Privacy Policy

1. Information we process

Cesca processes the following categories of information:

• Account data: name, email address, password hash, email-verification status, selected language, time zone, planner-cover color, and the date and versions of the legal documents accepted at registration.
• Planner content: notes, tasks, lists, checklists, dates, and the changes you save.
• Shared-page data: when you choose to create a private link, Cesca stores a read-only snapshot of that page, its date, display language, cover color, a random access token, creation and revocation timestamps, and an opening counter.
• Security, technical, and usage data: session identifiers, access-attempt counters, timestamps, limited operational logs, page views, pseudonymous session hashes, and events such as registration, verification, access, and a successful planner save. Cesca's own analytics events do not include planner-entry text, planner dates, email addresses, or unprotected IP addresses. IP addresses used for security purposes are stored as protected hashes in application logs.
• Analytics data: Google Analytics may process the page visited, general interaction events, device and browser information, the connection IP address, and an approximate location derived from it. Cesca does not send Google Analytics planner content, planner dates, names, email addresses, or account identifiers.
• Device preferences: session, language, time-zone, and analytics cookies, together with a local text-size preference.

This information forms part of private electronic files and databases used to operate Cesca. Cesca does not currently request or process payment-card information.

The planner provides free-form fields and does not require sensitive personal information. If you voluntarily enter information concerning health, beliefs, political opinions, racial or ethnic origin, sexual life, or other sensitive matters, Cesca will process it only to store, synchronize, back up, and display it as part of your private planner or a snapshot that you expressly choose to share. Do not enter or share sensitive information that is unnecessary for your use of the service.

2. How we use information

• Provide the service, synchronize your data, and keep your planner available.
• Create and protect your account, verify your email address, and enable password recovery.
• Create and serve read-only page snapshots when you request a private sharing link, count openings, and let you disable that link.
• Remember your language, time zone, planner appearance, and accessibility preferences.
• Measure visits, account activation, aggregate use, and service reliability in order to understand and improve Cesca.
• Prevent abuse, investigate errors, restore information from backups, and protect users and the service.
• Answer requests concerning your personal data and comply with valid legal obligations.
• Enforce the Terms and Conditions.

Cesca will not use personal data for purposes incompatible with those described here without providing the corresponding notice and obtaining consent when required.

3. Consent and processing principles

When you expressly accept this Privacy Policy and create an account, you freely and knowingly authorize the processing necessary to provide Cesca, subject to the choices and rights described below. If you do not provide the information required to create and protect an account, the service cannot be provided. You may withdraw your consent prospectively by deleting the account or submitting a request, without affecting processing already lawfully performed or information that must be retained under a legal obligation.

We seek to process only data that are adequate, relevant, accurate, and not excessive for explicit and lawful purposes. You may update your information, and we will correct or delete inaccurate or unnecessary data when appropriate.

4. Cookies and local storage

Cesca uses session, language, and time-zone cookies to keep you signed in and remember how the service should appear. Browser local storage keeps the editor text-size preference. Google Analytics may set analytics cookies, including identifiers used to distinguish one visitor from another, measure visits, and produce aggregate usage statistics.

By accessing or using Cesca, you acknowledge and accept the analytics processing described in this Policy. Advertising storage, advertising personalization, and advertising user-data signals remain disabled. Cesca does not use Google Analytics to send planner content or account data.

5. Service providers, recipients, and disclosure

Information may be processed by providers of hosting, infrastructure, databases, backups, monitoring, and transactional email, only to the extent necessary to operate Cesca. Google Analytics acts as an analytics provider and processes limited usage and device data under its own privacy and data-processing terms. Access is limited to authorized persons and providers who are expected to preserve confidentiality. We do not sell personal data.

When you create and distribute a private sharing link, anyone who obtains that link may view the corresponding snapshot without signing in. Cesca does not list these links publicly or submit them for search indexing, but the link must be treated as confidential and may be forwarded by a recipient. You can disable it from the sharing controls.

We may disclose limited information when you authorize it, when required by a competent authority or applicable law, when necessary to protect users or the service, or during a legitimate business reorganization subject to appropriate safeguards. If data are corrected or deleted after having been transferred, we will notify the corresponding recipient when required by law.

6. International processing

Some service providers may process information outside the Dominican Republic. When this occurs, we seek contractual, organizational, and technical safeguards appropriate to the information, the provider, and the destination.

7. Retention, blocking, and deletion

Account information and planner content are retained while your account remains active. An active shared-page snapshot remains available until you disable its link or delete your account. Disabled snapshots are removed during the service's limited operational-cleanup cycle. You may delete your account from My account; this removes the active account, planner content, shared-page snapshots, and Cesca analytics events linked to that account. Google Analytics events are not linked to a Cesca account and are retained according to the settings and periods applicable to that provider. Encrypted or access-controlled backups may retain deleted information for a limited rotation period, normally up to 14 days, before being overwritten.

Pseudonymous usage events maintained by Cesca are normally retained for up to 400 days to compare periods and understand product retention. Deletion may be limited when retention or temporary blocking is necessary to satisfy a legal or contractual obligation, protect legitimate third-party rights, resolve a claim, or establish possible liabilities. In such cases, access will remain restricted and the information will be deleted when the applicable period ends. Security records may be retained for the time reasonably necessary to prevent abuse or comply with legal obligations.

8. Your rights and how to exercise them

You may independently and free of charge request access to your personal data and information about their use and destination; correction or updating of inaccurate or incomplete data; deletion when appropriate; and opposition to processing in the cases recognized by applicable law. From My account you can also review and correct profile information, export your data, change your password, or permanently delete the account.

Submit a request through info@cesca.app, identifying the account concerned and describing the right you wish to exercise. We may request information reasonably necessary to verify your identity and protect the account. Access requests will be answered with clear, complete, and accessible information within five business days. When the request is appropriate, correction, updating, or deletion will be completed within a maximum of ten business days. If we cannot grant a request because of a legal or contractual retention duty or a legitimate third-party right, we will explain the applicable reason.

These mechanisms do not restrict your right to seek habeas data protection or any other remedy recognized by applicable law.

9. Security and confidentiality

Cesca applies reasonable technical, administrative, and organizational measures designed to protect information against unauthorized access, alteration, disclosure, or destruction. Access is restricted to persons who need it for an authorized purpose, and the duty of confidentiality continues after their relationship with the service ends. We review and improve these measures as Cesca evolves. However, no online service can guarantee absolute security; use a unique password and protect access to your email.

10. Minors

Cesca is not directed to children under 13. A minor who cannot legally provide informed consent or accept these terms may use the service only with authorization and supervision from a parent or legal guardian. A parent or legal guardian may contact us to exercise the minor's data-protection rights.

11. Changes

We may update this policy as Cesca evolves. Material changes will be announced through the service or by email when appropriate. The current version and effective date will remain available on this page.

12. Contact

Questions, consultations, claims, and requests concerning personal data may be submitted to the Operator through info@cesca.app.