Privacy policy
This policy covers the website explora.tours and the Explora app. It informs you under Articles 13 and 14 GDPR about which personal data we process, for what purpose, on what legal basis and for how long.
This is a translation for convenience. The German version is the legally binding one.
1. Controller
Oliver Seib
Kühlwetterstraße 43
40239 Düsseldorf
Germany
Email: hallo@explora-tours.de
2. Principles
We process personal data only where it is necessary to operate the app and the website. The tours are deliberately built to work offline: after download, audio, map and puzzles live on your device. No location data is transmitted to us during a tour.
3. Visiting the website
Hosting
The website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Vercel processes the technically necessary connection data on our behalf. We have concluded a data processing agreement with Vercel under Article 28 GDPR. The transfer to the USA is based on the European Commission's standard contractual clauses and on Vercel's certification under the EU-US Data Privacy Framework.
Server log files
Each time the site is accessed, data transmitted by your browser is recorded automatically: IP address (truncated or stored only briefly), date and time, page requested, referrer URL, browser type and operating system. This data serves to deliver the page, keep it stable and defend against attacks.
Cookies and analytics
The website sets no cookies for analytics, tracking or advertising and embeds no external fonts, maps or video services. A consent banner is therefore not required. Should this change, we will obtain your consent beforehand.
4. Contacting us
If you write to us, we process your details to handle your enquiry and any follow-up questions. The legal basis is Article 6 (1) (b) GDPR for contract-related enquiries, otherwise Article 6 (1) (f) GDPR. We delete the correspondence once it is no longer needed, at the latest after the statutory retention periods expire.
5. Using the app
Location data
The app needs your location to start chapters automatically at the right waypoint. The comparison between your position and the waypoints happens exclusively on your device. Location data is not transmitted to us or to third parties and is not stored on our servers.
On Android the app uses a foreground service with location access while a tour is running, so playback continues with the screen off. You can recognise this by the persistent notification. You can withdraw location permission at any time in your system settings — chapters can still be started manually.
User account and tour unlocks
For an account we process your email address, an encrypted password or the identifier of your sign-in provider, your unlocked tours and your tour progress. This is necessary so you can use purchased tours on several devices and resume an interrupted tour later.
This data is held by Supabase Inc., 970 Toa Payoh North, Singapore, in a data centre within the European Union. A data processing agreement under Article 28 GDPR is in place.
Purchases
Tours are purchased through Apple's App Store or Google Play. Payment processing lies entirely with these providers; we do not receive your payment details. We only receive a purchase confirmation, which we verify in order to unlock the tour and prevent misuse.
Push notifications
If you allow push notifications, Firebase Cloud Messaging, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, generates a device identifier (token). We use this token to send you information about new tours and your tour progress. You can withdraw permission at any time in your system settings.
Crash reports
If the app crashes, Firebase Crashlytics (Google Ireland Limited) transmits a technical report: device type, operating system version, app version, timestamp and stack trace, together with a pseudonymous installation ID. We use this solely to find and fix errors.
Advertising
In free use, the app displays advertising via Google Mobile Ads (Google Ireland Limited). This may involve processing your device's advertising ID, coarse location data and usage data. We only show personalised advertising if you have consented beforehand; you can change your choice at any time in the app settings. Purchased tours contain no advertising.
6. Recipients of your data
We pass on data only where necessary for the purposes described, where you have consented, or where we are legally obliged to do so. Processors act on our instructions on the basis of an agreement under Article 28 GDPR.
7. Transfers to third countries
Some of the providers named also process data outside the EU, in particular in the USA. This is based on the European Commission's standard contractual clauses and, where available, certification under the EU-US Data Privacy Framework. Despite these safeguards, access by authorities there cannot be entirely ruled out.
8. Your rights
Under the GDPR you have the following rights against us:
- Access to the data stored about you (Article 15)
- Rectification of inaccurate data (Article 16)
- Erasure (Article 17)
- Restriction of processing (Article 18)
- Data portability (Article 20)
- Objection to processing based on legitimate interests (Article 21)
- Withdrawal of consent with effect for the future (Article 7 (3))
An informal message to hallo@explora-tours.de is enough for any of these.
You also have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR), for example the authority where you live or the one responsible for us.
9. Deleting your account
You can delete your account at any time in the app under "Settings → Account", or ask us to do so by email. We then delete all personal data unless a statutory retention obligation applies. Purchase records are kept for tax reasons but separated from your profile.
10. Changes to this policy
We update this policy when the legal situation or our processing activities change. The version published here is the one that applies.