Join now

Privacy Policy

Last updated: 5 October 2026

1. Data controller

  • Controller: TOURYTELLER TECHNOLOGIES, S.L. (owner of the "Touryteller" brand and app)
  • Tax ID (CIF): B93893857
  • Registered office: Passatge de Sant Jordi, 15, 3º, 08915 Badalona (Barcelona), Spain
  • DPO email: dpo@touryteller.com
  • Website: https://touryteller.com

2. Purposes of processing

At Touryteller we process the personal data you provide for the following purposes:

  • User registration: manage your sign-up as a user of the Touryteller platform and mobile app, allowing you to access available services.
  • Bookings and service management: process your bookings of gamified urban routes and manage checkpoints, scores and content associated with your experience.
  • Location-based features: provide the map, route navigation and checkpoint validation features in the mobile app (see section 7).
  • Advertising: display advertising in the free version of the mobile app (see section 7).
  • Payment processing: process the purchases made in the app through a secure payment provider (see section 7).
  • Sign-in and authentication: allow you to create your account and sign in securely, including via Google and Apple (see section 7.4).
  • Media content: allow you to capture and attach photos and videos during the tours.
  • Marketing communications: send you information about new routes, promotions, events and Touryteller news, provided you have given prior consent.
  • Satisfaction surveys: send you surveys to learn your opinion about the services provided and improve platform quality.
  • Statistical studies: carry out aggregated and anonymised analyses on platform usage to improve our services.
  • User support: handle queries, requests or incidents you send us through enabled contact channels.
  • Compliance with legal obligations: respond to requirements from public administrations and comply with applicable regulations.

3. Legal basis for processing

The legal basis for processing your data depends on each purpose:

  • Performance of contract (Article 6(1)(b) GDPR): processing is necessary to provide the contracted services, including registration and sign-in, booking management, participation in gamified routes and payment processing.
  • Legitimate interest (Article 6(1)(f) GDPR): we carry out anonymised statistical studies and satisfaction surveys to improve our services. You may object to this processing at any time.
  • Consent (Article 6(1)(a) GDPR): certain processing is based on your express consent —marketing communications, access to geolocation and personalised advertising in the mobile app—, which you may withdraw at any time without affecting the lawfulness of prior processing.
  • Legal obligation (Article 6(1)(c) GDPR): processing of certain data is necessary to comply with tax, commercial and other obligations required from us.

4. Recipients of the data

In order to provide the service we communicate data to the following providers, which act as processors or, where so indicated, as independent controllers:

  • Stripe Payments Europe, Ltd. and Stripe, Inc. Payment processing and payouts to creators. Stripe receives your payment method details directly from the app. Touryteller does not store your full card number.
  • Mapbox, Inc. Maps, routes and conversion of coordinates into place names. It receives your device coordinates when you use the map or when the app needs to display the city or address corresponding to your position.
  • Google Ireland Ltd. and Google LLC. Firebase Authentication (identity), Firebase Cloud Messaging (push notifications), Google Sign-In (access with a Google account) and Google AdMob (advertising). As regards advertising, Google acts as an independent controller of the processing of advertising identifiers.
  • Meta Platforms Ireland Ltd. Meta SDK in the mobile app: measurement of installs and of the effectiveness of our advertising campaigns (see section 7.10).
  • Branch Metrics, Inc. Attribution of invitation links and shared links, so that when you open a link to a tour the app takes you to the right content even if you have just installed it.
  • Functional Software, Inc. (Sentry). Logging of app errors and crashes for diagnostic and stability purposes.
  • Resend (Plus Five Five, Inc.). Sending of transactional account emails, such as email address verification.
  • Apple Inc. When you choose to sign in with Sign in with Apple.

We do not sell your personal data, nor do we transfer it to third parties for purposes other than those described in this policy.

