Data Protection Officer: dpo@psicoteddy.online

This is an English translation provided for convenience. If there is any discrepancy, the Spanish version prevails: Política de Privacidad (español).

1. INTRODUCTION

What is this policy about?
This document explains how PsicoTeddy collects, uses, stores and protects your personal data. The baseline framework applicable to all users is Peru's Law No. 29733 on Personal Data Protection. In addition, PsicoTeddy takes into account the following regulatory frameworks, which apply depending on the country or region from which the user accesses the service:

General Data Protection Regulation (GDPR) — when the user accesses from the European Union
Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights (LOPD-GDD) — when the user accesses from Spain
Children's Online Privacy Protection Act (COPPA) — when the user accesses from the United States
Law No. 29733 on Personal Data Protection and its Regulations (Supreme Decree No. 016-2024-JUS) — Peru
California Consumer Privacy Act (CCPA/CPRA) — when the user accesses from California, USA
Law 34/2002 on Information Society Services (LSSI-CE) — when the user accesses from Spain
Apple App Store and Google Play Store policies
European Medical Device Regulation (MDR 2017/745) — clarification: PsicoTeddy is NOT a medical device

As of this update, PsicoTeddy does not actively offer its service to users in the European Union. If this changes, PsicoTeddy will adopt the additional measures required under the GDPR (including an EU representative and a Data Protection Officer, when required).

What is personal data?
Personal data is any information that can be used to identify you, directly or indirectly. This includes:

Identification data: first name, last name, email address
Technical data: IP address, device type, operating system
Tracking technologies: cookies, pixels, unique identifiers
User activity: usage patterns, interactions, searches
Sensitive data: emotional content, assessment responses, mental health indicators

2. CONTACT INFORMATION

Name: PsicoTeddy

Address (legal headquarters): Republic of Peru

Email: support@psicoteddy.online

Website: psicoteddy.online

Data Protection Officer: dpo@psicoteddy.online

Personal data bank: In compliance with Peru's Law No. 29733 on Personal Data Protection and its Regulations, the personal data collected through the platform is stored in the data bank named "USUARIOS DE PSICOTEDDY", owned by PsicoTeddy S.A.C. and registered with Peru's National Authority for Personal Data Protection under code PJ-2026-4334.

3. TYPES OF DATA COLLECTED

The types of personal data PsicoTeddy collects, either directly or through third parties, include:

Identification Data:

First and last name
Email address
Alias or username
Phone number (if provided)

Technical Data:

IP address
Browser type and operating system
Device identifier
Country/region of connection
Date and time of access

Sensitive Data (Enhanced Protection):

Text content of interactions
Responses to emotional self-assessments
Indicators of emotional or mental state
Inferred emotional patterns
Message content, if provided

4. HOW AND WHERE DATA IS PROCESSED

Processing Methods:
PsicoTeddy adopts appropriate technical and organizational security measures to prevent unauthorized access, improper disclosure, alteration or unauthorized destruction.

Place of Processing:
Data is processed mainly on Amazon Web Services (AWS) infrastructure, in the Virginia, USA region (us-east-1), together with other supporting service providers. Because these providers are based outside Peru, international data transfers are carried out in accordance with Art. 15 of Law No. 29733, which requires adequate protection or equivalent contractual safeguards in the receiving country. If PsicoTeddy accepts users from the European Union in the future, the additional GDPR safeguards that apply will also be adopted, including, if necessary, hosting data within the EU.

5. DETAILED INFORMATION ON DATA PROCESSING

General Purposes:
Your personal data is collected to provide the PsicoTeddy service, for guidance-oriented (non-diagnostic) analysis of emotional state, to improve and optimize the platform, to detect and prevent serious risks, and to comply with legal obligations.

Automated Serious Emotional Risk Detection System

To protect the user's vital interests, PsicoTeddy uses automated systems that analyze interaction content to detect possible signs of serious risk.

Personal data processed: text content of interactions, emotional patterns, assessment responses
Legal basis: Protection of the data subject's vital interests
Purpose: Preventive detection of imminent risk

When a possible risk is detected, the platform provides emergency numbers and helplines for the user's country.

