1. Introduction

This Privacy Policy (the "Policy") describes how New Consciousness Foundation USA LLC (hereinafter "we", "us", "our", or "the Company") handles user privacy in relation to the Ardi Lupa mobile application (hereinafter "the App"). This Policy is designed to comply with, and shall be interpreted in accordance with, the Google Play Developer Program Policies (2026 edition and any subsequent amendments), the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act ("CCPA/CPRA"), the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados, Law No. 13.709/2018, "LGPD"), the Children's Online Privacy Protection Act ("COPPA"), the Americans with Disabilities Act ("ADA"), the European Accessibility Act ("EAA"), the ePrivacy Directive (Directive 2002/58/EC as amended), and any other applicable privacy, data protection, consumer protection, and accessibility laws of jurisdictions in which the App is made available.

Ardi Lupa is a simple digital magnifying glass utility application designed for general consumer use. By its very design and architecture, the App does not collect, store, transmit, process, share, sell, rent, lease, license, or otherwise make available any personal data, personal information, or personally identifiable information whatsoever.

🔒 KEY PRIVACY HIGHLIGHTS — AT A GLANCE

• ✅ 100% offline operation: The App does not require, request, declare, or use internet access of any kind.
• ✅ Zero data collection: No personal data, no analytics, no telemetry, no tracking, no advertising identifiers.
• ✅ No third-party SDKs: No Firebase, no AdMob, no Crashlytics, no Sentry, no analytics frameworks of any kind.
• ✅ No microphone access: The App is technically incapable of capturing audio.
• ✅ No artificial intelligence or image analysis: No face detection, no object recognition, no biometric processing.
• ✅ No background execution: The App ceases all activity when not actively in use.
• ✅ No international data transfers: Because no data is collected, no data crosses any border.
• ✅ Single permission required: CAMERA, used exclusively for the core magnification functionality.
• ✅ Minimal local-only legal record: Stores only your acceptance of the legal documents (boolean flags + version + timestamp) on your own device; never transmitted anywhere.
• ✅ External links open in your browser: When you tap a link to view updated terms or translations, your device's browser handles the request — the App itself never connects to the internet.

This Policy applies exclusively to data practices of the App itself. It does not govern data practices of the Google Play Store, the Android operating system, third-party applications installed on your device, or any other software or service operating independently from Ardi Lupa.

2. Information We Collect

We do not collect any personal data, personal information, or personally identifiable information of any kind. Without limiting the generality of the foregoing, and for the avoidance of any doubt whatsoever:

• ❌ We do NOT collect names, email addresses, postal addresses, phone numbers, fax numbers, instant messaging identifiers, social media handles, or any other contact information.
• ❌ We do NOT collect device identifiers of any kind, including but not limited to Android ID, Advertising ID (AAID/IDFA), IMEI, IMSI, MAC addresses, serial numbers, hardware identifiers, or any other persistent or non-persistent identifiers.
• ❌ We do NOT collect geolocation data, whether precise (GPS-based) or approximate (network-based, Wi-Fi triangulation, cell tower, or otherwise).
• ❌ We do NOT collect app usage analytics, telemetry, behavioral data, interaction patterns, session duration, feature usage statistics, or any equivalent metric.
• ❌ We do NOT collect crash reports, error logs, diagnostic data, performance metrics, or stack traces.
• ❌ We do NOT collect biometric data, health data, financial data, payment information, government-issued identifiers, or any category of sensitive personal data as defined under GDPR Article 9, CCPA §1798.140(ae), or LGPD Article 5(II).
• ❌ We do NOT use cookies, web beacons, tracking pixels, fingerprinting technologies, local storage tracking, or any equivalent client-side or server-side tracking technology.
• ❌ We do NOT integrate any third-party software development kits (SDKs), libraries, or services that collect, transmit, or process user data. The App does NOT contain Google Firebase, Google Analytics, Google AdMob, Facebook SDK, Crashlytics, Sentry, Mixpanel, Amplitude, AppsFlyer, Adjust, Branch, or any analogous analytics, advertising, attribution, or telemetry framework.
• ❌ We do NOT maintain user accounts, profiles, login credentials, or authentication tokens, as the App requires no registration, sign-in, or identification of any kind.

Note on the scope of this Section: This Section addresses data collected by the Company — that is, data that would leave the User's Device, be transmitted to the Company, or otherwise be made available to the Company. For full transparency, the App does store a minimal Legal Acceptance Record locally on the User's own Device for legal-compliance purposes (specifically, the User's record of acceptance of these legal documents). This locally stored record is described in detail in Section 8 below; it does not constitute "collection" of personal data within the meaning of any applicable privacy law, but it is disclosed here for the avoidance of doubt and out of an abundance of transparency.