Providers of the touryteller.com website

The following processing activities relate to the touryteller.com website:

  • Google Analytics 4 (Google Ireland Ltd. / Google LLC): audience measurement and analysis of website usage.
  • Meta Pixel (Meta Platforms Ireland Ltd.): measurement of the effectiveness of the website's advertising campaigns.
  • CookieYes (CookieYes Ltd.): management of website cookie consent.

5. International data transfers

Some of our technology providers are located outside the European Economic Area. In all cases, we have adopted appropriate safeguards to protect your data:

  • Google (Google Drive, Google Analytics, Google AdMob, Firebase): United States. Adhered to the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023).
  • Mapbox, Inc.: United States. Standard Contractual Clauses (SCCs) approved by the European Commission.
  • Stripe (Stripe Payments Europe, Ltd. — Ireland; Stripe, Inc. — USA): the main processing takes place in the European Union; any transfers to the USA are covered by the EU-U.S. Data Privacy Framework and/or by Standard Contractual Clauses (SCCs).
  • Apple (Apple Inc.): United States. Adhered to the EU-U.S. Data Privacy Framework. Applies only if you sign in with your Apple ID.
  • Resend (Plus Five Five, Inc.): United States. Standard Contractual Clauses (SCCs) approved by the European Commission.
  • Branch Metrics, Inc.: United States. Standard Contractual Clauses (SCCs) approved by the European Commission.
  • Functional Software, Inc. (Sentry): United States. Standard Contractual Clauses (SCCs) approved by the European Commission.
  • Meta Platforms (Meta Platforms Ireland Ltd. / Meta Platforms, Inc.): United States. Adhered to the EU-U.S. Data Privacy Framework.

6. Data retention

We will keep your personal data for as long as necessary to fulfil the purpose for which it was collected:

  • Registration data: while you maintain an active account on the platform. Once cancellation is requested, the data will be blocked during the applicable legal periods.
  • Booking and payment data: during the validity of the contractual relationship and, afterwards, during legal prescription periods (5 years for personal actions, 4 years for tax obligations).
  • Location data: processed in real time to provide the service and not retained linked to your identity beyond what is necessary for the operation of the route (see section 7.1).
  • Marketing communications: until you withdraw your consent.
  • Browsing data and cookies: as indicated in our Cookie Policy.

7. Data processing in the mobile app

In addition to the processing described above, the Touryteller mobile app (available for iOS and Android) carries out the following specific processing:

7.1. Geolocation

  • Data processed: precise geographic location (GPS) of your device.
  • Purpose: show your position on the map, guide you along the gamified routes, validate your arrival at checkpoints, unlock content and challenges based on your proximity to points of interest, and display interactive maps.
  • When we access it: only while you are using the app (foreground use). The app does not track your location in the background or when you are not using it.
  • Legal basis: your consent (Article 6(1)(a) GDPR), which you grant by accepting the location permission requested by your device's operating system. You may withdraw it at any time from your device settings; in that case, some app features may no longer be available.
  • Maps provider: maps are generated using Mapbox (Mapbox, Inc.). To show you the map and your position, Mapbox may process your location and technical device data. You can read its privacy policy at mapbox.com/legal/privacy.
  • Retention: location data is processed in real time to provide the service and is not retained linked to your identity beyond what is necessary for the operation of the route, except in aggregated and anonymised form for statistical purposes.

7.2. Advertising and advertising identifiers

The app displays advertising through Google AdMob. These are rewarded, voluntary ads: they appear when you choose to watch them in exchange for an in-game benefit, such as recovering a life.

  • Data processed: the device advertising identifier (AAID on Android, IDFA on iOS), device identifiers, approximate IP address, technical device data and interaction with the ad.
  • Purpose: display advertising, measure its performance, limit the repetition of the same ad and prevent advertising fraud.
  • Disclosure to third parties: the advertising identifier is shared with Google and with its advertising partners, which process it for their own advertising and measurement purposes. You can consult the list of partners in the consent form that the app displays before the first ad.
  • Legal basis: your consent, Article 6(1)(a) GDPR.
  • Your control: before serving personalised advertising, the app displays Google's consent form (User Messaging Platform), where you can accept or refuse personalisation. If you refuse it you will still see ads, but not personalised ones. On iOS, Apple's tracking permission (App Tracking Transparency) is also requested before accessing the IDFA. You may revoke your decision at any time from your device settings, by resetting the advertising identifier on Android or withdrawing the tracking permission on iOS.

