Privacy policy

1. Who is responsible

The controller under the GDPR is the operator named in the imprint (see Imprint). You can reach us at the email address given there for anything about your data.

2. What we process and why

We process only what the service needs:

• Account data: your email address and, if you use Google sign-in, the name Google shares. Purpose: signing you in and identifying your account. Legal basis: performing our contract with you (Art. 6(1)(b) GDPR).
• Profile data: display name, city, and, for Guides, bio, topics, hours, price, video link or venue, and the public profile link you gave us to apply. Purpose: showing Guides to Explorers and reviewing applications. Legal basis: contract; for the application review, also our legitimate interest in a safe platform (Art. 6(1)(f)).
• Bookings: who booked whom, when, the topic, the note you wrote, and the meeting details. Purpose: arranging and managing sessions. Legal basis: contract.
• Reviews: your rating and comment. Purpose: helping others choose a Guide. Legal basis: legitimate interest in trustworthy ratings (Art. 6(1)(f)).
• Emails we send you: confirmations, reminders, decisions on requests, review requests, and messages about your Guide application. Purpose: running the booking process. Legal basis: contract. We do not send marketing emails.
• Questions to the AI concierge: the text of the question, with email addresses, phone numbers and account numbers automatically removed, stored without your name, account or IP address for 90 days, plus your thumbs up or down. Purpose: improving answers and finding missing content. Legal basis: legitimate interest (Art. 6(1)(f)). Please do not type personal details into the question.
• Technical data: our servers and hosting provider process your IP address and request data to deliver the site and keep it secure (security logs). Legal basis: legitimate interest (Art. 6(1)(f)).

3. Who receives your data

We use service providers who process data on our behalf under data processing agreements. Depending on your use, these are:

• Supabase: sign-in and database hosting.
• Resend: sending the emails described above.
• Google (Gemini API): generating the wording of AI concierge answers and turning questions into search vectors (embeddings) to find the right passages. Only the question text (with contact details removed) and the relevant knowledge-base passages are sent, never your account, name or email. We use the paid API tier, under which Google does not use this data to train its models. Google may process it outside the EU, on the basis of standard contractual clauses.
• Google (sign-in): only if you choose to sign in with Google.
• Our hosting provider: running the website and API.

4. What other users see

A Guide's display name, city, bio, topics, rating and reviews are public. When you book, the Guide sees your display name, the topic and your note. You see the Guide's name and, once confirmed, the meeting details. Nobody sees your email address.

5. Cookies and local storage

We use only what is strictly necessary: a sign-in session cookie, your language choice, and your light or dark theme preference. We do not use analytics, advertising or tracking cookies, which is why there is no cookie banner. If that changes, we will ask for your consent first.

6. How long we keep data

Your account data is kept until you delete your account. AI concierge question logs are deleted after 90 days. When you delete your account, your profile, Guide profile and free-text you wrote are erased and upcoming bookings are cancelled; past bookings remain in the other person's history without your name. Security logs are kept for a short period.

7. Your rights

You have the right to access, correct, delete and restrict processing of your data, to data portability, and to object to processing based on legitimate interests. You can download all your data and delete your account yourself under Account & privacy. For anything else, write to us. You may also complain to a data protection supervisory authority, for example the one where you live or where we are based.

8. Age

Alloland is intended for adults (18 and over).

9. Changes

We will update this policy when our data handling changes and show the date of the latest version at the top.