Note regarding the Google Play Store and Android operating system: The Google Play Store, Google Play Services, and the Android operating system itself may collect certain technical data (such as installation events, automatic system crash reports, system telemetry, or device-level diagnostics) independently of Ardi Lupa, in accordance with their own privacy policies. Such collection occurs at the platform layer, outside the App's scope of operation, and is not performed by, transmitted to, or accessible by Ardi Lupa or its developer. Users are encouraged to consult Google's own privacy policy at https://policies.google.com/privacy for details on platform-level data practices.

3. Permissions Required by the App

In the interest of full transparency and to align with Google Play's permission disclosure requirements, the following is an exhaustive list of permissions requested by Ardi Lupa:

No other permissions are requested by the App. In particular, Ardi Lupa does not request INTERNET, ACCESS_NETWORK_STATE, ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION, READ_CONTACTS, READ_PHONE_STATE, RECORD_AUDIO, READ_EXTERNAL_STORAGE, READ_MEDIA_IMAGES, READ_MEDIA_VIDEO, WRITE_EXTERNAL_STORAGE, MANAGE_EXTERNAL_STORAGE, READ_CALENDAR, BLUETOOTH, BLUETOOTH_CONNECT, BLUETOOTH_SCAN, NFC, BODY_SENSORS, ACTIVITY_RECOGNITION, POST_NOTIFICATIONS, SYSTEM_ALERT_WINDOW, or any other permission beyond the strictly necessary CAMERA permission.

You may revoke the Camera permission at any time through your device's system settings (typically under Settings → Apps → Ardi Lupa → Permissions). Please note that revoking the Camera permission will render the App's core functionality inoperable, as the App requires camera access to function as a magnifying glass.

4. Camera Permission and Image Processing

Ardi Lupa requests access to your device's CAMERA hardware for its core functionality: displaying a real-time, zoomed view of physical objects (the "magnifying glass" feature) and, at your sole discretion, capturing still photographs.

Detailed handling of camera-derived data:

• 📷 The camera feed is processed exclusively and locally on your device, in real time, using the standard Android Camera2 / CameraX APIs.
• 📷 The camera feed is never transmitted, streamed, mirrored, copied, or otherwise sent to our servers, to any third-party servers, or to any external service, network, or destination.
• 📷 Physical impossibility of transmission: Because the App does not declare the INTERNET permission in its AndroidManifest.xml, the App is technically and architecturally incapable of transmitting any image, frame, pixel, byte, or data over any network. This is not merely a policy commitment — it is a structural property enforced by the Android operating system's permission model itself. Even in a hypothetical scenario of code corruption, compromise, modification, or malicious tampering, the App cannot send images or any data over the internet because the required system-level permission is simply absent and cannot be invoked at runtime without re-installation of a different application bearing such permission.
• 📷 No frame of the camera feed is buffered, cached, persisted, or retained beyond the immediate real-time display, except in the case where the user explicitly invokes the photo capture function.
• 📷 Photographs that you affirmatively choose to capture are saved locally to your device's standard Pictures/ArdiLupa folder using Android's MediaStore API, in accordance with Android's scoped storage conventions.
• 📷 Captured photographs remain under your sole and exclusive control on your device. We have no access, no remote read capability, no synchronization mechanism, and no recovery capability with respect to such photographs.
• 📷 You may delete, move, rename, share, or otherwise manage saved photographs at any time through your device's standard file manager, gallery application, or any other tool of your choice.
• 📷 If you choose to share captured photographs through your device's system share menu, the third-party application you select (e.g., messaging apps, email clients, cloud storage services, or social media platforms) will receive and handle the photograph according to its own privacy policy and data practices, over which we have no control and for which we assume no responsibility.

5. Offline-Only Operation and Network Activity

Ardi Lupa does not request, declare, or require internet access of any kind. The App operates entirely offline, by design and by architecture. The INTERNET permission is not declared in the App's AndroidManifest.xml, which means that, by virtue of Android's permission enforcement model, the App is technically incapable of transmitting any data over any network, regardless of intent, configuration, or external manipulation.

Consequently, the App does not:

• Communicate with any remote server, API endpoint, or cloud service;
• Perform any background data synchronization;
• Check for updates over the network (updates are delivered exclusively through the Google Play Store's own update mechanism);
• Participate in any form of network-based telemetry, advertising, attribution, analytics, or remote logging;
• Establish any TCP, UDP, HTTP, HTTPS, WebSocket, or any other type of network connection;
• Resolve any DNS query on its own behalf.

This offline-only architecture is a deliberate design choice intended to provide users with the strongest possible privacy guarantee: data that never leaves the device cannot be misused, intercepted, breached, or sold.

6. No Microphone Access

The App does not request, declare, or use Android's RECORD_AUDIO permission, nor any other microphone-related permission. Under no circumstances does Ardi Lupa activate, access, sample, record, stream, transmit, or otherwise interact with the device's microphone or any other audio input device.