7.3. In-app payments

  • Payment provider: purchases made in the app are processed through Stripe (Stripe Payments Europe, Ltd. and Stripe, Inc.), a payment service provider compliant with the PCI-DSS security standard.
  • Data processed: the data needed to process the payment (amount, card or payment method details, and billing data) is processed directly by Stripe. Touryteller does not store your full card details.
  • Legal basis: performance of contract (Article 6(1)(b) GDPR) and compliance with legal obligations (Article 6(1)(c) GDPR).
  • More information: stripe.com/privacy.

7.4. Sign-in and authentication

We use Firebase Authentication (Google) to manage access to your account. You can register with an email address and password, with your Google account or with Sign in with Apple.

  • Data processed: email address, user identifier, name and username, profile picture if you add one, and the verification status of your email address.
  • Purpose: create and maintain your account, identify you across devices, recover access, communicate with you about your account and provide support.
  • Legal basis: performance of contract, Article 6(1)(b) GDPR.
  • Email verification: the verification email and all other messages relating to your account are sent through Resend.

We do not use Firebase Analytics, Crashlytics or Performance Monitoring.

7.5. Device permissions

The app requests the following permissions, always at the moment the corresponding feature needs them and always with the option to refuse them:

  • Foreground location: to place you on the map, validate the points of a tour and unlock content on arrival. We do not carry out background tracking.
  • Camera: to take photos that you add to your profile or to the tours you create.
  • Microphone: to record the audio narrations of the tours you create.
  • Photos and files: to select images, videos or audio files that you wish to upload. On Android 13 and above we use the system picker, which does not require access to your entire gallery.
  • Notifications: to notify you of news relating to your account and your tours.
  • Advertising tracking (iOS only): to access the IDFA if you accept personalised advertising.

You may revoke any of these permissions from your system settings. If you do, the associated feature will no longer be available, but the rest of the app will continue to work.

7.6. Push notifications

To send you notifications we use Firebase Cloud Messaging (Google).

  • Data processed: a device registration identifier (notification token), the operating system and the app version. That token is stored on our servers, associated with your account, so that the notification can be directed to the right device.
  • Purpose: notify you of news about your account, your tours and relevant activity within the app.
  • Legal basis: performance of contract as regards service notices, Article 6(1)(b) GDPR, and your consent as regards promotional communications, Article 6(1)(a) GDPR.
  • Your control: you may disable notifications at any time from your system settings. The token is deleted when you uninstall the app or delete your account.

7.7. Shared links and attribution

When you share a tour or open an invitation link we use Branch Metrics, Inc. so that the link takes you to the right content, even if you have to install the app first.

  • Data processed: device and installation identifiers, IP address, device model and operating system, and the specific link you have opened.
  • Purpose: resolve the link, attribute the invitation to whoever sent it and measure the performance of shared links.
  • Legal basis: your consent, Article 6(1)(a) GDPR. This functionality remains disabled until you accept the privacy notice that the app displays after you sign in.

7.8. Error diagnostics

To detect and fix faults we use Sentry (Functional Software, Inc.).

  • Data processed: the error report, app version, operating system, device model and a technical installation identifier. We have disabled the sending of personal data by default, so Sentry does not receive your IP address or your identity, and we do not collect performance data or navigation traces either.
  • Purpose: stability and security of the service.
  • Legal basis: legitimate interest in keeping the app operational, Article 6(1)(f) GDPR.

