Privacy Policy

Data Controller

OUTZERO, S.L. (hereinafter, "Outzero"), holder of tax identification number B26926014, with registered address at Carrer Eduard Serra i Guell, 16, Alella, 08328, Barcelona, Spain, and email address info@outzero.app, is subject to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, the "GDPR") and the data protection rules in force at any given time, which are a main priority for Outzero.

Outzero is the data controller of the personal data collected through the website https://www.outzero.app, including any of its subdomains or sections (hereinafter, the "Website"), and through the mobile device and wearable applications and services published by Outzero (hereinafter, the "Applications") (hereinafter, the Website and the Applications shall jointly be referred to as the "Platforms").

This Privacy Policy governs the processing of users' personal data by Outzero on the Platforms in the context of providing the services.

Access to and use of the Platforms imply that the user has read and fully accepted this Privacy Policy. Some of the services provided through the Platforms may have specific privacy policies which, if applicable, will supplement this Privacy Policy or, if they differ from it, replace or complement its content, and which must be accepted by the user before the relevant service begins.

The purpose of this policy is to explain how Outzero will process your personal data, which may be collected through the different forms that may be made available on the website or the application. Your data will be processed by Outzero confidentially and only for the purposes and legal bases explained below in this policy. Likewise, access to and use of the Platforms are also subject to the Terms and Conditions of Use.

Purposes of Processing

Your data will be processed as follows:

### Platform management for service provision

Outzero processes the data of users registered on the Platform through the Services in order to manage user accounts and profiles, authenticate access, operate the core functions of the Platforms, manage user-generated content, favorites, reviews, routes, subscriptions or other premium access, notification preferences, support requests, and account change or deletion workflows, as well as to provide or improve the provision of the Services.

Legal basis: Performance of a contract.

Retention: We will process the data while the user account remains active and, where applicable, during the account deletion workflow and for the periods necessary to comply with legal obligations or defend claims.

### Geolocation

Outzero may ask you to provide or enable location data in order to publish a spot or point of interest, explore nearby content, use map functions, navigate or track routes, or otherwise use location-based features. If the user wishes to use geolocation, consent will be managed and must be granted in the App and, where applicable, in the operating system permissions. If route tracking is active and the user grants the corresponding permission, this may include background location while the screen is locked or the app is in the background.

Where the user does not manually enter a location when uploading content, Outzero may also request specific consent to read location metadata embedded in selected media in order to prefill the spot location. Images sanitized and stored by Outzero are re-encoded and uploaded without EXIF metadata.

Legal basis: Consent.

Retention: The data will be kept until consent is withdrawn. In the case of route tracking or media location extraction, the processing may be limited to the relevant session or upload flow, without prejudice to the fact that the coordinates or location data that the user chooses to publish may remain associated with that content while it is available on the Platforms. The user may manage consent at any time through the permissions requested by the app or through device settings.

### Push notifications and service communications

If the user enables notifications on their device or within the Platforms, Outzero may process push notification tokens, platform or device information, locale, and notification preferences to send service, security, social, moderation, milestone, ranking, or promotional notifications, and to store or show notification history within the Platforms.

Legal basis: Performance of a contract for notifications necessary to provide the service, legitimate interest for service integrity and non-essential service notices, and consent where promotional communications or device permissions require it.

Retention: Push tokens and notification preferences will be processed while the account remains active or until the token becomes invalid, the user revokes permissions, or the user changes their preferences. Notification history may be kept for the period necessary to provide the service and handle claims.

### Sending commercial communications

If consent is given and contact details or relevant notification permissions are provided, such data may be used to send information and commercial communications by email, push notification, or similar means about products or services, as well as discounts, promotions, invitations to events, or opinion surveys from Outzero.

Legal basis: Consent.

Retention: We will process the data until the user unsubscribes, disables the relevant permissions, or withdraws consent.

### Contact us

When you contact us, we will process your data to handle any questions or queries you may send us.

Legal basis: Consent.

Retention: We will keep the data for 1 year after the query has been resolved.

### Service improvement, diagnostics and fraud prevention

When using the Services, information is generated about such use of the Platforms, such as searches, follows, interactions, posts, downloads, notification events, purchases or restorations, technical diagnostics, or security and access events. This information will be used by Outzero to improve the Services, monitor performance and stability, diagnose incidents, prevent conduct that could amount to fraud, and ensure security.

This may include product and usage analytics events generated within the app or website, such as screen views, searches, content selections, interactions with spots, routes, profiles or subscriptions, technical performance measurements, crash or error reports, and limited technical context associated with those events. For authenticated users, some analytics, audit, or security events may be associated with an internal account identifier. On the web, where legally required, analytics and similar measurement collection will only be activated after the user has granted consent through the cookie banner or configuration tool.

Legal basis: Legitimate interest and, where applicable for certain web analytics or measurement technologies, consent.

Retention: 10 years.