5-BIS. MODES OF USE AND THIRD-PARTY ACCESS

a) Individual mode

The user subscribes directly. No organization is linked to the account. PsicoTeddy does not generate, transmit or make available to any third party information derived from use.

b) Institutional mode

An organization purchases licenses for its staff or students. In this mode:

The organization acts as an independent controller for licensing data (license identifier and activation status). PsicoTeddy acts as the controller of interaction content. No content is transferred to the organization.
The organization receives only aggregated statistical indicators about the user population, subject to a minimum threshold of fifteen (15) active users per segment. Below that threshold, no information is generated or shown.
The following is never shared with the organization: conversation content, mood journal entries, self-assessment results, crisis protocol activations, or any data attributable to an identified or identifiable person.
The organization may not request re-identification of users or any breakdown below the threshold. This prohibition is included as a contractual obligation in the institutional agreement.
The threshold is applied consistently across segments and periods, so that comparing successive or overlapping reports cannot be used to infer an individual user's data by subtraction.
Users keep all their rights of access, rectification, erasure, objection and portability, and may exercise them and delete their account without the organization's authorization, knowledge or involvement.

c) Access by the controller

Authorized PsicoTeddy S.A.C. staff may access personal data only when strictly necessary for operations, security, support and legal compliance (for example, to address a technical failure or a security alert), under restricted access controls and a confidentiality commitment. Conversations are not routinely read. Your conversations are not used to train AI models, according to the policies of our language-processing provider; incoming and outgoing traffic to that provider is encrypted.

6. LEGAL BASIS FOR PROCESSING

PsicoTeddy processes personal data on the following legal bases:

Consent: When you have given explicit consent for specific processing
Compliance with a Legal Obligation: Compliance with the legal requirements of the country of operation
Performance of a Contract: Provision of the service under the Terms and Conditions
Legitimate Interests: Improvement and security of the platform
Protection of Vital Interests: Detection and referral in the event of serious risk of imminent harm

7. SPECIFIC PROCESSING PURPOSES

Service Provision: Creating and maintaining your account, providing access to features
Platform Improvement: Analysis of usage and patterns, interface optimization
Security and Prevention: Detection of fraud or abuse, security risk analysis
Communication: Responding to user inquiries, notifications about changes
Legal Compliance: Internal audits, responding to requests from authorities

8. VITAL SAFETY AND EMERGENCY REFERRAL

Protection of Vital Interests:
To protect the user's physical and mental integrity, PsicoTeddy is authorized to process information, including sensitive information, to detect situations of serious risk.

Activation Circumstances:

Signs of suicidal ideation
Risk of serious self-harm
Acute psychiatric crisis
Imminent violence against others
Other risks to life

Responsibilities and Limitations:

PsicoTeddy does not automatically contact emergency services
The user is responsible for contacting services
The platform does not provide rescue or intervention services
There is no guarantee that all risks will be detected

9. RETENTION PERIOD

General Rule:
Unless otherwise stated, personal data is processed and kept for as long as necessary for the purposes for which it was collected.

Specific Periods:

Identification Data: While the account is active, and 30 days after a deletion request
Sensitive (Emotional) Data: While the account is active; deleted when the account is closed
Right to Be Forgotten: Once the retention period ends, your data is deleted or anonymized

10. DATA SHARING

General Policy:
PsicoTeddy DOES NOT sell personal data to third parties for commercial purposes.

Permitted Sharing:

With Authorized Processors: Cloud hosting providers, security services
Regulatory Compliance: Judicial authorities (with a legal order), data protection authorities
Emergency Services: When a risk to life is detected, limited information may be provided

11. YOUR RIGHTS OVER YOUR PERSONAL DATA

Regardless of your country of residence, PsicoTeddy recognizes the following rights over your personal data. Their exact scope by jurisdiction is detailed in section 12:

Right to Withdraw Consent: You may withdraw consent at any time
Right to Object: You may object to the processing of your data
Right of Access: You may request access to your data and obtain a copy
Right to Rectification: You may request correction of inaccurate data
Right to Restriction: You may request restriction of processing
Right to Be Forgotten (Erasure): You may request deletion of your data
Right to Portability: Receive your data in a structured, commonly used and readable format
Right to Lodge a Complaint: With the data protection authority of your country

