This policy is provided in English.
Privacy Policy — ToursAI
Last updated: 28 August 2026
Website & waitlist
On this website we collect one personal data point only: the email address you voluntarily enter in the waitlist form. We use it solely for communications about the launch of ToursAI, and for nothing else. You can request its deletion at any time by writing to info@toursai.it. Form submissions are relayed through the FormSubmit service (formsubmit.co), acting as a data processor for the sole purpose of forwarding your sign-up to us. This website uses no profiling cookies and no third-party analytics.
The remainder of this policy describes data processing in the ToursAI app.
1. Who we are (Data Controller)
The Data Controller for your personal data is ToursAI. Privacy contact email: info@toursai.it.
ToursAI is an AI tour-guide app for iOS and Android: voice guide ("Ehi Guida"), automatic narration of places via GPS, monument recognition through the camera, walking navigation, personalization, 16 languages, offline mode, 24/7 travel companion, trip planner, travel diary and statistics.
This policy explains, in plain language, what data we process, why, where it goes and how long it is kept, as required by Regulation (EU) 2016/679 ("GDPR").
2. At a glance (summary)
- No advertising. We show no ads and never use your data for advertising.
- No selling of data. We do not sell or rent your data to anyone.
- No cross-app tracking. We do not follow you across other apps or websites.
- The microphone is active only while you talk to the guide; audio files are deleted immediately after transcription.
- Photos for monument recognition are taken only at your request and are not stored.
- Your GPS location is processed on the device; only the necessary context (coordinates / city name) is sent to AI providers to generate narrations and answers.
- You can use the app as a guest (no account): conversations and preferences then stay on your device only.
- If you have an account, you can delete it together with ALL your data in one tap, directly from the app.
3. Summary table: which data → why → where it goes → how long it stays
| Which data | Why | Where it goes | How long |
|---|---|---|---|
| GPS location | Automatic narration of nearby places, walking navigation, weather | Processed on device; coordinates / city name sent to AI providers as context; map/route services (OpenStreetMap/Overpass, OSRM) and weather (wttr.in) | Not stored on our servers; used only in the moment |
| Microphone audio | Transcribing your voice questions ("Ehi Guida") | Groq (Whisper) for transcription | Audio file deleted immediately after transcription; not stored by our servers |
| Camera photos (recognition) | Recognizing the monument you are looking at (only at your request or in exploration/museum modes you enable) | Anthropic (Claude) and/or OpenAI for visual analysis | Not stored |
| Conversations with the guide | Generating answers; "memory" feature (registered users only) | Anthropic/Groq to generate answers; if registered: saved on our cloud backend (Supabase) with Row-Level Security | Guest: device only. Registered: as long as the account exists or until you delete them |
| Interest profile (e.g. "loves history") | Personalizing narrations | On device; if registered, also on the cloud backend, per user | As long as the account exists or until you delete it |
| Statistics (steps, places visited, badges) | Travel diary and personal statistics | Mainly on your device | Until you delete them / uninstall the app |
| Crowd-learning (aggregated questions) | Improving shared narrations for everyone | Our backend, in anonymous form (random session identifier, not linked to your identity) | In aggregated/anonymous form, not traceable to you |
| Diary keepsake photos | Your personal travel diary | Your device only | Until you delete them |
| Account (email, password) | Login, sync, memory | Supabase Auth (cloud hosting); anonymous sign-in also available | As long as the account exists; full deletion on request |
| Payments (when active) | Subscriptions and purchases | Apple App Store / Google Play via RevenueCat; we never see your card details | According to Apple/Google/RevenueCat rules |
4. Processing in detail
4.1 Location (GPS)
Location is needed for the app's core feature: narrating places as you walk through them and guiding you on foot. Processing happens on the device; we send coordinates or the city name to AI providers only as context to generate relevant narrations and answers. Your location is never sold and never used for advertising, and we do not build movement histories on our servers. You can revoke the permission at any time in your phone settings (some features will stop working).
4.2 Microphone and voice
The microphone is used only during active listening: when you say the wake word ("Ehi Guida") or ask a question. The audio is sent to Groq (Whisper model) for speech-to-text; the audio file is deleted from the device immediately after transcription and is not stored by our servers. There is no recorded continuous listening: no recording is kept.
4.3 Camera
Photos are taken only at your explicit request (e.g. "what am I looking at?") or in the exploration/museum modes that you enable. The image is sent to Anthropic (Claude) and/or OpenAI for monument/artwork recognition and is not stored by us or used for any other purpose. Keepsake photos in the travel diary stay on your device only.
