Privacy Policy

This document explains what personal data Santino processes, for what purpose, with whom it is shared and what rights the user has over it.

Last revised: November 14, 2026

1. Who the controller is

Anderson Alvarado, resident in Colombia, and Federico Hochreuter, resident in Switzerland (hereinafter jointly “the Controllers”), are the controllers of the personal data collected through the Santino app (hereinafter “the App”) and the website appsantino.com.

Any reference to “we” or “us” shall be understood as a reference to the Controllers. The contact channel for any matter relating to personal data is f.hochreuter@gmx.ch.

2. Scope

This Policy applies to the personal data processed when someone uses the App or visits the website, whether or not they have an account. It does not apply to third-party services to which the App may link, which are governed by their own policies.

3. Users in different countries

The Controllers reside in Colombia and in Switzerland, and the App is available to people residing in different countries. The safeguards described here apply equally to all users, regardless of where they reside.

Where the law of the user’s country of residence grants them broader rights than those provided for in this document—as is the case with the General Data Protection Regulation (GDPR) in Europe and the United Kingdom, the Swiss Federal Act on Data Protection (FADP), California legislation, or the habeas data laws of Latin American countries, including Colombia’s—that law shall prevail, and the Controllers will honor the right on the terms it establishes.

4. What we do not do

•We do not sell personal data or transfer it for commercial purposes.

•We do not show advertising or share data with advertising networks.

•We do not track the user’s activity outside the App or combine it with their activity on other services.

•We do not use third-party analytics tools. If any are ever introduced, this will be announced here in advance.

5. What data we process

Only the data necessary to provide the service:

•Email address, to create the account and send the sign-in code. The App does not use passwords.

•Profile data, all optional except the name: photo, telephone number, date of birth, sex, a short description, language and parish.

•Activity within the App: saved prayers, progress in the daily routine, scores, and which content the user shares (not with whom or through which app).

•Content the user proposes: prayers—together with the audio they record when proposing them, if they do so—as well as parishes, missions and retreats submitted for review, and the corrections they suggest to those already published.

•Comments and ratings the user posts about parishes, missions, retreats and companions, which other users see together with the user’s name and photo.

•Conversations with the AI assistant, if the user uses it, which are kept so that they can be resumed.

•Reports of content or users, the list of users the user blocks, and the messages they send us, by email or from the App.

•Requests for spiritual accompaniment: with whom, when, and whatever the user writes when making them.

•Premium subscription data, if the user takes out the subscription: the plan, the store through which it was purchased, its status and its dates, and the notification of each charge as forwarded by RevenueCat (product, price, currency, country of the store account and transaction identifiers). We never receive payment data: it is processed by Apple or Google.

•Minimal technical data: date of the last connection and server logs with the IP address and errors, used to operate the service and detect abuse.

If the user signs in with a Google or Apple account, we receive from them only the email address and the account identifier. Never their password.

Preferences that only affect the phone, such as the daily reminder for saved prayers and its time, are stored on the device itself and do not reach us.

6. What we use it for

•Creating the account and enabling password-free sign-in.

•Operating the sections of the App: liturgical calendar, Bible, catechism, prayers, map of parishes and missions, formation content and the assistant.

•Keeping what the user saves and synchronizing it across devices: favorites, progress and conversations.

•Reviewing and, where appropriate, publishing proposed content, and informing the user of the outcome.

•Moderating: handling reports, removing content contrary to the Terms, and preventing abuse, impersonation and spam.

•Checking whether the account has an active subscription.

•Responding to questions and complaints, and complying with legal obligations.

No automated decisions producing legal effects concerning the user are made, and no profiles are built for commercial purposes.

7. Legal basis

Processing is based on the performance of the contract the user accepts by using the service, with regard to the data necessary to provide it; on the user’s consent, with regard to the optional profile data and access to location; on the Controllers’ legitimate interest in keeping the service secure; and on compliance with legal obligations.

Consent may be withdrawn at any time, without retroactive effect, by the means set out in clause 12.

