Vandro Privacy Policy

Vandro is operated by [LEGAL ENTITY NAME] (“Vandro”, “we”, “us” or “our”).

This Privacy Policy explains how we collect, use, store and share information when you use the Vandro mobile application, website and related services.

Vandro provides location-based, AI-powered travel experiences and tours. Because location is fundamental to the service, some of the information we process may include your current location and information about tours you plan or take.

1. Information we collect

Account information

You need a Vandro account to purchase and experience a tour.

Authentication is provided using Auth0. Depending on how you create and use your account, we may receive information such as:

• your name;
• email address;
• account identifier;
• authentication information and status; and
• information associated with the security and operation of your account.

We do not receive or store your Auth0 password.

Location information

With your device's permission, Vandro may collect your location:

• when you plan a tour;
• while you are taking a tour;
• when location is required to identify places, attractions or routes around you; and
• when necessary to provide location-based features within the app.

Location information associated with a tour may be stored in your Vandro account and systems.

You can control Vandro's access to location through your device settings. Restricting location access may prevent some features of Vandro from working correctly.

Tour and usage information

We collect information about how Vandro is used, which may include:

• tours purchased, planned or taken;
• places or points of interest included in a tour;
• tour progress;
• dates and times at which features are used;
• interactions with features within Vandro; and
• technical information needed to operate and improve the service.

Subscription and purchase information

Subscriptions and payments are processed through Apple's App Store.

Vandro does not receive your full payment-card details.

We may receive information from Apple concerning your purchases and subscription status, such as the product purchased, transaction identifiers, subscription entitlement and whether a subscription is active or has expired.

Technical, analytics and diagnostic information

We collect technical information relating to the operation of the app and our services. This may include:

• device and operating-system information;
• app version;
• performance information;
• network and service errors;
• crash information;
• diagnostic logs;
• approximate usage information; and
• identifiers used to associate technical events with a session or account where necessary.

We use Microsoft Azure Application Insights and Apple-provided diagnostics and metrics to help us identify errors, monitor performance and improve Vandro.

Support communications

If you contact us for support, we will process the information you provide to us and information relating to your account or activity where necessary to investigate and respond to your request.

User-generated content

Vandro does not currently provide functionality for users to upload or publish photos, videos, audio, reviews or other user-generated content.

2. How we use your information

We use personal information where necessary to provide and operate Vandro, including to:

• create, secure and administer your account;
• confirm your subscription and purchases;
• plan and provide tours;
• determine your location during a tour;
• provide mapping, routing and location-based functionality;
• generate AI-powered tour information and experiences;
• remember and display tours associated with your account;
• provide customer support;
• detect and diagnose faults;
• maintain the security and reliability of the service;
• understand how Vandro is being used;
• develop and improve Vandro and its tours;
• analyse service performance and usage patterns;
• produce benchmarking and aggregate insights; and
• comply with applicable legal and regulatory requirements.

Where applicable, we rely on one or more of the following legal bases for processing personal information:

• performance of a contract, where processing is necessary to provide the Vandro services you have requested;
• legitimate interests, including operating, securing, supporting, analysing and improving Vandro;
• consent, where applicable, including permissions controlled through your device; and
• legal obligations, where we are required to retain or process information by law.

3. Location data and anonymised insights

Location data is an important part of Vandro.

We may analyse location and tour information to understand matters such as how tours are used, which locations are popular, how users move through tours and how Vandro can be improved.

We may also convert this information into aggregated or anonymised information for purposes including:

• product development;
• service improvement;
• benchmarking;
• understanding travel and tour trends;
• business analysis; and
• marketing Vandro.

For example, we may use aggregated information showing that a particular attraction or tour area is popular without identifying the individuals who visited it.

Where we describe information as anonymised, we mean that it has been processed so that it can no longer reasonably be associated with an identifiable individual.

We do not use identifiable precise location history to advertise directly to you or sell your location history to advertisers.

4. Artificial intelligence

Vandro uses artificial intelligence to create and deliver aspects of the tour experience.

Information necessary to generate AI-powered content may be processed using services provided by:

• OpenAI; and
• Microsoft Azure, including Azure-hosted AI services where applicable.

Information sent to these services may include contextual information necessary to provide a tour, such as locations, places of interest and the information required to generate the relevant experience.

We aim to minimise the personal information included in AI requests and do not intentionally send information to AI providers that is not necessary to provide or improve the relevant feature.

5. Maps and location services

Vandro uses Google Maps Platform to provide mapping, location, route and related geographical functionality.