The App is technically incapable of capturing audio of any kind, because the necessary system permission is absent from the App's manifest. This guarantee, like the offline guarantee, is enforced by the Android operating system itself at the platform level.

7. Limited File System Access

The App does not request, declare, or hold any read permission over external storage. Specifically, Ardi Lupa does not declare READ_EXTERNAL_STORAGE, READ_MEDIA_IMAGES, READ_MEDIA_VIDEO, READ_MEDIA_AUDIO, MANAGE_EXTERNAL_STORAGE, or any equivalent broad file-access permission.

Consequently, the App is technically unable to access, read, enumerate, list, open, copy, or display photographs, videos, documents, or any other files previously stored on your device, whether captured by other applications, transferred from external sources, downloaded from the internet, received via messaging apps, or otherwise present on the device. The App has no visibility whatsoever into your existing media library or file system contents.

Furthermore, as a matter of deliberate design, the App does not access, open, read, modify, display, list, or retrieve photographs previously captured by Ardi Lupa itself. There is no in-app gallery, no recent-photos view, no photo browser, no thumbnail strip, and no retrieval mechanism of any kind for previously captured images.

The App's entire file system interaction is strictly limited to the following narrow operation: writing a newly captured photograph to the Pictures/ArdiLupa folder at the precise moment of capture, using Android's standard MediaStore API under scoped storage conventions. Once a photograph is written to this folder, control over that file passes entirely to the operating system and to the user. The App neither retains a reference to such file, nor provides any means of recovering, viewing, or interacting with it from within the App.

In summary: Ardi Lupa can write new photos, and nothing else, with respect to the device's media file system. The single additional file the App writes to its own private application storage is the Legal Acceptance Record described in Section 8 below, which is not part of the device's media file system and is not accessible to any other application.

8. Local Application State and Device-Side Storage

For purely functional, operational, and legal-compliance purposes, the App stores minimal internal state on your Device using Android's standard SharedPreferences API. The data is stored in a single sandboxed file at the system path:

/data/data/com.carnegiecorpsa.ardilupa/shared_prefs/ardilupa_legal.xml

This file is strictly private to the App under the Android security model: no other application installed on your Device can read or write to it without device-level root privileges, and the file is automatically encrypted at rest on Devices supporting file-based encryption (Android 7.0 and later).

8.1 What is stored

The locally stored data consists exclusively of the following items, which together comprise the Legal Acceptance Record:

• Three independent boolean flags, each representing one of the three separate confirmations you provide during the initial legal acceptance screen:
• (a) Confirmation that you are eighteen (18) years of age or older;
• (b) Acceptance of the Terms of Use and Privacy Policy in their entirety;
• (c) Specific acknowledgment of the critical prohibitions set forth in Sections 7.4 and 7.5 of the Terms of Use (regarding photography of minors and prohibition of sexual/pornographic content respectively);
• A version identifier (e.g., "1.1") indicating precisely which version of the legal documents you accepted, enabling the App to detect when subsequent material updates require renewed acceptance;
• A timestamp (expressed in milliseconds since the Unix epoch, January 1, 1970, 00:00:00 UTC) recording the exact moment at which your acceptance was registered. This timestamp constitutes the principal evidentiary record of your acceptance and may be relevant in the event of any legal inquiry directed at the User.

No other data is stored. The App does not persist user-interface preferences, settings, history, usage statistics, recently used items, last-state restoration data, or any other form of user-derived state. The Legal Acceptance Record is the App's complete and exhaustive local storage footprint.

8.2 Behavior upon decline of legal acceptance

If the User, upon being presented with the initial legal acceptance screen, does not affirmatively accept the legal documents — that is, if the User does not mark all three required checkboxes and tap the "I ACCEPT" button, or if the User taps the "DECLINE" button — the App immediately closes via Android's finishAndRemoveTask() mechanism. In such case, no data is written to the Device's SharedPreferences, and the ardilupa_legal.xml file is not created. The Legal Acceptance Record described in this Section is created only upon affirmative acceptance by the User; declining users leave no trace whatsoever in the App's local storage.

