Privacy and Transparency

Committed to protecting your experience and your personal data.

1. Privacy Commitment

Last updated: 3 October 2026.

At TourAI, accessible from tourai.es, we regard our users' privacy as a fundamental pillar. This policy explains how we manage information to ensure that the use of our intelligent audio guides and associated website services (account, community and reviews) is safe and transparent.

2. Data controller

The controller of the personal data collected through tourai.es and the associated services of the TourAI project is:

You can find more information about the project on the About us page or write to us from Contact for any privacy-related enquiry.

3. Information We Collect

TourAI limits account identification data to what is essential for the service to work. We do not request or process other identifying profile data (for example phone number, postal address or identity document). The detail is as follows:

  • Account identification data (app and web): only your email address (essential to sign in and use TourAI; without an email you cannot use the app or the private area of the website), the display name or alias (nickname) you choose to appear on the website and in the app, and, entirely optional, your date of birth, solely so we can offer birthday bonuses (BIRTHDATE campaign). If you do not provide it, that type of bonus will not be applied automatically. The password forms part of the authentication credentials and is not used for purposes other than access. You may optionally add a profile photo; it is not an essential piece of data. The same account may be used in the mobile application and on tourai.es. If you do not want your email to be used, the route is to delete the account (available in the app and on the website), in accordance with section 5.1.

In addition, to provide specific service features (not as additional profile data), the following technical or operational data may be processed:

  • Geographic location: Used with your permission to offer audio guides and contextual content for nearby points of interest. We do not store a history of your movements or a permanent route.
  • Places presented by the tourist guide: To avoid repeating the same point of interest on later routes, we associate with your account a record of places the guide has started to present to you (place identifier, name, category and technical registration and silence dates). This record is not a route or movement history: it does not store your GPS trail. It may be stored in the cloud linked to your account and, while you use the app, also in device memory. The record may be created when presentation of the place begins, even if you do not finish listening to the narration or move on to the next place. It is kept while it remains useful to avoid repeating that place (a silence period by category) and is deleted if you clear the list in the app (Edit account → Visited and saved places, with periods such as last hour, 24 hours, week or all), when the silence no longer applies for the service, or when the account is deleted.
  • Messages to the assistant (chat): The artificial intelligence chat is ephemeral: queries and replies are processed to provide the service while you use the application, but we do not store a conversation history linked to your account or in the cloud. When you close the application, the conversation disappears from the device. During the session, messages may be kept in device memory and sent to AI providers needed to generate the reply.
  • Account security and password reset: If you request "Forgot your password?" from the app or the website, we send an email with a secure link to tourai.es/reset-password.html so you can set a new password. We do not send your current password by email.
  • Registration abuse prevention: We retain a history of registrations and deletions associated with the same email address (email lifecycle) to limit abusive re-registrations (currently a maximum of 3 registrations in 180 days). An administrator may unlock the email when appropriate.
  • Bonuses and promotional codes: Record of the redeemed code, redemption date, associated plan and promotional campaign reference (for example WELCOME, BIRTHDATE), to manage activation of a free plan (including the automatic welcome bonus on first access where applicable, and pre-assigned email bonuses that take priority over the WELCOME bonus), prevent duplicate use per user and prevent fraud. Bonuses have a maximum activation period of 30 days; purchased plans, 60 days from acquisition. If you redeem a bonus by scanning a QR code, the camera is used on the device to read the code; we do not store QR images or video recordings.
  • Plan payments (app and web): Amount, currency, payment method, payment status (for example paid, pending, cancelled, not completed or failed), gateway session or transaction identifiers (e.g. Stripe or the app store) to reconcile payment, record creation date and link to the purchased plan. In the app, if you exhaust your active plan's usage allowance, the payment flow described in the Terms may start; the data processed is the same as for any plan purchase and charging is subject to your confirmation in the store or gateway. TourAI does not store full card numbers. Purpose: contractual plan management, fraud prevention, incident handling and compliance with accounting obligations where applicable. Legal basis: performance of the contract and legitimate interest in service security.
  • Device and session identifier: We use a device identifier and a presence signal while you use the app to maintain a single active session per account and to close the previous session when you sign in from a new device. On the web, the authentication session may persist in the browser. It is not used to build third-party commercial profiles.
  • Community (user-generated content): If you post in Community, we process the topic title and body, replies, your account identifier, the displayed name or alias, the publication date, the moderation status (pending, approved or rejected) and technical metadata associated with moderation. Automated filters of non-permitted terms may block submission before the content is stored (that attempt does not enter the moderation queue). Once approved and visible, that content is public (viewable without signing in). We may hide it (moderation or voluntary withdrawal by the author) without physically deleting it immediately, in order to preserve thread integrity and service security. We also retain on your account counters of approved and rejected contributions and, where applicable, the flag for a restriction of the ability to post in the Community, for the purpose of applying the moderation policy described in the Terms.
  • Acceptance of legal texts: We record whether you have accepted the Terms and the Privacy Policy, the acceptance date and the acceptance version in force at that time, in order to evidence contractual consent and to request a new express acceptance when those texts are updated.
  • Reviews and ratings: Rating is voluntary: you are not obliged to submit a review to use TourAI. If you choose to submit a rating on Reviews, we process the stars (required to complete submission), the optional comment, the rated target (web or app), your account identifier, the displayed name or alias and the moderation status. Reviews are not published until a moderator approves them. Once approved, they are public. We also retain aggregated statistics (sum and number of ratings) without needing to identify each author in the displayed average.
  • Website forms: If you write to us from Contact, we process the name (if you provide it), email, message and associated verification, solely to handle that enquiry.
  • Web analytics (optional): If you accept analytics cookies in the tourai.es banner, we use Google Analytics to obtain aggregated visit and page-view statistics. Legal basis: consent. You may reject them in the banner or withdraw consent by clearing site data in your browser (including the cookies-aceptadas key).
  • Launch notices (waitlist): If you subscribe to the App Store or Google Play availability notice, we process your email address, the chosen platform and associated verification data, for the sole purpose of sending you the publication notice. Legal basis: consent. You may view or cancel alerts from the website ("Manage or cancel launch alerts") after proving ownership of the email with a verification code sent to that address or, if you are already signed in on tourai.es with the same email, through that authentication session. You may also write to info@tourai.es. Sending may be carried out through email providers acting as processors.
  • Local data on the device: Preferences may be stored locally on the phone or PC (language, app privacy consent, cookie consent on the website), previously used emails to facilitate sign-in and, if you enable it, biometrics to unlock an already signed-in session. When you open the app for the first time, the interface language is taken from the device language (you can change it later in Preferences). For the voice assistant, when you turn on the microphone (or a feature that needs it), the app may, after your confirmation, download and install on the device a speech-recognition component for the app language at that time; that recognition is preferably processed on the device. If you clear the app's data in system settings, that component is removed and may be downloaded again when you turn the microphone back on.
  • Technical diagnostics: If the app detects a serious error, a technical report may be sent to our team (device, system, screen and, if there is a session, identifier or email) to fix faults. It is not used for third-party commercial purposes.