7.9. Content you upload and in-app activity

  • Content you upload: if you create tours you can upload photos, videos and audio recordings. That content is stored on our servers, associated with your account and, if you publish the tour, becomes visible to other users. It is also reviewed for moderation purposes before publication. Legal basis: performance of contract, Article 6(1)(b) GDPR.
  • Activity within the app: we record your progress in the tours, the searches you carry out within the app, the tours you save as favourites, the coins and rewards obtained and your purchase history.
  • Purpose: maintain your progress across devices, display rankings and rewards, recommend content to you, restore purchases and compile aggregated statistics on the use of the service.
  • Legal basis: performance of contract, Article 6(1)(b) GDPR, and legitimate interest in improving the service, Article 6(1)(f) GDPR. The personalisation of recommendations is based on your consent, Article 6(1)(a) GDPR, and you may withdraw it from the app settings.

Part of this activity, together with the advertising identifier, may be disclosed to Google AdMob on the terms described in section 7.2.

7.10. Measurement of installs and campaigns (Meta SDK)

The app integrates the Meta SDK (Meta Platforms Ireland Ltd.) to measure installs and the effectiveness of our advertising campaigns on Facebook and Instagram.

  • Data processed: the device advertising identifier (IDFA on iOS, only if you grant Apple's tracking permission; AAID on Android), app and installation identifiers, IP address, device model and operating system, and app usage events (install, app open and close, and purchases with their amount and currency).
  • Purpose: to know which campaigns generate installs and purchases, and to optimise our advertising spend.
  • Disclosure to third parties: Meta receives this data and may also process it for its own advertising and measurement purposes, in which case it acts as controller. On international transfers, see section 5.
  • Legal basis: your consent, Article 6(1)(a) GDPR. The SDK does not send any data until you accept the privacy notice that the app shows you; if you do not accept it, the app works in the same way.
  • Your control: you may withdraw your decision at any time from your device settings: by withdrawing the tracking permission on iOS or by resetting or deleting the advertising identifier on Android.

8. Rights of the data subject

As the data subject, you may exercise the following rights at any time:

  • Right of access: know what personal data of yours we are processing.
  • Right of rectification: request correction of inaccurate or incomplete data.
  • Right of erasure ("right to be forgotten"): request the deletion of your data when it is no longer necessary for the purpose for which it was collected.
  • Right to restriction of processing: request that we restrict the processing of your data in certain circumstances.
  • Right to portability: receive your data in a structured, commonly used and machine-readable format, and transmit it to another controller.
  • Right to object: object to the processing of your data, including profiling.
  • Right not to be subject to automated decisions: not be subjected to decisions based solely on automated processing, including profiling, that produce legal effects.

How to exercise your rights

You may exercise any of these rights by writing to dpo@touryteller.com from the email address associated with your account. You do not need to attach a copy of your ID or any other document: we verify your identity by writing back to that same address so you can confirm the request. Only if we have reasonable doubts about the identity of the person making the request may we ask for additional information to confirm it, in accordance with Article 12(6) of the General Data Protection Regulation. We will respond to your request within a maximum period of one month from receipt.

Account deletion. You can delete your account and the associated data from the app's own settings or at touryteller.com/en/delete-account, without needing to write to us or wait. Deletion is permanent. We will retain only the billing data that tax and commercial regulations oblige us to keep, for the periods indicated in section 6.

Complaints to the supervisory authority

If you consider that the processing of your personal data infringes current regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), based at C/ Jorge Juan, 6, 28001 Madrid, and website www.aepd.es.

9. Responsibility of the data owner

  • The user warrants that they are over 14 years of age and that the data provided is true, accurate, complete and up to date. The user shall be responsible for any damages they may cause to Touryteller or to third parties through providing false, inaccurate, incomplete or outdated data.
  • If the data provided belongs to a third party, the user warrants that they have informed said third party of the aspects contained in this policy and obtained their authorisation to provide their data.

10. Modifications to this policy

Touryteller Technologies, S.L. reserves the right to modify this Privacy Policy to adapt it to legislative or jurisprudential changes, as well as industry practices. In such cases, the modified policy will be published on this page indicating the date of the last update.

Last updated: 5 October 2026.