### Sponsored content and contextual advertising

Outzero may show sponsored content or third-party advertising in the mobile app and, where applicable, process limited device, app, contextual, or measurement information to deliver, cap, secure, and measure such content. Outzero does not use this processing to create its own individualized advertising profiles, without prejudice to the processing that the relevant third-party providers may carry out under their own terms where applicable.

Legal basis: Legitimate interest and, where required by applicable law or platform rules, consent.

Retention: For the period necessary to manage advertising delivery, frequency control, fraud prevention, and measurement, and in accordance with the applicable provider's retention rules.

If in the future data is processed for any other purpose, this will be communicated before carrying out such processing.

However, in some cases it may be necessary to process personal data to comply with legal obligations or in connection with any contractual relationship we may have with the user.

Managing commercial communications and push permissions

If authorized through consent, commercial communications or push updates from the Platforms may be sent. In such cases, Outzero may send information about its products, activities, and services, or updates made on the Platforms.

Consent to receive commercial communications may be withdrawn at any time by using the unsubscribe mechanism included in each email, by changing the relevant notification preferences on the Platforms or on the device, or by sending an email to info@outzero.app.

Data disclosures and international transfers

If you purchase a subscription, your data may be disclosed to app stores, payment providers, subscription processors, or other providers we work with to process, restore, manage, or support the subscription. Depending on the service, such providers may act as data processors or as independent controllers under their own terms.

Outzero does not sell or rent personal data to third parties. In addition, data may be made available to providers that support hosting, authentication, database management, storage, analytics and measurement, crash reporting, push messaging, mapping or geolocation services, advertising or sponsored-content delivery, customer support, and other functions necessary to operate, secure, measure, or improve the Platforms. Such providers will access the data only to the extent necessary for those services, unless they act under their own privacy terms as independent controllers.

Some of these providers may be located outside the European Union or the European Economic Area. If such providers are engaged, we will ensure that this is done in accordance with the safeguards provided for in the GDPR and that we apply all measures and controls necessary to guarantee and protect the processing of personal data.

You may request more information at any time about the safeguards adopted in each case by contacting info@outzero.app.

Cookies

Through Cookies and similar technologies, we may process and retain information about how the Website is used and, where applicable, some personal data, including sections visited, language or consent choices, general usage flows, and analytics or performance events. In the mobile app, equivalent local storage or SDK identifiers may be used instead of browser cookies.

This information is obtained mainly through the use of Cookies or similar technologies, so its processing will depend on the Cookies or technologies that have been accepted or are strictly necessary. Outzero may use technical, preference, analytics, and performance measurement cookies or identifiers to understand the use of the website and improve the service. Outzero does not enable non-essential web analytics or similar measurement collection before consent when consent is legally required.

Cookies and similar technologies can be managed from the configuration tool and preferences can be changed at any time. For more information, including the types of cookies or similar technologies used and how to configure them, please consult our Cookie Policy.

Retention period

Data will be retained for the period established in each section of the website in which personal data is requested, unless the data subject consents to its retention for a longer period, without prejudice to its retention and maintenance under due blocking for availability to the competent authorities in the different matters that may apply.

Where the user requests account deletion, Outzero may apply security verification steps, email confirmation, and a grace period before permanent deletion, without prejudice to any blocking or retention obligations that may apply under the law.

User rights

Any person has the right to obtain confirmation as to whether or not Outzero is processing personal data concerning them.

Data subjects have the right to access their personal data and to request the rectification of inaccurate data or, where appropriate, erasure when, among other reasons, the data is no longer necessary for the purposes for which it was collected.

In certain circumstances, data subjects may request restriction of the processing of their data, in which case the data will only be retained for the exercise or defense of claims.

Likewise, in certain circumstances and for reasons related to their particular situation, data subjects may object to the processing of their data. In that case, Outzero will stop processing the data, except for compelling legitimate grounds or for the exercise or defense of possible claims.

By virtue of the right to data portability, data subjects have the right to receive the personal data concerning them in a structured, commonly used, and machine-readable format, and to transmit it to another controller.

When the legal basis legitimizing the processing is consent, the data subject has the right to withdraw or revoke it at any time. Withdrawal or revocation of consent will not have retroactive effects and therefore will not affect the lawfulness of processing based on consent before its withdrawal.

You may exercise any of the rights indicated by sending an email to: info@outzero.app.

The user may also manage certain permissions and preferences directly on the Platforms or through their device or browser settings, such as location, cookies on the web, or push notifications.

Please note that, in some cases, Outzero may need to verify your identity and may therefore require supporting documentation such as a copy of your national identity document or an equivalent identification document.

Questions or complaints

If you have any questions or complaints about how we process your personal data, or any other related matter, you may contact us through the channels indicated above, using the reference "Personal data". If you do not receive a response within a reasonable period, you have the right to file a complaint with the Spanish Data Protection Agency (`www.aepd.es`).

Last updated: May 01, 2026