8.3 Critical characteristics of this locally stored data

• ✅ Strictly device-local: This data never leaves your Device. It is not transmitted, synchronized, mirrored, or uploaded to the Company's servers, to any third-party server, or to any cloud service. The App's offline-only architecture (Section 5) makes such transmission technically impossible.
• ✅ Not associated with any user identifier: The Company does not assign any user ID, device ID, account ID, or any other identifier to this data. The Company does not know which Device this data resides on, who owns such Device, or any information that could link such data to an identifiable natural person.
• ✅ Not "personal data" under applicable privacy law: The data described in this Section does not constitute "personal data" within the meaning of Article 4(1) GDPR, "personal information" within the meaning of CCPA §1798.140(v), or "personal data" within the meaning of LGPD Article 5(I), because it neither identifies nor relates to an identifiable natural person from the Company's perspective. It is purely operational and legal-compliance state, analogous to "strictly necessary" technical state exempt from consent requirements under Recital 30 of the GDPR and Article 5(3) of the ePrivacy Directive (Directive 2002/58/EC as amended).
• ✅ Not backed up to cloud services: The App's manifest disables Android Auto Backup (android:allowBackup="false") and configures device-transfer rules (via res/xml/data_extraction_rules.xml) to exclude SharedPreferences and related local data from any cloud backup, Google One backup, or device-to-device transfer mechanism. Accordingly, this data does not propagate to your Google Drive, your Google account, or any other cloud destination.
• ✅ Fully user-controlled: You may delete this data at any time by (i) clearing the App's data through your Device's system settings (typically under Settings → Apps → Ardi Lupa → Storage → Clear data), or (ii) uninstalling the App, in which case all data is automatically and irrevocably deleted by the Android operating system. Upon next launch (after data clearance or reinstallation), the App will present the legal acceptance screen again as if it were the first installation.
• ✅ Reset upon material updates: Upon any material update to the Terms of Use or this Privacy Policy, the version identifier stored in the Legal Acceptance Record will no longer match the current document version, the three acceptance flags will be deemed reset, and the User will be prompted to review and accept the updated documents before continuing to use the App.

8.4 Purpose and necessity of this storage

The Legal Acceptance Record exists for two interrelated and legally necessary reasons:

1. User-experience continuity: Without persistent local record of your acceptance, the App would be required to present the legal acceptance screen at every single launch of the App, which would be impractical, frustrating, and contrary to reasonable user-experience expectations for any mobile application;
2. Forensic evidence: In the unlikely event of any legal dispute, judicial inquiry, regulatory investigation, or law-enforcement matter directed at the User concerning use of the App, the timestamped acceptance record on the User's Device serves as evidence that the User did, in fact, knowingly, deliberately, and voluntarily accept the legal terms — including in particular the critical prohibitions set forth in Sections 7.4 (prohibition against photography of minors) and 7.5 (prohibition against sexual/pornographic content) of the Terms of Use.

No other purpose is served by this storage, and no other use of this data is made by the App. The Company has no access to this data from its own systems, because the data exists exclusively on the User's Device and is never transmitted anywhere.

9. No Artificial Intelligence, Machine Learning, or Image Analysis

Ardi Lupa does not employ, embed, invoke, or rely upon any of the following technologies, whether on-device or remote, whether at runtime or at build time, whether actively or passively:

• Artificial intelligence systems of any kind;
• Machine learning models, neural networks, deep learning algorithms, or any equivalent computational learning system;
• Computer vision algorithms beyond the standard real-time rendering pipeline of the Android camera APIs;
• Face detection, face recognition, facial analysis, or any biometric analysis system;
• Object detection, object recognition, scene classification, or content classification systems;
• Optical character recognition (OCR), text detection, document analysis, or barcode/QR-code scanning;
• Automated decision-making systems, profiling systems, or recommendation systems;
• Any analogous form of automated analysis, interpretation, or inference applied to the camera feed or captured photographs.

The camera feed displayed by the App is a direct, real-time visual rendering of the device's camera input, magnified solely through standard digital zoom mechanisms provided by the Android camera APIs. No frame, image, or pixel data is analyzed, classified, recognized, interpreted, tagged, indexed, or otherwise algorithmically processed beyond what is strictly necessary to render the visual feed to the screen and, optionally and exclusively upon explicit user request, to save it to local storage.

This declaration is made, among other reasons, in anticipation of and consistency with the European Union Artificial Intelligence Act (Regulation (EU) 2024/1689) and analogous emerging AI regulatory frameworks worldwide.

10. No Background Execution

The App does not execute any code, perform any operation, capture any data, or remain meaningfully active when not in the foreground and actively in use by the user.

Specifically, Ardi Lupa does not:

• Register any background services (foreground services or otherwise);
• Schedule any background jobs via WorkManager, JobScheduler, or AlarmManager;
• Register any broadcast receivers for system events such as boot completion, network connectivity changes, screen on/off events, or any other system broadcast;
• Maintain any persistent foreground notification;
• Use the device's wake locks, doze-mode exemptions, or battery-optimization exemptions;
• Execute any periodic, scheduled, or triggered logic outside of direct user interaction.

When you exit, minimize, or close the App, all camera operations cease immediately, all in-memory data is released to the operating system in accordance with standard Android lifecycle management, and the App enters a fully dormant state until the next time you explicitly launch it.