How to Exercise Your Rights:
You can send any request to our Data Protection Officer: 📧 dpo@psicoteddy.online

12. ADDITIONAL INFORMATION BY JURISDICTION

European Union Residents (GDPR): You have all the rights described above
California, USA Residents (CCPA/CPRA): Right to know, access, deletion, and to opt out
Peru Residents (Law No. 29733): Right to information, access, rectification, updating or cancellation
Swiss Residents: Right of access, rectification, objection and portability

13. SPECIAL PROTECTION OF MINORS' DATA

CHILDREN UNDER 13 (COPPA):

PsicoTeddy does not knowingly collect personal information from children under 13. If we discover that we have collected data from a child under 13 without verifiable parental consent, we will delete that information immediately.

If you are a parent or guardian and believe your child under 13 has provided us with personal information, contact us at: support@psicoteddy.online

USERS AGED 13 TO 17 (GDPR / LOPD-GDD):

For users under 18, data is processed on the legal basis of the parental consent given during registration.

In Spain: under the LOPD-GDD, the age of digital consent is 14. For 13-year-old users in Spain, express and verifiable parental consent is required.
In the European Union: under Art. 8 of the GDPR, for users aged 13 to 15 in countries where the age of consent is 16, additional safeguards apply.

Parents or guardians of minor users may exercise the rights of access, rectification, erasure and portability on behalf of their children by contacting: support@psicoteddy.online

14. BIOMETRIC DATA — FACE AND FINGERPRINT AUTHENTICATION

PsicoTeddy optionally offers authentication via Face ID and Touch ID (biometric data) to protect access to the app.

Processing: Biometric recognition is processed EXCLUSIVELY on the user's device through Apple's native APIs (LocalAuthentication). PsicoTeddy DOES NOT access, store, transmit or process biometric data on its servers.

Legal basis: The user's explicit consent (Art. 9.2.a GDPR). The user can enable or disable this feature at any time from Profile > Privacy and Security.

Special category: Biometric data is a special category of personal data under Art. 9 of the GDPR and receives the highest level of protection.

15. DATA PROCESSORS

PsicoTeddy works with the following data processors, which may access personal data in the context of providing the service:

Provider	Service	Data processed	Country	Legal basis
Google Firebase (Google LLC)	User authentication	Email, UID, registration date	USA / EU	SCC
AI processing provider	Processing of AI conversations	Message content (no real name)	USA	SCC
RevenueCat Inc.	Subscription and payment management	User ID, purchase history	USA	SCC
Amazon Web Services (AWS)	Cloud infrastructure and database	All service data	USA (us-east)	SCC
Apple Inc.	App Store distribution and payments	Subscription data	USA	SCC
Google LLC	Google Play distribution and payments	Subscription data	USA	Performance of a contract
Binance (Binance Pay)	Optional payments in the Android app	Payment transaction data	International	Performance of a contract

International transfers: The providers above operate outside Peru. Transfers are carried out in accordance with Art. 15 of Law No. 29733, with adequate protection or equivalent contractual safeguards, such as standard contractual clauses (SCC).

PsicoTeddy DOES NOT sell personal data to third parties for commercial purposes.

16. COOKIES AND TRACKING TECHNOLOGIES (WEBSITE)

The PsicoTeddy website (app.psicoteddy.online) does not use cookies.

Browser local storage: stores only your language preference and your choice on the privacy notice. It never leaves your device.
Visit measurement: we use Cloudflare Web Analytics, which does not use cookies or identify individuals. It records aggregated data such as pages visited, country, device type and referring site.

You can clear local storage from your browser settings at any time.

17. PRIVACY CONTACT

For privacy or data protection questions, or to exercise your rights, write to our Data Protection Officer:

📧 dpo@psicoteddy.online

🌐 psicoteddy.online

Response Time:

Acknowledgment: within 5 business days
Full response: within 30 days (extendable to 60)

← Back to home