COMPREHENSIVE PRIVACY NOTICE

The Controller is Sasu Educación, S.A.P.I. de C.V., with address at Calle Jaime Balmes 11, Torre B, Piso 4, Despacho 402, Col. Polanco I Sección, Miguel Hidalgo, C.P. 11510, Mexico City. For any matter related to your personal data, contact us at privacidad@sasuedu.com.

Depending on the features you use, we process the following categories of data:

• From the parent or guardian: phone number and, optionally, email address and family surname; free-text notes from daily check-ins; reminder settings and time zone; notification token; referral codes; and, if you order prints, full name, address and phone number.
• From the children: name, date of birth or age range, gender, optional avatar photo, and the photos, videos and text you upload to the Memory Chest, as well as emotion and activity records.
• Sign-in and device data: user and device identifiers, model, operating system, app version and IP address.
• Subscription and payments: subscription tier and status. Payments are processed through Apple, Google or Stripe; Sasu does not receive or store your card or bank account details.

Sensitive data. Children's photos and videos, as well as the emotional notes in check-ins, are considered data requiring special protection. They are processed only with the express consent of the parent or guardian, collected through a specific checkbox in the app.

Primary purposes (necessary for the service):

• Create and manage your account and the children's profiles.
• Run the app's features: daily check-ins, Memory Chest, reminders and content recommendations.
• Process subscriptions and, where applicable, print orders.
• Send notifications and service-related communications, including the weekly activity summary on WhatsApp, which you can unsubscribe from at any time.
• Keep the platform secure and handle support requests.

Secondary purposes (not necessary; you may object):

• Product analytics and service improvement.
• Campaign measurement and marketing.

If you do not want your data processed for the secondary purposes, you can say so on the app's consent screen or by writing to privacidad@sasuedu.com; this is not a condition for using the app.

To recommend content after a daily check-in, we use an artificial intelligence service from Google (Vertex AI) located in the United States. We send the text of your note and the selected emotions; the child's name and age are not included. This processing takes place with your express consent, collected through a specific checkbox in the app, and is an international transfer that you authorize by giving it.

To run the service we use providers that process data on our behalf (processors) or to whom we transfer data. The main ones are:

We do not sell your personal data. Transfers to these providers are made for the purposes described; those that require your consent under the Law are authorized when you accept this Notice. We maintain with our processors the protection commitments required by the Law and its Regulations.

Sasu accounts are created and managed only by adults acting as parent or guardian. When you open the app for the first time you confirm that you are an adult with authority as parent or guardian, and you accept the Terms and this Notice. Before you upload a child's first photo or video, we ask for your specific express consent. Each decision is recorded with the date, time and version of the Notice accepted. If you believe a minor gave us data without your authorization, contact us to have it deleted.

You can Access, Rectify, Cancel or Object to the processing of your data (ARCO rights), and withdraw your consent, by sending a request to privacidad@sasuedu.com. The request must include your name, how you want to receive the answer, documents proving your identity and a description of the data the request concerns. We will respond within the periods set by the Law and its Regulations (20 business days to decide and 15 to carry out the decision). You can also delete your account from the Parents' Zone.

We keep your data while your account is active and for the periods needed to meet legal obligations. When you delete your account, we remove your data from our active systems immediately and permanently within a maximum of 30 days, including photos, videos and technical records, except information we must keep by law. Some providers may keep limited technical or usage data, without your name, phone number or email, for up to 14 months under their own policies. Apple and Google keep subscription purchase records under their own policies.

You can delete your child's profile in the app, under Parents' Zone › Manage profiles › Delete profile. This also deletes their memories, photos, videos and notes. To delete a specific memory, photo or video, write to us at privacidad@sasuedu.com.

On sasuedu.com we use our own and third-party cookies and similar technologies (Google Analytics, Meta, Stripe). Non-essential cookies and technologies, including measurement events sent from our server, are only activated with your consent through the notice on the site. You can manage them from that notice or from your browser settings. Details are in our Cookie Policy.

We apply administrative, technical and physical security measures to protect your data. Information travels encrypted (HTTPS/TLS) and is stored encrypted at rest. No system is completely infallible, but we work to protect your data in accordance with the Law.

We may update this Notice because of legal changes or changes in our practices. We will publish the current version at https://sasuedu.com/es/privacy and, when the change is significant, we will let you know through the contact details we have on file.

If you believe your right to personal data protection has been violated, you can contact the Secretaría Anticorrupción y Buen Gobierno, the authority that took over the functions previously held by the National Institute for Transparency, Access to Information and Personal Data Protection (INAI), or whichever authority is competent.