3.1. Legal basis for processing (summary)

In general terms, we process your data on the following bases, depending on the type of information:

  • Performance of the contract / provision of the service: account (app and web), plans, plan payments, bonus redemption, ephemeral assistant chat, record of places presented by the guide, preferences, community posting and submission of reviews, and other requested features.
  • Consent: geolocation, microphone, camera or gallery/photo library (profile photo or bonus QR scanning), contact or notice forms, non-essential cookies where applicable.
  • Legitimate interest: security, fraud prevention for promotional codes and abusive re-registrations, moderation of user-generated content (hiding, rejection, removal and, where applicable, restriction of the ability to post), service stability, integrity of public threads and aggregated rating averages, evidencing the accepted version of legal texts, and technical error reports.
  • Legal obligation: retention of billing data where applicable; responding to authority requests or obligations arising from digital services rules when they apply.

4. Providers and transfers

To provide the service we use customary providers (cloud authentication and storage — including authentication and database services —, transactional email, maps, artificial intelligence models, speech synthesis, app stores and payment gateways). Part of the processing may take place outside the European Economic Area. In those cases we apply the safeguards provided for in applicable law (for example, standard contractual clauses or other appropriate measures). The detail of categories of processors and transfers may be expanded following legal review.

5. Your Rights (GDPR)

In accordance with applicable law, you may exercise the rights of access, rectification, erasure, restriction of processing, portability and objection, as well as withdraw consent where processing is based on it, by writing to info@tourai.es. You may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

  • Account deletion and linked data are preferably managed automatically through the app or the Delete account page, in accordance with section 5.1.
  • You may clear the list of places already presented by the guide from the app (Edit account → Visited and saved places), choosing a period or all, without deleting the account.
  • You may withdraw geolocation consent at any time from your device settings.

5.1. Account deletion and associated data

If you do not want TourAI to use your email or other account data, you must delete the account. You may do so at any time from the application (Edit account → Delete my account) or from the website page Delete account.

In both cases you must verify your identity with a 6-digit code sent to the account email address. Providing the email alone is not enough: you must confirm the code received.

You may also request it by writing to info@tourai.es only if you cannot access the app or the deletion web page.

After verification, we delete the trail of your account and of your usage history: authentication and profile (email, display name or alias, date of birth if you provided it, photo if any, identifier), plans, usage history, the record of places presented by the guide, bonus redemptions, associated payment data stored in our systems, linked preferences and reviews or ratings (pending and published; the aggregated average is updated). No reference to your account or to the usage history generated by you remains.

Community (topics and replies): for legitimate reasons of conversation-thread integrity, the text of your posts is not deleted, but it is anonymised: the displayed name is replaced with the label "Anonymous", any trail of name or email is removed and your account identifier is dissociated. Anyone reading the thread will no longer be able to link it to you. If you want a specific item of content removed completely, write to info@tourai.es with the URL or a sufficient description; we will handle the request unless there is a legal retention obligation or an overriding legitimate interest (for example, defence against claims).

We will not delete global service content with no direct link to your identity, such as place texts or narrations reused in the shared catalogue, the points-of-interest catalogue, general commercial plans, aggregated rating statistics once your contribution has been deducted, or other data shared between users.

Apart from the above, only the following may be retained, to the extent strictly necessary: a minimal technical record associated with the email to limit abusive re-registrations (currently a maximum of 3 registrations in 180 days), without the rest of your account data, and what is required by legal or billing obligations, anonymised where appropriate.

Deletion is immediate after confirming the code. You will receive a confirmation email when it is complete.

We may retain aggregated and anonymous statistics about account deletions (date and counters by app/web channel), without data that would allow any user to be identified.

Withdrawal of geolocation consent may be done at any time from your device settings; disabling location alone does not delete your account or the rest of the stored data.