Privacy Policy

1. Introduction

1.1 About This Policy

This Privacy Policy (“Policy”) describes how Urticad Tech Ltd (“Company”, “we”, “us”, “our”) collects, uses,
and protects information in connection with the ILR Tracker mobile application (“App”, “Application”).

1.2 Our Commitment

We are committed to protecting your privacy and handling your data in an open and transparent manner. This
App is designed with privacy as a core principle — your travel data uses on-device primary storage. Optional private iCloud recovery on iOS, Android system backup and user-initiated exports may retain copies outside the device under your platform settings and choices. Travel data is not sent to Urticad’s billing or purchase-verification service.

1.3 Legal Basis

This Policy complies with:

• UK GDPR (UK General Data Protection Regulation) & DPA 2018
• EU GDPR (General Data Protection Regulation 2016/679)
• California Consumer Privacy Act (CCPA) / California Privacy Rights Act
  (CPRA)
• COPPA (US children’s privacy)
• Apple App Store Guidelines
• Google Play Store Policies

2. Data Controller

For the purposes of applicable data protection laws, the data controller is:

3. Information We Collect

3.1 Data Stored Locally on Your Device

3.2 Data We Do NOT Collect

We explicitly DO NOT collect:

• Passport numbers or details
• BRP card numbers
• National Insurance numbers
• Home Office reference numbers
• Biometric data
• Payment-card details or bank-account credentials
• Precise location data
• Contacts or address book
• Photos or documents uploaded to our servers for purchase verification
• Health data
• Browsing history

3.3 Optional Data Collection

Currently, the App does not collect any analytics. If we implement analytics in the future, we will:

• Update this Privacy Policy
• Request your explicit consent
• Provide opt-out mechanisms
• Only collect anonymized, aggregated data

3.4 Support Communications

If you contact us for support, we may collect:

• Your email address
• The content of your communications
• Screenshots or logs you voluntarily share

This data is used solely to provide support and is retained only as long as necessary.

3.5 Website Briefings

If you ask to receive Urticad website briefings, we process your email address, selected topics, confirmation
status, consent version, source page and limited campaign attribution to send the briefings you chose and to
maintain suppression records. We use Resend as our email delivery processor. You can change topics or
unsubscribe without an account using the link in each email. We retain suppression evidence so an automated
process does not add you again without fresh affirmative consent. Contact wangyal@urticad.com to exercise your data rights.

4. Lifetime Access & App Store Terms

4.1 Lifetime Pricing

Release status — 7 October 2026: Android 1.18 is publicly available on Google Play, with a free download and a one-off £0.99 Lifetime Access purchase in the UK. iOS 1.49 is publicly available on the App Store, with the same free-download and UK £0.99 Lifetime Access purchase model. The lifetime purchase, restoration, code redemption and purchase-verification provisions below apply to Android 1.18 and iOS 1.49; they do not add a purchase requirement or a verification request to the preceding free editions.

ILR Tracker is free to download. Lifetime Access is a one-time in-app purchase of £0.99 in the UK;
other storefronts use the local price shown before purchase. There is no recurring subscription,
automatic renewal or timed trial in this release. Purchases and codes restore within the relevant store
account; Apple and Android licences are separate.

4.2 Purchase Verification

On iOS, Apple StoreKit verifies transactions and redemption results. The App stores access locally;
it does not send Apple purchase details to an Urticad verification server.

On Android, the App sends its package and product identifiers, Google Play purchase token and a fresh
request nonce over HTTPS to our Cloudflare-hosted verification service. The service checks the purchase
state with Google, acknowledges eligible purchases and returns a signed access proof. Purchase status,
refund and revocation information is processed only to manage access.

The verification service does not receive travel records, visa details, documents, payment-card details
or your store password. Cloudflare processes the network IP address to deliver and rate-limit requests.
We do not keep request-body logs or a purchase-token database. Purchase checks are processed temporarily;
a verified access state is retained locally so the App can work offline. Google and Cloudflare process
service data under their own retention and security policies.

4.3 Terms of Use (EULA)

By using our mobile applications, you also agree to the applicable platform terms:

4.4 Payment Data

All payments are processed by Apple or Google. We do not directly collect, store, or have access to your
payment card details or financial account information.

5. How We Use Information

5.1 Local Data Usage

Your local data is used exclusively to:

• Calculate days in/out of the UK
• Display compliance status
• Generate reports (PDF/CSV)
• Provide calendar visualization
• Send local notifications (with your permission)

5.2 Support Data Usage

Support communication data is used to:

• Respond to your inquiries
• Troubleshoot technical issues
• Improve our services

5.3 Website Briefing Use

We use website briefing information to confirm your request, send only the topics you selected, provide topic
and unsubscribe controls, and maintain suppression records.

6. Data Sharing

6.1 We Do NOT Sell Your Data

6.2 Limited Sharing Scenarios

We may share data only in these circumstances:

6.3 Third-Party SDKs

Our mobile apps may include the following third-party services:

6.4 Purchase Verification Processor

Cloudflare provides the Android verification endpoint and Google provides the authoritative purchase
status. These services process the limited purchase and network data described in section 4.2.
See Cloudflare Privacy Policy
and Google Privacy Policy.

6.5 Data Export by You

When you export data (CSV/PDF), you are responsible for securing and handling that exported data.

6.6 Website Briefing Processor

Resend processes the email and delivery information needed to send Urticad website briefings on our behalf.

7. Data Security

7.1 Security Measures

We implement appropriate technical and organizational measures to protect your data:

• Platform Protection: The App uses operating-system protected storage and iOS Keychain for saved purchase access
• Local Storage: Travel data stored locally using platform-native secure storage
• Scoped Transmission: Android purchase verification uses HTTPS; travel records are not sent to the billing service
• App Lock: Optional password and biometric protection for app access
• Secure Development: Following Apple and Google security best practices

7.2 Your Security Responsibilities

You are responsible for:

• Keeping your device secure
• Using strong device passcodes
• Enabling App password protection if desired
• Backing up your data regularly
• Securing exported files

8. Data Retention

8.1 Local Data

Your travel data is retained on your device until you:

• Delete individual records
• Clear all data from settings
• Delete the App

8.2 Support Communications

• Active support cases: Until resolved
• Resolved cases: Up to 24 months for quality assurance
• After retention period: Securely deleted

8.3 Website Briefing Retention

We retain consent, confirmation and suppression evidence as needed to honour your choices and to prevent an
automated process from adding a suppressed address again without fresh affirmative consent.

9. Your Rights

9.1 Rights Under UK GDPR and EU GDPR

9.2 Rights Under California Law (CCPA/CPRA)

If you are a California resident:

• Right to Know – What data we collect and how it’s used
• Right to Delete – Request deletion of your data
• Right to Correct – Request correction of inaccurate data
• Right to Opt-Out – Opt out of sale of personal information (we do not sell data)
• Right to Non-Discrimination – Not be discriminated against for exercising rights

9.3 How to Exercise Your Rights

Since your data is stored locally on your device:

• Access/Export: Use the App’s export feature
• Correction: Edit records directly in the App
• Deletion: Delete records or clear all data in Settings

For support-related data or other requests, email wangyal@urticad.com. We will respond within 30 days (UK/EU) or 45
days (California).

9.4 Website Briefing Choices

You can change your selected topics or unsubscribe without an account using the link in each briefing email.
Contact wangyal@urticad.com to exercise your data rights.

10. Data Deletion Requests

To request deletion:

• In-app: Use the data management options in the App’s Settings
• Email: Send a request to wangyal@urticad.com
  with the subject line “Data Deletion Request”

Upon receiving a verified deletion request, we will:

• Delete or anonymise your personal data within 30 days
• Confirm deletion via email

11. Children’s Privacy

The App is not intended for users under 16 years of age (UK/EU) or under 13 years of age (US). We do not
knowingly collect data from children. If you believe a child has provided us with personal information,
please contact us at wangyal@urticad.com.

12. Cookies & Tracking

As a mobile application, ILR Tracker does not use cookies. We do not integrate third-party tracking services,
advertising networks, or analytics platforms.

13. International Data Transfers

Travel records are not sent to our purchase-verification service. Optional Apple iCloud recovery,
Android system backup and user-directed exports are managed by their respective platforms or by you.
Google and Cloudflare may process purchase and network data internationally under their applicable
safeguards. Support communications may be processed in the United Kingdom.

14. Changes to This Policy

We will notify you of material changes by:

• In-app notification
• Updating the “Last Updated” date
• For app users, through an app update where practicable

Your continued use of the App after changes constitutes acceptance of the updated Policy.

15. App Store Privacy Disclosures

15.1 Apple App Store Privacy Nutrition Labels

In accordance with Apple’s requirements:

The iOS App does not send travel or purchase data to an Urticad server. Apple manages StoreKit and optional
iCloud recovery. Android uses the limited purchase-verification processing described in section 4.2;
its Google Play Data safety disclosure is separate from Apple’s label. Neither app uses purchase data
for advertising or tracking.

15.2 Categories of Personal Information (CCPA)

16. Supervisory Authority

16.1 UK Users

You have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113

16.2 EU/EEA Users

You may lodge a complaint with your local Data Protection Authority.

16.3 California Users

You may contact the California Attorney General’s Office:

• Website: oag.ca.gov/privacy

17. Contact Us

For any questions about this Privacy Policy or our privacy practices: