Privacy Policy

Last updated: 22 June 2026

Maspax is operated by Bitu Corp S.L. (“we”, “us”, “our”), a company registered in Spain (CIF: B22939128), registered address C. de Hermosilla, 48, 1º Derecha, 28001 Madrid, Spain. We are the data controller for personal data processed through the Maspax app and website (the “Service”).

We value your privacy. This Policy explains what we collect, why, how we share it, and the rights you have. By using Maspax, you agree to this Policy.

1. Information We Collect

a. Information you provide

Account data: your email address (used for sign-in via a secure email link/one-time code, or via Sign in with Apple/Google). We do not store an account password.
Profile data: display name and, optionally, a profile picture.
Check-in (“Pax”) content: the questions you create and the answers you submit, including text and photos.
Trusted contacts and groups: names, email addresses, or phone numbers you enter to invite or designate contacts, and the groups/family you create or join. *You must have these people’s consent before adding their information.*
Notes and settings: optional notes, categories, reminder preferences, and a hashed master password if you set one (we store only a one-way hash, never the password itself).

b. Information collected automatically

Device and technical data: device model, operating system and version, app version, language, and a push-notification token.
Usage and diagnostics: interactions and crash/performance logs used to keep the Service reliable.

c. Location data (optional)

If you enable it for a Pax, Maspax may access your device location — including in the background — for the specific purpose of sharing your location with your chosen trusted contacts or group if you miss that check-in. Location is not shared unless you have enabled it and a check-in is missed. You can disable location sharing per check-in and revoke location permission at any time in your device settings.

We do not use third-party advertising SDKs, and we do not build advertising profiles.

2. How We Use Your Information

We process your data to:

Create and maintain your account and authenticate you.
Deliver check-ins, reminders, alarms, and notifications.
Notify your trusted contacts and share your location when you miss a check-in, as you have configured.
Enable contact and family groups and the sharing of check-ins/responses.
Process and manage subscriptions and entitlements.
Maintain security, prevent fraud and abuse, and improve performance and reliability.
Comply with legal obligations.

We do not sell your personal data, and we do not use it for advertising.

3. Legal Bases (GDPR)

We rely on:

Contract — to provide the Service you request (accounts, check-ins, notifications, subscriptions).
Consent — for optional features such as location sharing and push notifications; you may withdraw consent at any time.
Legitimate interests — for security, fraud prevention, and service improvement (you may object — see Section 8).
Legal obligation — to meet tax, accounting, and regulatory requirements.

4. How We Share Information

With people you choose: trusted contacts and group/family members receive the check-in status, responses, or location you have chosen to share with them.
Service providers (processors) acting on our behalf:

- Supabase — hosting, authentication, database, and file (photo) storage; data hosted in the EU. - RevenueCat — subscription and entitlement management. - Apple / Google — sign-in and in-app purchase processing (billing data is handled by them, not stored by us). - Expo push notification service (exp.host) — delivering notifications to your device. - Google Maps — rendering shared locations.

Legal and safety: where required by law, or to protect the rights, safety, and security of users and the public.
Business transfers: in connection with a merger, acquisition, or asset sale, subject to this Policy.

We never sell your data.

5. International Transfers

Our primary infrastructure is in the European Union. Some providers (e.g., Apple, Google, RevenueCat, Expo) may process data outside the EU. Where data leaves the EEA, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

6. Data Retention

We keep personal data only as long as needed to provide the Service and for legitimate or legal purposes.

Account deletion: when you request deletion in the App, your account is locked and scheduled for permanent deletion after 30 days. Logging back in within 30 days cancels the deletion. After 30 days, your account, profile, check-ins, photos, and related personal data are permanently deleted.
We may retain limited records where required for legal, tax, or fraud-prevention purposes, for the period required by law.

7. Security

We use industry-standard measures including encryption in transit (HTTPS/TLS), encrypted storage provided by our infrastructure, one-way hashing of any master password, and access controls. No system is perfectly secure, but we work to protect your data and will notify you and the relevant authorities of a breach where legally required.

8. Your Rights

Depending on where you live, you may have the right to:

Access the personal data we hold about you.
Rectify inaccurate data.
Erase your data (“right to be forgotten”) — you can delete your account in-app.
Restrict or object to certain processing.
Portability — receive your data in a portable format (the App includes a data-export feature).
Withdraw consent at any time for consent-based processing.
Lodge a complaint with a supervisory authority — in Spain, the Agencia Española de Protección de Datos (AEPD, www.aepd.es).

California residents (CCPA/CPRA): you have rights to know, delete, and correct your personal information, and to not be discriminated against for exercising them. We do not sell or “share” personal information for cross-context behavioral advertising.

To exercise any right, use the in-app tools or contact jaime@bitucorp.com. We will respond within the time required by law.

9. Children’s Privacy

Maspax is not directed to children under the age of digital consent in their country (generally 13–16; 14 in Spain). We do not knowingly collect personal data from such children without verifiable parental consent. Within a Family plan, a minor may use the Service only under the responsibility of a parent or guardian. If you believe a child has provided us data without proper consent, contact us and we will delete it.

10. Push Notifications and Permissions

We request permission to send push notifications (for check-ins, reminders, invites, and alerts) and, optionally, to access your location and photo library/camera. You can change or revoke these permissions at any time in your device settings; some features may not work without them.

11. Changes to This Policy

We may update this Policy. We will notify you of material changes through the App or by email. The “Last updated” date reflects the latest version.

12. Contact

📧 jaime@bitucorp.com 🏢 Bitu Corp S.L. (CIF: B22939128) C. de Hermosilla, 48, 1º Derecha, 28001 Madrid, Spain