11. Data Sharing with Third Parties

We do not share, sell, rent, lease, license, disclose, or otherwise transfer any data with or to any third party, because we do not collect, possess, or have access to any data to begin with. There is, accordingly, no "sale" of personal information within the meaning of the CCPA/CPRA, no "transfer" of personal data within the meaning of the GDPR, no "sharing" of personal information for cross-context behavioral advertising within the meaning of the CPRA, and no "treatment" or "sharing" of personal data within the meaning of the LGPD.

The Legal Acceptance Record described in Section 8 above is stored exclusively on the User's Device and is, by virtue of the App's offline architecture, structurally unable to be shared with any third party.

12. No International Data Transfers

Because Ardi Lupa does not collect, process, store, or otherwise handle any personal data of any kind, no transfer of personal data to any jurisdiction takes place, whether within the European Economic Area, the United States, Brazil, Paraguay, or any other territory.

Consequently, the data transfer obligations established under Chapter V of the GDPR (Articles 44 through 50, including the requirements regarding Standard Contractual Clauses, adequacy decisions, and Binding Corporate Rules), Section 1798.140 of the CCPA, Articles 33 through 36 of the LGPD, and analogous provisions of other applicable laws are inherently and fully complied with by virtue of the structural absence of any data transfer whatsoever.

In plain terms: no personal data crosses any border, because no personal data exists within the App's ecosystem in the first place.

13. Data Retention

We do not retain any user data on the Company's systems, because we do not collect any user data. Photographs that you choose to capture using the App are stored exclusively on your local device and remain there until you affirmatively choose to delete them. We have no role in, knowledge of, or control over the retention or deletion of such locally stored photographs.

Regarding the minimal Legal Acceptance Record stored locally on the User's Device (as described in detail in Section 8), such record is retained on the User's Device until any of the following events occurs:

• (i) The User clears the App's data through the Device's system settings (typically under Settings → Apps → Ardi Lupa → Storage → Clear data);
• (ii) The User uninstalls the App, in which case all associated SharedPreferences data is automatically and irrevocably deleted by the Android operating system;
• (iii) A material update to the Terms of Use or this Privacy Policy causes the recorded version identifier to no longer match the current document version, in which case the three acceptance flags are deemed reset, and the User is prompted to review and re-accept the updated documents.

The Company does not retain a copy of the Legal Acceptance Record on its own systems, as the App's offline-only architecture makes such retention technically impossible. The Record exists solely on the User's Device.

14. Open Source Components and Third-Party Libraries

Ardi Lupa incorporates certain open-source software components for general application functionality, including but not limited to portions of:

• The Android Jetpack libraries and AndroidX support libraries;
• The CameraX library, for camera-related functionality;
• The Kotlin Standard Library and Kotlin coroutines (where applicable);
• Standard components of the Android operating system itself.

Each of these components is distributed under permissive open-source licenses (typically the Apache License 2.0 or the MIT License). These components are integrated solely to provide standard application functionality, and none of them collects, transmits, or processes any user data on behalf of the Company or any third party in the context of Ardi Lupa, given the App's offline-only architecture and the absence of the INTERNET permission.

Attribution and license information for incorporated open-source components may be made available through the App's "About" or "Licenses" section, and may also be requested at the contact address provided in the final section of this Policy.

15. Outbound Links to External Websites

The App may contain hyperlinks or buttons that, upon User activation, open external websites in the Device's default web browser (or in any browser application designated by the User as default). Such links may include, without limitation:

• Links to the online version of this Privacy Policy (https://fundacionnuevaconsciencia.com/app/ardilupa/privacy/), which may contain updated or translated text;
• Links to the online version of the Terms of Use (https://fundacionnuevaconsciencia.com/app/ardilupa/terms/);
• Links to the App's online home page (https://fundacionnuevaconsciencia.com/app/ardilupa/);
• Links to translated versions of the foregoing in languages other than English, where available;
• Links to the Company's official website (https://fundacionnuevaconsciencia.com/);
• Links to the contact email address (mailto: links), which open the Device's default email application;
• Links to authoritative external resources cited in this Privacy Policy or the Terms of Use (e.g., the European Online Dispute Resolution platform, the NCMEC CyberTipline, applicable regulatory texts);
• Other functional links explicitly added by the Company in future versions of the App.

