Privacy policy

1. Who we are

Xploro (the mobile app and the website xploro.al) is run by [Company legal name], [Registered address], Albania, [NIPT / registration number] ("we", "us"). We are the controller of the personal data described here. For anything about your data, write to privacy@xploro.al.

2. What we collect and why

Your account

• Email address and password, to create your account and sign you in. Your password is handled by Amazon Cognito and we never see it.
• First name (optional) and anything you add to your profile (last name, a short bio, your home town, a profile photo link).
• Emails we send: the verification code when you sign up and password reset codes. We do not send marketing emails.

Legal basis: performance of our contract with you (providing the app).

Your collection and bookings

• Places you collect and when you collected them. Your badges and progress are worked out from these.
• Bookings: the event, number of guests, price, and when you booked or cancelled. If you book an event, the guide or organiser running it receives your name and the booking details so they can host you.

Legal basis: performance of our contract with you.

Location (on your phone only)

When you open a place to collect it, the app asks for permission to use your location while the app is open. It checks on your phone whether you are inside the place's zone, which unlocks the object. Your location is not sent to us or stored. When you collect a place we receive only which place you collected. The app never uses your location in the background. You can turn location off in your phone's settings; collecting places then won't work.

Camera (on your phone only)

The camera shows the augmented-reality view where you collect a place. The camera feed is processed on your phone. We do not record, upload or keep any images or video.

Using Xploro without an account

You can browse places without signing up. The app then gets an anonymous guest identifier from Amazon Cognito so it can load the catalogue. It is not linked to you.

Technical data

Like any online service, our servers process your IP address, device and app details and the time of each request in order to answer it and keep the service secure. We keep error logs for 14 days. They do not contain the contents of your requests. Legal basis: our legitimate interest in running a secure, working service.

The website

xploro.al has no accounts, forms, analytics or advertising, and sets no cookies (see the cookie policy). Our hosting provider processes standard request data (IP address, browser, page requested) to deliver the pages.

3. Who processes your data

• Amazon Web Services hosts the app's backend and the website in the EU (Ireland, eu-west-1): database, sign-in (Amazon Cognito, which also sends our emails), API and website hosting. AWS acts as our processor under its data processing terms.
• Guides and event organisers receive your name and booking details when you book their event.

The app also loads public content directly from third parties. They receive your IP address and device details as part of each request, under their own privacy policies: OpenStreetMap (map tiles), Wikimedia (place photos) and unpkg.com (the map's code). We do not send them any of your account data.

We do not sell or rent personal data, and we do not use it for advertising or share it with data brokers.

4. Where your data is stored

Your data is stored in the European Union (Ireland). If AWS needs to access it from outside the EU or Albania, for example for support, this is covered by the European Commission's standard contractual clauses or another lawful transfer mechanism.

5. How long we keep it

• Account, profile, collected places and bookings: for as long as you have an account. When you delete your account, they are deleted. Copies in our database backups expire within 35 days.
• Booking records that we must keep for tax or accounting law are kept for the period that law requires.
• Error logs: 14 days.

6. Your rights

You can ask us to:

• give you a copy of your data, including in a machine-readable format;
• correct it;
• delete your account and data;
• restrict or object to how we use it.

Write to privacy@xploro.al from the email address of your account. We reply within 30 days. You can withdraw location or camera permission at any time in your phone's settings.

If you think we have mishandled your data, you can complain to Albania's Information and Data Protection Commissioner (idp.al) or, if you live in the EU or EEA, to the data protection authority where you live. We would appreciate the chance to sort it out with you first.

7. Security

All traffic between the app or website and our servers is encrypted (HTTPS). The database is encrypted at rest and runs in a private network that cannot be reached from the internet. Passwords are handled only by Amazon Cognito.

8. Children

Xploro is not meant for children under 16. We do not knowingly collect data from them. If you think a child has given us data, contact us and we will delete it.

9. Changes

If we change this policy, we will update the date at the top. If a change affects how we use data you have already given us, we will tell you in the app first.

10. Contact

[Company legal name], [Registered address], Albania. Email: privacy@xploro.al.