Privacy Policy

Last updated: September 2026

1. What we collect

Email address (only when you buy a pass or contact us), purchase records, anonymous usage analytics (pages visited, events like tour plays — collected via PostHog in the EU, without cookies that identify you personally), and suggestions/feedback you submit. If you use the app, we collect coarse location only to trigger tour narration while a tour is active — location is processed on your device and not stored.

2. Why we collect it

To identify your pass and unlock your tours, to process payments (handled by Stripe under their privacy policy), to understand how the product is used so we can improve it, and to respond when you contact us.

3. What we don't do

We don't sell your data. We don't run third-party advertising trackers. We don't send marketing emails — you'll only hear from us about a purchase you made or a message you sent.

4. Data retention and your rights

Purchase records are kept as long as needed for accounting and legal obligations. Analytics are retained in aggregate form. Under the GDPR you can request access to, correction of, or deletion of your personal data at any time — email [email protected] and we'll action it within 30 days.

5. Processors we use

Stripe (payments, USA/EU), Cloudflare (hosting and content delivery), PostHog (product analytics, EU region). Each processes data only on our instructions under a data processing agreement.

6. Changes

If this policy changes materially, we'll announce it on the website. This policy is governed by Spanish and EU law.