Important user notice regarding outbound links:

• 🌐 The App itself does not transmit any data when an outbound link is activated. Because the App lacks the INTERNET permission (see Section 5), the act of opening an external link does not involve any network operation performed by the App. The App's role is limited to passing the target URL to the Android operating system via the standard Intent.ACTION_VIEW mechanism, which then opens the URL using the User's designated browser application. The App neither contacts the destination server nor exchanges any data with it.
• 🌐 Activation of any outbound link is always at the User's explicit initiative. No outbound link is opened automatically, in the background, or without the User's deliberate tap or click.
• 🌐 Once the User has been redirected to an external website, the browser application and the website operator govern all subsequent activity. This Privacy Policy ceases to apply at the moment the link is activated and the User leaves the App. The privacy practices of external websites are governed by their own respective privacy policies and by the terms of service and privacy policy of the browser application used.
• 🌐 The Company has no control over, and assumes no responsibility for, the content, availability, security, accuracy, legality, or privacy practices of any external website linked from the App. The inclusion of any link does not constitute endorsement of the linked website by the Company, except in respect of websites operated by the Company itself.
• 🌐 The Company's own website (https://fundacionnuevaconsciencia.com/) is operated by the Company and is subject to its own website privacy policy, which may differ from this App Privacy Policy given that the website operates online and may involve different technical mechanisms (such as standard web server logs, session cookies for language preference, or aggregate visitor statistics). The User is encouraged to consult the website's own privacy policy when accessing it.

Recommendation to the User: Before activating any outbound link, the User is encouraged to review the privacy policy of the destination website and to use a browser application configured in accordance with the User's own privacy preferences.

16. Children's Privacy

Ardi Lupa is suitable for users of all ages and complies with the Children's Online Privacy Protection Act ("COPPA"), the GDPR's provisions regarding the processing of personal data of children (Article 8), the LGPD's provisions regarding the treatment of children's data (Article 14), and analogous provisions of other applicable laws.

Because we do not collect any personal data, personal information, or personally identifiable information from any user, regardless of age, there is no risk to the privacy of children or minors arising from the use of the App.

Notwithstanding the foregoing, the Terms of Use of the App restrict its use to adults aged eighteen (18) years or older. We do not direct the App specifically at children, nor do we knowingly engage in any practice that would require parental consent under COPPA or equivalent regulations. Parents and guardians remain responsible for supervising minors' use of mobile devices and applications in accordance with applicable laws and reasonable parental judgment.

17. Your Rights Under GDPR, CCPA/CPRA, LGPD, and Other Applicable Laws

Under the GDPR, CCPA/CPRA, LGPD, and various other privacy laws, data subjects and consumers are afforded certain rights with respect to their personal data, including but not limited to the rights to:

• Access or request a copy of personal data;
• Rectify or correct inaccurate personal data;
• Erase or request deletion of personal data ("right to be forgotten");
• Restrict or object to the processing of personal data;
• Data portability (receive personal data in a structured, commonly used, machine-readable format);
• Withdraw consent for processing;
• Lodge a complaint with a competent data protection authority;
• Opt out of the sale or sharing of personal information (under CCPA/CPRA);
• Opt out of automated decision-making and profiling;
• Non-discrimination for exercising privacy rights.

Because we do not collect, process, store, or hold any personal data of any kind, there is no personal data to which any of the foregoing rights could be meaningfully applied. The Legal Acceptance Record described in Section 8 is stored exclusively on the User's own Device and is under the User's exclusive control; the User may delete it at any time by clearing the App's data or uninstalling the App.

Notwithstanding the foregoing, if you believe you have any concerns regarding the App's privacy practices, or if you wish to make any inquiry related to your rights under applicable privacy law, you may contact us at the email address provided in the final section of this Policy, and we will respond in good faith within the timeframes prescribed by applicable law.

18. Security

Although we do not collect or process any user data, we nonetheless take security seriously as a matter of design philosophy and professional responsibility. To that end, Ardi Lupa:

• Uses Android's standard secure file storage mechanisms (MediaStore API with scoped storage) for any photographs captured by the user.
• Uses Android's standard private SharedPreferences storage for the Legal Acceptance Record (Section 8), which is sandboxed within the App's private data directory and inaccessible to other applications.
• Does not embed or link against any networking libraries, HTTP clients, WebSocket libraries, gRPC clients, or remote procedure call frameworks.
• Does not include any code path capable of initiating outbound network connections.
• Has been developed in compliance with Google Play's security review requirements, including but not limited to compliance with target API level requirements, the absence of known-vulnerable dependencies, and adherence to Google Play's Restricted Permissions and Sensitive Permissions policies.
• Does not include any obfuscated, packed, or dynamically loaded code beyond what is strictly necessary for ordinary application execution.
• Is signed using a secure developer key managed by the Company in accordance with Google Play App Signing best practices.
• Disables Android Auto Backup (android:allowBackup="false") and data extraction rules to prevent local data from being transmitted to cloud backup services or device-transfer mechanisms.

19. Accessibility Commitment

Ardi Lupa is designed with accessibility in mind and supports Android's built-in accessibility services, including the TalkBack screen reader, system-wide font scaling, color inversion, high-contrast modes, and other accessibility-oriented system settings. The App's interactive elements are programmatically labeled (via contentDescription attributes and Modifier.semantics in Jetpack Compose) to facilitate use by persons with visual or motor impairments.