4.4 Conversations and the "memory" feature
Your questions and the guide's answers are sent to AI providers (Anthropic, Groq) to generate responses. If you use the app as a guest, conversations stay on your device only. If you are registered, conversations are saved on our cloud backend (Supabase) to power the "memory" feature (the guide remembers what you talked about, like a friend). The database enforces Row-Level Security: each user can only access their own data.
4.5 Interest profile and personalization
From your questions we derive an interest profile (e.g. "loves history", "prefers art") used to personalize narrations. The profile is stored on the device and, if you are registered, also on the cloud backend, linked only to your user.
4.6 Statistics and diary
Steps (pedometer), places visited and badges are processed mainly on the device for your personal diary and statistics.
4.7 Anonymous crowd-learning
To improve narrations for everyone, we collect the most frequent questions about places in anonymous form: a randomly generated session identifier is used, not linked to your account or identity. Questions are analyzed in aggregate (e.g. "many people ask who built this bridge") to enrich the shared narrations.
4.8 Account
You can register with email and password (Supabase Auth) or use anonymous sign-in. The account enables sync and the memory feature. See section 8 for full deletion.
5. Third-party providers (sub-processors)
To deliver the service we rely on the following providers, which process data only on our behalf and for the stated purposes:
| Provider | Purpose |
|---|---|
| Anthropic | AI answers and visual recognition (Claude) |
| Groq | Voice transcription (Whisper) and fallback AI |
| OpenAI | Fallback visual recognition and voice |
| Google Cloud TTS | Speech synthesis (the guide's voice) |
| ElevenLabs | Speech synthesis |
| Supabase | Database and backend (cloud hosting) |
| OpenStreetMap / Overpass | Place data and maps |
| Wikipedia | Information about places |
| OSRM | Walking route calculation |
| wttr.in | Weather information |
| FormSubmit (formsubmit.co) | Relaying the website waitlist form |
| Apple App Store / Google Play (via RevenueCat) | Payments and subscriptions (when active) |
Some providers may be located outside the European Union (notably in the USA). In that case, transfers rely on appropriate safeguards under Articles 44-49 GDPR (e.g. Standard Contractual Clauses and/or the EU-US Data Privacy Framework, where applicable).
6. Legal bases (Article 6 GDPR)
- Performance of a contract (Art. 6(1)(b)): providing the service you request (narrations, answers, navigation, account, memory).
- Consent (Art. 6(1)(a)): microphone, location and camera permissions, granted through the operating system and revocable at any time in your device settings; voluntary sign-up to the website waitlist.
- Legitimate interest (Art. 6(1)(f)): anonymous crowd-learning to improve the service; security and abuse prevention (e.g. rate limiting).
7. Data retention
- Account data (email, conversations, synced interest profile): kept for as long as the account exists; deleted when the account is deleted.
- Microphone audio files: deleted immediately after transcription.
- Recognition photos: not stored.
- On-device data (diary, statistics, guest conversations): under your control; removed by deleting them in the app or uninstalling the app.
- Crowd-learning data: kept only in anonymous/aggregated form.
- Waitlist email: kept until the launch and related communications, or until you request deletion at info@toursai.it.
8. Your rights (Articles 15-22 GDPR)
You have the right to:
- Access your data (Art. 15);
- Rectification of inaccurate data (Art. 16);
- Erasure ("right to be forgotten", Art. 17): from within the app you can delete your account and ALL associated data (profile, conversations, memory, synced statistics) completely and permanently;
- Data portability (Art. 20);
- Object to processing based on legitimate interest (Art. 21);
- Withdraw consent at any time (device permissions), without affecting the lawfulness of prior processing;
- Lodge a complaint with a supervisory authority: in Italy, the Garante per la Protezione dei Dati Personali (www.garanteprivacy.it), or the authority of your country of residence.
To exercise your rights, write to info@toursai.it. We reply within statutory deadlines (normally 30 days).
9. Security
We adopt appropriate technical and organizational measures, including: encrypted communications (HTTPS/TLS), Row-Level Security on the database (each user can only access their own data), mandatory authentication for sensitive operations (e.g. account deletion requires a valid user token), and rate limiting against abuse.
10. Children
The app is not intended for children under 13 without adult supervision. We do not knowingly collect data from children under 13; if you believe this has happened, contact us and we will delete it.
11. What we do NOT do
- No advertising and no use of data for advertising purposes.
- No sale or transfer of data to third parties for commercial purposes.
- No cross-app tracking or marketing profiling.
12. Changes to this policy
We may update this policy (e.g. for new features or legal requirements). We will publish the updated version in the app and/or on this website, with its "Last updated" date. For material changes, we will notify you in the app.
13. Contact
Controller: ToursAI
Email: info@toursai.it
This is a courtesy translation. In case of conflict with the Italian version, the Italian version prevails for users in Italy.