Privacy policy

Your position

In the "I'm at Pompeii" mode the guide uses your phone's location to give directions and start each stop. This happens on your device. Your position is not sent to us, and we can't see where you are or have been. The browser or the app asks your permission first, and you can say no and still use the 3D visit.

When you buy or sign in

Legal basis: performing the contract with you (Article 6(1)(b) GDPR). We keep account data while your account exists. Purchase records are kept as long as Spanish tax and accounting law requires, currently up to 6 years.

• Your e-mail address, to link your purchases and send sign-in links, codes and receipts.
• Your purchases: which tour, when, the price and the payment reference.
• For each device you use: a random identifier the app or browser creates, and the date it was last used. We use it only to count devices.
• Sign-in codes and session keys, stored as hashes.

Payments

Card, Apple Pay and Google Pay payments on the website are handled by Stripe Payments Europe, Ltd. (Ireland). Your card details go to Stripe and never reach our servers. Stripe also processes data for fraud prevention as its own controller. In the app, the App Store or Google Play handles the payment.

Cookies and storage

We use no advertising or analytics cookies, so there is no cookie banner. When you sign in or buy, we set a cookie that keeps you signed in (vg_session, 180 days) and, during checkout, a one-time cookie that recognises this browser when you come back from paying (vg_checkout, 1 hour). After a purchase in the browser, a cookie keeps that tour unlocked there (vg_pass, 1 year). The guide stores your language, progress and device identifier in your browser's local storage. All of this is needed for the service you ask for.

Who processes data for us

Some of these companies may process data outside the EU. Where they do, they rely on the EU-US Data Privacy Framework or on standard contractual clauses approved by the European Commission.

• Cloudflare, Inc.: hosting, our database and the e-mails we send.
• Stripe Payments Europe, Ltd.: payments.
• Apple and Google: in-app purchases, once the app is out.

Server logs

Our hosting provider keeps standard request logs (IP address, page, time) for security and abuse prevention, for a short period.

Your rights

You can ask for access to your data, correction, deletion, restriction, a copy to take elsewhere, or object to processing. Write to hello@veredamaps.com. Deleting your account removes your access to purchased tours. If you think we handle your data wrongly, you can complain to the Spanish authority, the Agencia Española de Protección de Datos (www.aepd.es), or to the one in your own country.

Children

Accounts are for people aged 14 or over. Children can use a tour on a family device under supervision.

Changes

If we change how we handle data, we update this page and the date at the top. For important changes, we e-mail account holders.