Because Ardi Lupa is, by its very nature, a magnification utility, we recognize that the App may be particularly useful to persons with low vision or other visual impairments, and we have approached the App's design with this audience explicitly in mind.

We are committed to complying with applicable accessibility standards and legal frameworks, including but not limited to:

• The Americans with Disabilities Act ("ADA"), United States, 1990, as amended;
• The European Accessibility Act ("EAA"), Directive (EU) 2019/882, applicable as of 28 June 2025;
• The Web Content Accessibility Guidelines (WCAG) 2.2, to the extent applicable to mobile applications;
• The Brazilian Law on Inclusion of Persons with Disabilities (Lei Brasileira de Inclusão da Pessoa com Deficiência, Law No. 13.146/2015);
• The Paraguayan Law 4934/2013 on accessibility for persons with disabilities; and
• Any other applicable accessibility law in jurisdictions where the App is made available.

If you experience any accessibility barrier while using Ardi Lupa, or if you have suggestions for improving the App's accessibility, please contact us at the email address provided in the final section of this Policy. We endeavor to address accessibility feedback as a matter of priority and in good faith.

20. Google Play Data Safety Disclosure

The disclosures contained in this Privacy Policy are fully consistent with, and shall be deemed to align with, the information provided by the developer in the Google Play Data Safety section associated with the App's listing on the Google Play Store. In the event of any apparent inconsistency between this Policy and the Data Safety section, the more privacy-protective interpretation shall prevail in favor of the user.

21. Changes to This Privacy Policy

We may, from time to time, update, revise, amend, or restate this Privacy Policy to reflect changes in legal requirements, regulatory guidance, industry best practices, or App functionality. The "Last updated" date at the top of this Policy will be revised accordingly. Material changes to this Policy will be communicated through reasonable means, which may include in-app notifications, updates to the App's listing on the Google Play Store, or posts on our official website.

Where a material change occurs, the version identifier of the legal documents will be incremented, and the App will prompt the User to review and accept the updated Policy upon next launch, as described in Section 8.3 above.

We encourage you to review this Policy periodically. Your continued use of the App following any modification to this Policy shall constitute your acknowledgment of, and agreement to, the modified Policy, except to the extent that applicable law requires affirmative consent for such modifications.

22. Disclaimer of Warranties — "As-Is" Provision

Ardi Lupa is provided to you free of charge and on an "AS IS" and "AS AVAILABLE" basis, without warranties or representations of any kind, either express, implied, statutory, or otherwise. To the maximum extent permitted by applicable law, New Consciousness Foundation USA LLC, its parent company, its affiliates, subsidiaries, directors, officers, employees, agents, contractors, licensors, and service providers hereby disclaim all warranties, whether express, implied, or statutory, including but not limited to:

• Warranties of merchantability;
• Warranties of fitness for a particular purpose;
• Warranties of accuracy, completeness, or correctness;
• Warranties of reliability, availability, or uninterrupted operation;
• Warranties of non-infringement of third-party rights;
• Warranties arising from course of dealing, course of performance, or trade usage;
• Warranties that the App will be error-free, bug-free, or free of malicious code;
• Warranties that defects in the App will be corrected.

You acknowledge and agree that Ardi Lupa is a simple digital magnifying utility intended solely for general everyday, casual, and recreational use. The App is NOT designed, certified, validated, tested, approved, intended, or suitable for any of the prohibited uses enumerated in the Terms of Use. Such uses are expressly prohibited under the Terms of Use, and, to the extent that any user nonetheless engages in such uses in contravention of that express prohibition, such use shall be undertaken strictly at the user's sole and exclusive risk, with the user assuming full and complete responsibility for any and all consequences, damages, injuries, losses, or liabilities arising therefrom.

You acknowledge that the App's magnification level, image clarity, color accuracy, focus accuracy, low-light performance, and overall optical performance depend on numerous factors entirely outside our control, including but not limited to your device's camera hardware, lens quality, sensor size, image processor, ambient lighting conditions, focus distance, hand stability, and the physical characteristics of the object being viewed. We make no representation or warranty regarding the suitability of the App for any specific use case, and the App should not be relied upon as a substitute for purpose-built professional optical equipment.

Nothing in this Section, or anywhere else in this Policy, is intended to exclude or limit any liability that cannot be excluded or limited under applicable law, including without limitation liability for gross negligence, willful misconduct, fraud, fraudulent misrepresentation, death, or personal injury caused by negligence. Where applicable law does not permit the exclusion of certain warranties, the duration and scope of such warranties shall be limited to the minimum permitted by such law.