8. Location

Location is used for a single purpose: to show nearby parishes, missions and retreats. The user provides it, either by granting the phone’s permission or by marking a point manually on the map. If the user does not provide it, the map still works without centering on their position.

When the user proposes a place, the location of that place is published, not the user’s own.

9. The AI assistant

If the user uses the assistant, their queries are sent to Amazon Bedrock, the artificial intelligence service of Amazon Web Services, which generates the response. Under that provider’s terms, these conversations are not used to train its models.

The assistant can make mistakes. It is not a priest, it is not confession and it does not replace spiritual direction. We recommend not sharing with it any information the user does not want to be recorded.

10. Who we share it with

Only with the providers that make the service work, and with each one only what it needs:

•Amazon Web Services: hosting, database, file storage, access management, sending the emails with the code, and the AI assistant.

•Google and Apple: if the user chooses to sign in with their accounts; as distributors of the App in their stores; and as the parties that charge for the Premium subscription, which is paid through the App Store or Google Play.

•RevenueCat: validates Premium subscription purchases. It receives the purchase receipt issued by the store and a pseudonymous identifier of the Santino account—not the name or the email address—and uses them to confirm to us whether the subscription is active.

•Google, in addition: draws the map and places on it the address the user enters when proposing a place (Google Maps), and delivers notifications to the phone (Firebase Cloud Messaging). For the map, it receives the area being viewed; for notifications, a device identifier and the notification sent to it.

Data will also be disclosed when a competent authority legally requires it. Apart from these cases, it is not shared with anyone.

11. Where it is processed

The infrastructure is hosted in the United States, so the data is processed there. For users residing outside that country, this involves an international transfer; the providers mentioned offer the contractual safeguards customarily required for this type of transfer, including standard contractual clauses where applicable.

12. User rights

At any time, the user may:

•Access the personal data we process about them.

•Rectify or complete it from their profile in the App.

•Request deletion of their account and the associated data, from within the App or by email, as set out in clause 13.

•Request a copy of their data in a commonly used format.

•Object to a specific processing activity or request its restriction.

•Withdraw any consent they have given.

Exercising these rights is free of charge and is requested by writing to f.hochreuter@gmx.ch from the email address associated with the account. We respond within thirty days at most. Exercising them never results in worse treatment in the service.

If the user considers that their data has not been processed correctly, they may turn to the data protection authority of their country.

13. How long we keep it

For as long as the account remains open. Once the deletion request has been submitted—from within the app, under Profile → Delete my account, or by email—the account is blocked immediately, and the profile, the photo and the associated personal data are deleted after thirty days.

Those thirty days are a grace period, not an administrative delay: if the user signs in again during that time—by email, with Google or with Apple—the request is automatically cancelled and nothing is deleted; to carry it out, they would have to request it again. Once the period has elapsed without them signing in again, the deletion is carried out and can no longer be undone.

Content the user contributed that has already been published—a prayer, a parish—may remain in the App without their name or photo, as it forms part of the community’s content and is used by other people. The user may request its complete removal in the same request. Missions and retreats organized in their name do not remain: they are deleted along with the account.

The minimum required by law, or what is necessary to handle an abuse report that is still open, will be kept for longer.

14. Security

Data travels encrypted via HTTPS and is stored encrypted. The database is not exposed to the internet, and access is limited to those who need it to operate the service. No system is infallible: if a breach affecting the user were to occur, it will be communicated to them and to the relevant authorities.

15. Minors

The App is suitable for the whole family, but it is not directed at children under the age of thirteen, and we do not knowingly collect their data. Minors must use it with the authorization of those who hold parental authority over them or act as their legal representatives. If an account belonging to a child under the age of thirteen is detected, it is cancelled and its data is deleted.

16. Changes to this Policy

We may modify this Policy to adapt it to changes in the law or in the service. Relevant changes are announced in the App and reflected in the revision date in the header. The version published at this address is always the one in force.

17. Contact

To exercise any of the rights above, request deletion of the account or ask about this Policy: f.hochreuter@gmx.ch.