Privacy Policy

1. Introduction

1.1 About This Policy

This Privacy Policy (“Policy”) describes how Urticad Tech Ltd (“Company”, “we”, “us”, “our”) collects, uses,
and protects information in connection with the ILR Tracker mobile application (“App”, “Application”).

1.2 Our Commitment

We are committed to protecting your privacy and handling your data in an open and transparent manner. This
App is designed with privacy as a core principle — your travel data stays on your device.

1.3 Legal Basis

This Policy complies with:

• UK GDPR (UK General Data Protection Regulation) & DPA 2018
• EU GDPR (General Data Protection Regulation 2016/679)
• California Consumer Privacy Act (CCPA) / California Privacy Rights Act
  (CPRA)
• COPPA (US children’s privacy)
• Apple App Store Guidelines
• Google Play Store Policies

2. Data Controller

For the purposes of applicable data protection laws, the data controller is:

3. Information We Collect

3.1 Data Stored Locally on Your Device

3.2 Data We Do NOT Collect

We explicitly DO NOT collect:

• Passport numbers or details
• BRP card numbers
• National Insurance numbers
• Home Office reference numbers
• Biometric data
• Banking or financial information
• Precise location data
• Contacts or address book
• Photos, camera, or microphone access
• Health data
• Browsing history

3.3 Optional Data Collection

Currently, the App does not collect any analytics. If we implement analytics in the future, we will:

• Update this Privacy Policy
• Request your explicit consent
• Provide opt-out mechanisms
• Only collect anonymized, aggregated data

3.4 Support Communications

If you contact us for support, we may collect:

• Your email address
• The content of your communications
• Screenshots or logs you voluntarily share

This data is used solely to provide support and is retained only as long as necessary.

3.5 Website Briefings

If you ask to receive Urticad website briefings, we process your email address, selected topics, confirmation
status, consent version, source page and limited campaign attribution to send the briefings you chose and to
maintain suppression records. We use Resend as our email delivery processor. You can change topics or
unsubscribe without an account using the link in each email. We retain suppression evidence so an automated
process does not add you again without fresh affirmative consent. Contact wangyal@urticad.com to exercise your data rights.

4. Subscriptions & App Store Terms

4.1 Subscription Pricing

ILR Tracker Pro offers flexible subscription plans:

4.2 Auto-Renewal

Subscriptions automatically renew at the same price unless cancelled at least 24 hours before the end of the
current billing period. Payment will be charged to your Apple ID or Google Play account upon purchase
confirmation. You can manage or cancel your subscription at any time in your App Store or Google Play
account settings.

4.3 Terms of Use (EULA)

By using our mobile applications, you also agree to the applicable platform terms:

4.4 Payment Data

All payments are processed by Apple or Google. We do not directly collect, store, or have access to your
payment card details or financial account information.

5. How We Use Information

5.1 Local Data Usage

Your local data is used exclusively to:

• Calculate days in/out of the UK
• Display compliance status
• Generate reports (PDF/CSV)
• Provide calendar visualization
• Send local notifications (with your permission)

5.2 Support Data Usage

Support communication data is used to:

• Respond to your inquiries
• Troubleshoot technical issues
• Improve our services

5.3 Website Briefing Use

We use website briefing information to confirm your request, send only the topics you selected, provide topic
and unsubscribe controls, and maintain suppression records.

6. Data Sharing

6.1 We Do NOT Sell Your Data

6.2 Limited Sharing Scenarios

We may share data only in these circumstances:

6.3 Third-Party SDKs

Our mobile apps may include the following third-party services:

6.4 Data Export by You

When you export data (CSV/PDF), you are responsible for securing and handling that exported data.

6.5 Website Briefing Processor

Resend processes the email and delivery information needed to send Urticad website briefings on our behalf.

7. Data Security

7.1 Security Measures

We implement appropriate technical and organizational measures to protect your data:

• Encryption: Sensitive data stored in iOS Keychain / Android Keystore is encrypted
• Local Storage: Travel data stored locally using platform-native secure storage
• No Transmission: Data is not transmitted over the internet
• App Lock: Optional password and biometric protection for app access
• Secure Development: Following Apple and Google security best practices

7.2 Your Security Responsibilities

You are responsible for:

• Keeping your device secure
• Using strong device passcodes
• Enabling App password protection if desired
• Backing up your data regularly
• Securing exported files

8. Data Retention

8.1 Local Data

Your travel data is retained on your device until you:

• Delete individual records
• Clear all data from settings
• Delete the App

8.2 Support Communications

• Active support cases: Until resolved
• Resolved cases: Up to 24 months for quality assurance
• After retention period: Securely deleted

8.3 Website Briefing Retention

We retain consent, confirmation and suppression evidence as needed to honour your choices and to prevent an
automated process from adding a suppressed address again without fresh affirmative consent.

9. Your Rights

9.1 Rights Under UK GDPR and EU GDPR

9.2 Rights Under California Law (CCPA/CPRA)

If you are a California resident:

• Right to Know – What data we collect and how it’s used
• Right to Delete – Request deletion of your data
• Right to Correct – Request correction of inaccurate data
• Right to Opt-Out – Opt out of sale of personal information (we do not sell data)
• Right to Non-Discrimination – Not be discriminated against for exercising rights

9.3 How to Exercise Your Rights

Since your data is stored locally on your device:

• Access/Export: Use the App’s export feature
• Correction: Edit records directly in the App
• Deletion: Delete records or clear all data in Settings

For support-related data or other requests, email wangyal@urticad.com. We will respond within 30 days (UK/EU) or 45
days (California).

9.4 Website Briefing Choices

You can change your selected topics or unsubscribe without an account using the link in each briefing email.
Contact wangyal@urticad.com to exercise your data rights.

10. Data Deletion Requests

To request deletion:

• In-app: Use the data management options in the App’s Settings
• Email: Send a request to wangyal@urticad.com
  with the subject line “Data Deletion Request”

Upon receiving a verified deletion request, we will:

• Delete or anonymise your personal data within 30 days
• Confirm deletion via email

11. Children’s Privacy

The App is not intended for users under 16 years of age (UK/EU) or under 13 years of age (US). We do not
knowingly collect data from children. If you believe a child has provided us with personal information,
please contact us at wangyal@urticad.com.

12. Cookies & Tracking

As a mobile application, ILR Tracker does not use cookies. We do not integrate third-party tracking services,
advertising networks, or analytics platforms.

13. International Data Transfers

Since all travel data is processed and stored locally on your device, there are no international transfers of
your travel data. For support communications, data may be processed in the United Kingdom with appropriate
safeguards in place.

14. Changes to This Policy

We will notify you of material changes by:

• In-app notification
• Updating the “Last Updated” date
• For app users, through an app update where practicable

Your continued use of the App after changes constitutes acceptance of the updated Policy.

15. App Store Privacy Disclosures

15.1 Apple App Store Privacy Nutrition Labels

In accordance with Apple’s requirements:

Data Not Collected: We do not collect any data from this App.

Data Not Linked to You: Any data used is not linked to your identity.

15.2 Categories of Personal Information (CCPA)

16. Supervisory Authority

16.1 UK Users

You have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113

16.2 EU/EEA Users

You may lodge a complaint with your local Data Protection Authority.

16.3 California Users

You may contact the California Attorney General’s Office:

• Website: oag.ca.gov/privacy

17. Contact Us

For any questions about this Privacy Policy or our privacy practices: