🇺🇸 Official English Version 🇲🇽 Ver versión en Español →

Privacy Policy

Last updated: October 3, 2026

COMPREHENSIVE PRIVACY POLICY

Last Updated: October 3, 2026

I. PREAMBLE

This document constitutes the Comprehensive Privacy Policy (hereinafter, the “Policy”) issued by ADAN ESAU LUNA CONTRERAS (hereinafter, the “Data Controller”), as the developer and operator of the “Dulce Halloween” mobile application and platform (hereinafter, the “Application” or “Platform”). This Policy is established in strict compliance with Mexico’s Federal Law on Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares – LFPDPPP), its secondary regulations, as well as internationally recognized data protection principles (including the Children’s Online Privacy Protection Act – COPPA, CalOPPA, and US state privacy regulations). Acceptance of this Policy through registration and continued use of the Application constitutes a valid agreement governing personal data processing between the user (the “Data Subject”) and the Data Controller.

II. DEFINITIONS

For the interpretation of this Policy, capitalized terms shall have the meanings attributed to them under Article 2 of Mexico’s LFPDPPP and applicable international data protection standards.

III. DATA CONTROLLER IDENTITY, ADDRESS, AND CONTACT CHANNELS

The entity responsible for processing your Personal Data is ADAN ESAU LUNA CONTRERAS, with official legal address for notifications at: LIBERTAD #25, SAN MARTIN TEPETLIXPAN, 54763 CUAUTITLAN IZCALLI, Estado de México, MEXICO. Data processing is conducted with the operational assistance of our data processor, Abo Digital Media, S.A. de C.V.

Official Contact Channels:

IV. PERSONAL DATA PROCESSED AND MEANS OF COLLECTION

The Data Controller processes the following categories of Personal Data, collected through the means detailed below:

4.1. Data Provided Directly by the Data Subject:

  • Identification & Content: Full name, email address, physical address or neighborhood of the property to be registered, as well as voluntary audiovisual content generated and uploaded by the Data Subject (such as photographs, videos, yard displays, and descriptions captured via the device camera and microphone).

4.2. Data Collected via Third-Party Authentication Services:

  • If the Data Subject chooses to register or log in using third-party single sign-on services (e.g., Google, Apple, Facebook), we collect the email address and profile name associated with that service to link it to the Application profile.
  • Facebook Data Deletion Request (Instrucciones para la Eliminación de Datos de Facebook): If you signed in using Facebook, you can request the deletion of all data associated with that authentication by emailing [email protected] with the subject “Facebook Data Deletion Request” or by revoking access directly via Facebook Settings → Apps and Websites → Dulce Halloween → Remove. We will process and confirm your data deletion request within a maximum of 30 calendar days.

4.3. Data Collected Automatically via Electronic and Technical Means: When interacting with the Application, the following technical data is collected automatically to ensure service stability, security, navigation, and continuous improvement:

  • 3.1. Geolocation Data: Precise (derived from GPS) and approximate (derived from cellular and Wi-Fi networks) device location is accessed strictly when the Application is in the foreground and actively in use by the Data Subject.
  • 3.2. Network and Connectivity Data: Network connection status and Wi-Fi state are monitored to ensure data synchronization and core app performance. IP addresses are processed to estimate geographic location, diagnose connectivity errors, and prevent fraudulent activity.
  • 3.3. Advertising Identifiers and APIs:
    • Advertising ID: We access device advertising identifiers (Google AAID on Android, Apple IDFA on iOS), which are unique, user-resettable identifiers used for aggregated analytics and ad delivery.
    • Advertising Services APIs: We utilize application programming interfaces (APIs) such as AdServices (Custom Audience, Topics, Attribution) and AdID to measure campaign effectiveness, track app install attribution, and segment audiences in a privacy-preserving manner.
    • Play Install Referrer API: Used to identify the installation source campaign or partner link.
  • 3.4. Technical Device and Operating System Data: Device model, manufacturer, operating system version, screen resolution, and preferred system language. Permissions to run foreground services and manage wakelocks are utilized to maintain smooth user experiences, countdown alerts, and real-time trick-or-treat notifications.
  • 3.5. Storage and Hardware Control: Read permissions for shared media storage (to allow the Data Subject to select existing photos for home registration or contest submissions) and silent background data fetching for map updates. Device vibration control is used for tactile haptic feedback.

V. PURPOSES OF DATA PROCESSING

  1. A) Primary and Necessary Purposes:
  • Application Operation & Mapping: Registering, managing, and displaying public Halloween map pins and participating addresses in real-time.
  • Technical Performance & Optimization: Ensuring OS compatibility, optimal app speed, map tile rendering, and crash resolution.
  • Seasonal Digital Promotion: Featuring selected neighborhood community displays and contest submissions on official social channels.
  • Contest Management: Verifying submissions, running anti-fraud audits on votes, and publishing winners in the Hall of Fame.
  • Security & Fraud Prevention: Analyzing device identifiers and IP addresses to monitor and prevent botting, malicious activity, and map vandalism.
  • Billing & License Management: Verifying installation legitimacy via Google Play Licensing and processing in-app purchases through official App Store / Google Play billing APIs.
  • Account Administration & Customer Support.
  1. B) Secondary Purposes (Optional):
  • Advertising Personalization & Marketing: Displaying relevant, family-friendly seasonal advertisements.
  • Aggregated Analytics: Analyzing anonymous aggregate usage trends to improve future app seasons.

VI. OBLIGATIONS AND WARRANTIES OF THE DATA SUBJECT

The Data Subject warrants that all information provided is accurate and truthful, and that they possess all legal rights and authorizations for any media uploaded to the Application.

VII. INTELLECTUAL PROPERTY OVER USER CONTENT

The Data Subject retains all intellectual property rights in their uploaded photos and videos. However, they grant the Data Controller a non-exclusive, royalty-free, worldwide license to reproduce and publicly display such content solely for the operation and promotion of the Platform and contests as described herein.

VIII. DATA STORAGE AND RETENTION PERIODS

Personal Data is retained for an active period of up to one (1) year following collection or the Data Subject’s last active interaction, after which it is securely deleted, purged, or irreversibly anonymized.

IX. EXERCISE OF PRIVACY RIGHTS (ARCO & CONSENT REVOCATION)

The Data Subject has the right to Access, Rectify, Cancel, or Oppose (ARCO Rights) the processing of their Personal Data, as well as revoke consent previously granted. Requests can be submitted via email to:

[email protected] or [email protected]

Requests must include: (i) user’s name and registered email; (ii) copy of official ID; (iii) clear description of the right being exercised. Requests are addressed within 20 business days.

Facebook Data Deletion Request: If you signed in using Facebook, you can request the deletion of all data associated with that authentication by emailing [email protected] or by revoking access directly via Facebook Settings → Apps and Websites → Dulce Halloween → Remove. We will process and confirm your request within a maximum of 30 calendar days.

X. SECURITY BREACH NOTIFICATION PROTOCOL

In the unlikely event of a security breach significantly impacting the rights of Data Subjects, the Data Controller will immediately notify affected users via email and registered push notification so preventative measures can be taken.

XI. THIRD-PARTY LINKS

The Application and Website may contain links to external third parties (sponsors, retailers, social networks). This Privacy Policy applies solely to Dulce Halloween. We encourage users to review the privacy policies of any third-party websites visited.

XII. MODIFICATIONS TO THE PRIVACY POLICY

The Data Controller reserves the right to amend this Privacy Policy to reflect legal, regulatory, or operational updates. All changes will be notified within the Application and published on this website with the corresponding “Last Updated” date.

XIII. GOVERNING LAW AND JURISDICTION

For interpretation and compliance, this Policy is governed by the laws of the United Mexican States, submitting to the competent courts of the City of Monterrey, Nuevo León, Mexico, without prejudice to applicable international consumer data protections.

XIV. EXPRESS CONSENT AND FINAL ACKNOWLEDGMENT

By checking the acceptance box during registration or by actively using the Platform, the Data Subject expressly acknowledges having read, understood, and consented to all provisions of this Privacy Policy.