When you use features powered by Google Maps, information necessary to provide those features may be processed by Google in accordance with Google's applicable terms and privacy practices.

6. Service providers

We use third-party service providers to operate Vandro. These currently include providers supporting:

• authentication: Auth0;
• cloud hosting and infrastructure: Microsoft Azure;
• artificial intelligence: OpenAI and Microsoft Azure;
• mapping and location services: Google Maps Platform;
• application monitoring and diagnostics: Microsoft Azure Application Insights;
• device crash and performance information: Apple; and
• subscriptions and payments: Apple App Store.

These providers may process information on our behalf or, in some circumstances, as independent controllers under their own privacy terms.

We require service providers acting on our behalf to process information only for appropriate purposes and subject to suitable protections.

7. Do we sell personal information?

We do not sell your personal information.

We do not sell identifiable location histories to data brokers, advertising networks or other third parties.

We may use or disclose aggregated or genuinely anonymised information that does not identify individual users.

8. How long we keep information

We do not keep personal information indefinitely.

Different categories of information are retained for different periods depending on why they are needed.

As a general approach:

• account information is retained while your account remains active and may subsequently be retained where necessary for legal, regulatory, security or dispute-resolution purposes;
• records relating to purchases and subscriptions may be retained for up to six years where necessary for accounting, legal or contractual purposes;
• identifiable tour and location information will normally be retained for up to 24 months after the relevant tour;
• after that period, useful tour or location information may only be retained in genuinely anonymised form where it can no longer reasonably be linked back to an identifiable user;
• operational, application and diagnostic telemetry is generally retained for substantially shorter periods appropriate to monitoring and troubleshooting the service;
• support records are retained for as long as reasonably necessary to resolve and record the relevant issue; and
• information that has been genuinely anonymised may be retained for longer periods because it can no longer be associated with an identifiable individual.

We periodically review the information we hold and may delete or anonymise it sooner when it is no longer required.

9. International processing

Vandro uses technology providers that operate internationally.

As a result, personal information may be processed in countries other than the country in which you live.

Where data protection law requires safeguards for international transfers of personal information, we will use appropriate mechanisms intended to protect that information.

10. Security

We use technical and organisational measures designed to protect information against unauthorised access, alteration, disclosure or loss.

These include the use of established cloud and identity platforms, access controls and security measures appropriate to the nature of the information being processed.

No internet-connected service can guarantee absolute security.

11. Your choices and rights

Depending on where you live, you may have rights concerning your personal information. These may include the right to:

• request access to information we hold about you;
• request correction of inaccurate information;
• request deletion of your information;
• restrict certain processing;
• object to certain processing;
• receive certain information in a portable format;
• withdraw consent where processing is based on consent; and
• complain to an applicable data-protection regulator.

You can also control Vandro's access to device capabilities such as location through the privacy settings on your device.

To exercise a privacy right, contact us at [PRIVACY EMAIL ADDRESS].

We may need to verify your identity before processing certain requests.

12. Deleting your Vandro account

You can initiate deletion of your Vandro account directly from within the Vandro app.

Account deletion will remove or anonymise personal information associated with your account unless we need to retain particular information for legal, accounting, fraud-prevention, security or dispute-resolution purposes.

Deleting Vandro from your device does not, by itself, delete your Vandro account.

If you have an active App Store subscription, deleting your Vandro account may not automatically cancel that subscription. Subscriptions can be viewed and managed through your Apple account and App Store subscription settings.

13. Children's privacy

Vandro is not specifically designed or directed at children.

[CONFIRM MINIMUM AGE / APP STORE AGE POSITION BEFORE PUBLICATION.]

If we become aware that personal information has been collected in circumstances where parental or guardian consent was legally required and was not obtained, we will take appropriate steps to delete that information.

14. Changes to this Privacy Policy

We may update this Privacy Policy as Vandro develops, including where we introduce new features, providers or ways of processing information.

When we make material changes, we will provide appropriate notice, which may include notice within the Vandro app or on our website.

The effective date at the top of this policy indicates when it was last updated.

15. Contact us

The controller responsible for Vandro is:

[LEGAL ENTITY NAME]
[REGISTERED / CONTACT ADDRESS]
[COUNTRY]

Privacy enquiries: [PRIVACY EMAIL ADDRESS]

If you are in the United Kingdom and are dissatisfied with how we handle your personal information, you may also have the right to complain to the UK Information Commissioner's Office or another relevant supervisory authority.

Open your privacy choices