23. Limitation of Liability

To the maximum extent permitted by applicable law, in no event shall New Consciousness Foundation USA LLC, its parent company Carnegie Corporation S.A., their respective affiliates, subsidiaries, directors, officers, employees, agents, contractors, licensors, service providers, or successors-in-interest be liable to you or to any third party for any of the following, whether arising in contract, tort (including negligence), strict liability, statute, or any other legal or equitable theory:

• (a) Any indirect, incidental, special, consequential, exemplary, or punitive damages;
• (b) Any loss of profits, loss of revenue, loss of business, loss of goodwill, loss of reputation, loss of data, loss of use, or loss of opportunity;
• (c) Any cost of substitute goods or services;
• (d) Any damages arising out of or relating to your use of, inability to use, reliance upon, or interaction with the App;
• (e) Any damages arising out of or relating to unauthorized access to or alteration of your device, photographs, or other content;
• (f) Any damages arising out of any matter relating to the App;

even if we have been advised of the possibility of such damages, and even if any remedy set forth herein is found to have failed of its essential purpose.

In any jurisdiction that does not allow the exclusion or limitation of certain damages, our aggregate liability to you for all claims arising out of or relating to the App or this Policy shall not exceed the greater of (i) the total amount you paid to us for the App in the twelve (12) months preceding the claim, which, for a free application, equals zero (USD $0.00), or (ii) the minimum amount permitted by applicable law.

You acknowledge that the disclaimers and limitations of liability set forth in this Policy reflect a reasonable and fair allocation of risk between you and the Company, and that without such disclaimers and limitations the Company would not be able to provide the App to you free of charge.

24. Governing Law and Jurisdiction

This Privacy Policy, and any dispute, claim, controversy, or matter arising out of or relating to this Policy or to the App (whether in contract, tort, statute, or otherwise), shall be governed by and construed in accordance with the laws of the State of Texas, United States of America, without regard to its conflict-of-laws principles, except to the extent that the mandatory laws of your country of residence provide otherwise and afford you greater protection.

Subject to any mandatory consumer protection rights you may have under the laws of your country of residence, any action or proceeding arising out of or relating to this Policy or the App shall be brought exclusively in the state or federal courts located in Harris County, Texas, United States of America, and you hereby submit to the personal jurisdiction of such courts and waive any objection based on forum non conveniens.

Nothing in this Section shall be construed to deprive any consumer residing in the European Union, the European Economic Area, the United Kingdom, Switzerland, Brazil, Paraguay, or any other jurisdiction with mandatory consumer protection laws of the rights afforded to such consumer under the mandatory laws of his or her country of residence, including the right to bring proceedings before the courts of such country of residence.

25. Language

This Privacy Policy is originally published in the English language. Translations into Spanish, Portuguese, or any other language may be provided for convenience and informational purposes. In the event of any inconsistency, ambiguity, conflict, or discrepancy between the English version and any translated version, the English version shall prevail and govern, except where mandatory local law of the user's country of residence requires otherwise.

26. Severability and Entire Agreement

If any provision of this Privacy Policy is held by a court or other tribunal of competent jurisdiction to be invalid, illegal, unenforceable, or void for any reason, such provision shall be deemed modified to the minimum extent necessary to render it valid, legal, and enforceable, and the remaining provisions of this Policy shall continue in full force and effect, unimpaired and unmodified. The failure of the Company to enforce any right or provision of this Policy shall not constitute a waiver of such right or provision.

This Privacy Policy, together with the App's Terms of Use and the Google Play Store Terms of Service, constitutes the entire agreement between you and the Company with respect to the privacy practices of the App, and supersedes any prior or contemporaneous understandings, agreements, representations, or warranties, whether written or oral, with respect to such subject matter.

27. Contact Information

If you have any questions, comments, concerns, complaints, or requests regarding this Privacy Policy or our privacy practices, please contact us using the information below:

New Consciousness Foundation USA LLC 14112 S Post Oak Rd Houston, TX 77045 United States of America

📧 Email: support@newconsciousnessfoundation.com 🌐 Website: https://fundacionnuevaconsciencia.com/app/ardilupa/

We will endeavor to respond to all legitimate inquiries within a reasonable time and, where applicable law mandates specific response timeframes, within such mandated timeframes.

Parent company: Carnegie Corporation S.A. (a Paraguayan corporation)

This Privacy Policy is published in compliance with the Google Play Store Developer Program Policies (2026 edition), the Children's Online Privacy Protection Act (COPPA), the General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) — including Recital 30 regarding strictly necessary technical state, the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act (CCPA/CPRA), the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados, Law No. 13.709/2018, LGPD), the ePrivacy Directive (Directive 2002/58/EC as amended) — including Article 5(3) regarding terminal-equipment storage, the Americans with Disabilities Act (ADA), the European Accessibility Act (Directive (EU) 2019/882, EAA), the European Union Artificial Intelligence Act (Regulation (EU) 2024/1689), and other applicable privacy, data protection, accessibility, and consumer protection laws.

© 2026 New Consciousness Foundation USA LLC. All rights reserved.