Privacy Policy

Our Privacy Principles

1. Information We Process (Not Store)

1.1 Information We Store on Our Servers

• User Profile: When you create an account, we store your user ID and credit balance on our secure servers to sync your credits across devices.
• Credit Balance & Purchase History: Your current credit balance and purchase transactions are stored securely to track your usage and prevent fraud.
• Premium Tickets: Active unlimited passes are stored to verify your subscription status.

1.2 Information Processed Locally on Your Device

• Apple Sign-In: When you sign in with Apple, your name and email are stored locally on your device only. We never see or store this information.
• Generated Tours: All tours you create are saved exclusively on your iPhone. We cannot access, view, or retrieve your tours.
• App Preferences: Language settings, theme choices, and other preferences remain on your device only.

1.3 Information Processed Temporarily (Never Stored)

• Location for Navigation: Your GPS coordinates are sent to API providers (Google/Apple Maps) for navigation instructions, then immediately discarded. We never store or track your location.
• AI Conversations: Your text questions are sent to OpenAI/Google for AI responses, processed, and immediately deleted. No conversation history is retained.
• Voice Input: Speech recognition happens 100% on your device. Your voice never leaves your iPhone.
• Images for AI Analysis: Photos are temporarily sent to AI providers for analysis (e.g., "What is this building?") and deleted immediately after generating a response.
• Tour Generation Requests: City names and themes are sent to AI/Google APIs to generate tours, then discarded after processing.

1.4 Information We NEVER Access or Store

• Audio recordings of your voice
• Precise location history or tracking data
• Personal contacts or calendar information
• Other apps installed on your device
• Browsing history or advertising identifiers
• Health or fitness data

2. How We Use Your Information

Purpose	Data Used	Legal Basis (GDPR)
Generate personalized tours	City name, tour theme	Contract performance
Provide navigation	Current GPS location	Contract performance
AI tour guide responses	User questions, current location (optional)	Contract performance
Process in-app purchases	Apple ID (handled by Apple)	Contract performance
Provide customer support	Email address, issue description	Legitimate interest
Improve app performance	Anonymized usage patterns	Legitimate interest

3. Disclosure of Your Information

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following situations:

3.1 Service Providers

• OpenAI: We send your text queries (not voice) to OpenAI's API for AI responses. OpenAI processes this data according to their privacy policy and does not use it for model training when accessed via API.
• Google Cloud (Gemini): For voice synthesis in Quality mode. Only text is sent, not personal information.
• Google Maps Platform: For geocoding and route optimization during tour generation. Only city names and waypoint data are shared.
• Apple: For Sign in with Apple and in-app purchases. Handled entirely by Apple's secure systems.

3.2 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency).

3.3 Business Transfers

If we are involved in a merger, acquisition, or asset sale, your personal information may be transferred. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy.

4. Data Storage and Security

4.1 Where Your Data is Stored

• On Our Secure Servers: User accounts, credit balances, and premium ticket status are stored on secure, encrypted servers to sync across your devices.
• On Your Device: All tours, user preferences, and Apple authentication data are stored locally on your iPhone. We have no access to this data.
• In Transit Only: Location data and AI queries are transmitted securely to API providers (OpenAI, Google) for processing but are never stored permanently.
• Temporary Processing: Images and text queries are processed temporarily by AI providers and immediately deleted after generating responses.

4.2 Security Measures

• All data transmission is encrypted for security
• On-device data is protected by iOS security features including encryption
• No passwords are stored (authentication handled by Apple)

4.3 Data Retention

• Local Data: Remains on your device until you delete the app
• Account Data: Retained while your account is active
• Temporary Data: Deleted immediately after processing

5. Third-Party Services

Our app integrates with the following third-party services. Each service has its own privacy policy:

Service	Purpose	Data Shared	Privacy Policy
OpenAI API	AI text generation	Text queries only	OpenAI Privacy
Google Cloud	Voice synthesis, geocoding	Text and location names	Google Cloud Privacy
Apple Maps	Map display and navigation	Location coordinates	Apple Privacy

6. Your Rights

You have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate personal information
• Deletion: Request deletion of your personal information
• Portability: Request a copy of your data
• Objection: Object to processing of your personal information
• Restriction: Request restriction of processing your personal information
• Withdrawal of Consent: Withdraw consent at any time where we rely on consent

How to Exercise Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days.

7. GDPR Compliance (European Users)

8. California Privacy Rights (CCPA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You can request information about the categories and specific pieces of personal information we collect
• Right to Delete: You can request deletion of your personal information
• Right to Opt-Out: We do not sell personal information, so this right is not applicable
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

Shine the Light: California residents may request information about disclosure of personal information to third parties for direct marketing purposes. We do not disclose personal information for such purposes.

9. Children's Privacy

Our App is not intended for children under the age of 13 (or 16 in the EU). We do not knowingly collect personal information from children under these ages. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at [email protected], and we will delete such information.

10. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last Updated" date at the top of this Privacy Policy
• Sending an in-app notification for material changes

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

11. Contact Us

Consent and Acceptance

By using the AI-Tourguide app, you signify your acceptance of this Privacy Policy. If you do not agree to this policy, please do not use our App. Your continued use of the App following the posting of changes to this policy will be deemed your acceptance of those changes.

International Users

If you are accessing our App from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States and other countries where our service providers operate. By using our App, you consent to the transfer of information to countries outside your country of residence, which may have different data protection rules.

EU-US Data Transfers

For transfers from the EU/EEA to the United States, our service providers maintain adequate privacy protections for your data.

Data Breach Notification

In the unlikely event of a data breach that affects your personal information, we will:

• Notify affected users within 72 hours of discovery (as required by GDPR)
• Provide information about the nature of the breach
• Describe the measures taken to address the breach
• Offer guidance on steps you can take to protect yourself