GuideSofia Privacy Policy

Effective date: January 9, 2025
Last updated: September 20, 2026

GuideSofia, with address at Rua Manuel Da Silva Leal 8 Esq., 1600-166 Lisboa, Portugal, is the controller of the personal data described below. In this policy, “GuideSofia”, “we” and “us” refer to the controller. You can contact us at privacy@guidesofia.com.

What We Process and Why

• Account and profile: name, email, account identifiers, login provider, profile, language and settings, used to create and manage your account. Legal basis: performance of our contract with you.
• Location: precise or approximate location when you enable nearby places, maps, routes or location-aware tours. Legal basis: performance of our contract when you request the feature, and consent where required.
• Content and AI features: prompts, chat messages, images, selected guide content, language, preferences, generated text and audio, used to provide AI, image-recognition, translation, personalization and narration features you request. Legal basis: performance of our contract.
• Usage and technical data: device and app details, IP address, user agent, installation identifiers, session activity, searches, tours and audio used, feedback, crash reports and error data, used to operate, secure, diagnose and improve GuideSofia. Legal basis: our legitimate interests in security, reliability and product improvement, or consent where required by law.
• Saved activity and personalization: favorites, itineraries, histories, interests, likes, dislikes and profile results, used to save your choices and recommend relevant content. Legal basis: performance of our contract and our legitimate interest in providing relevant recommendations.
• Purchases: product, platform, purchase token, receipt metadata, subscription status and entitlement history, used to process, restore and verify subscriptions. Legal basis: performance of our contract and legal obligations.
• Notifications and support: push token, notification preferences, contact details, support messages and feedback, used to provide requested notifications and support. Legal basis: consent, performance of our contract, or our legitimate interest in responding to users.

Account details are required to create an account. Location, camera, microphone, Bluetooth and notification access are required only for features that use them. You can manage these permissions in your device settings. If you refuse required data, the relevant feature may not work, but unrelated features remain available.

Personalization and Automated Processing

GuideSofia may use your interests, language, saved activity and choices to rank or generate content that is more relevant to you. This affects recommendations and presentation only. We do not use your data to make solely automated decisions that produce legal or similarly significant effects.

Service Providers and International Transfers

We use contracted providers for authentication, hosting, databases, analytics, notifications, crash reporting, maps and routing, payments, AI, image processing, translation and text-to-speech. These include Google Cloud and Firebase, Apple and Google, the login provider you select, mapping providers, and the AI or speech provider needed for a feature you request. We may also disclose data where required by law or to establish or defend legal claims.

Some providers may process data outside the European Economic Area. Where required, we rely on an adequacy decision, the European Commission’s Standard Contractual Clauses, or another lawful safeguard. You may contact us for information about the safeguard used. We do not sell personal data or share it for third-party targeted advertising.

How Long We Keep Data

• Account, saved content and personalization: while your account is active, then deleted or anonymized after a verified deletion request unless a legal exception applies.
• Raw product analytics: normally up to 30 days, then deleted or aggregated.
• Operational and security logs: normally 30 days; up to 90 days where needed for an active security investigation.
• Recognition images and temporary audio: deleted after processing or normally within 24 hours; a protected recognition cache may remain for up to 7 days.
• Support and feedback: up to 24 months after the request is closed.
• Purchase and accounting records: for the period required by tax, accounting, consumer-protection or fraud-prevention law.
• Backups: deleted data is removed as backups are overwritten, normally within 90 days.

Security

We use measures appropriate to the risk, including authentication, access controls, encryption in transit, protected storage, monitoring, backups and incident response. No online service can guarantee absolute security.

Your Rights

Where the GDPR applies, you may:

• access your personal data and receive a copy;
• correct inaccurate or incomplete data;
• request deletion or restriction of processing;
• receive data you provided in a portable format;
• object to processing based on legitimate interests; and
• withdraw consent at any time for future consent-based processing.

To exercise a right or object to analytics or personalization, email privacy@guidesofia.com from the address associated with your account. We may request information needed to verify your identity. We normally respond within one month. For a complex or numerous request, the GDPR may allow up to two additional months; we will tell you if this applies. Rights may be limited where a legal exception applies.

Account Deletion

You may use Delete Account in the app or email privacy@guidesofia.com. We will delete or anonymize personal data associated with the account unless limited records must be retained for legal, accounting, fraud-prevention or security reasons.

Children

GuideSofia accounts are not intended for children under 13. Where local law requires a higher age for a child to consent to optional processing, that higher age applies. Please contact us if you believe a child provided data without the authorization required by law.

Complaints

You may complain to Portugal’s Comissão Nacional de Proteção de Dados (CNPD) or another competent supervisory authority, particularly in the EU Member State of your habitual residence, place of work, or the place of the alleged infringement.

Changes and Contact

We may update this policy when our services or legal obligations change. We will post the updated date and provide additional notice where required.

GuideSofia
Rua Manuel Da Silva Leal 8 Esq.
1600-166 Lisboa, Portugal
Email: privacy@guidesofia.com