WeGuide AI — Privacy Policy

1. Who is responsible for your data

The controller of your personal data is:

WeGuide AI Prosta Spółka Akcyjna ul. Gospodarcza 26, 20‑213 Lublin, Poland KRS 0001255683 · NIP 9462770470 · REGON 54529487300000 District Court Lublin‑Wschód in Lublin seated in Świdnik, 6th Commercial Division

Contact for data protection matters: desk@weguide.ai (please put "Data protection" in the subject line).

We have not appointed a data protection officer — we are not required to at our current scale. We review that assessment periodically and will state it here if it changes.

In Japan, Yamagiri G.K. (合同会社), Kyoto, is present locally as a licensee of our platform. It is not a controller of your data. We are responsible for your data whichever country you use the service in.

2. Two layers: the app and the website

The rules differ depending on where you are. We keep them apart, because mixing them obscures the picture.

3. What data we collect

3.1 Data you provide

• Account: first name, e‑mail address, country, language, display currency.
• Preferences: interests, travel style, accessibility needs, age — if you give them.
• External sign-in: if you sign in through an identity provider, we receive your name, e‑mail address and an identifier. We do not receive your password.
• Conversations with the guide: the content of your questions and statements, spoken and typed.
• Correspondence: enquiries, complaints, messages to us.
• Your content: reviews, ratings, photos including the data stored in the file.

3.2 Data collected automatically

• Location — the precise position of your device during an active trip.
• Trip telemetry — places visited, time spent, engagement with content.
• Technical data — device model, operating system, app version, language settings, IP address, diagnostic data and error reports.
• Usage data — features used, how a session unfolded.

3.3 Payment-related data

We receive confirmation of the transaction, the amount and an identifier from the payment provider. We do not collect or store your full card details.

4. Why we process data and on what basis

5. Location — the most sensitive category

We treat it separately, because it is the most sensitive thing we know about you: where you were, and at what time, throughout your stay in an unfamiliar city.

1. We collect precise location only during an active trip — to start the narration in the right place, guide you, and steer you away from crowds.
2. You can switch off location access in your device settings at any time. The service will then stop working — not because we decided so, but because you cannot guide someone whose position you do not know.
3. We keep the location trail for 90 days, then anonymise it. After that only statistical information remains, which cannot be linked back to you. We do this because after a few weeks the trail no longer has value for the service, while the risk of holding it does not diminish.
4. You can ask us to delete your location history earlier — write to desk@weguide.ai.

6. Artificial intelligence

1. The guide is an artificial intelligence system. To prepare the narration and answer your questions it processes your first name, interests, history of places visited, current location and the content of the current conversation.
2. We do not use your data to train artificial intelligence models. With the providers that process data on our behalf, use of that data for training is switched off.
3. No human reads conversations as they happen. Access to conversation content is exceptional — where you make a complaint that requires checking it, where we investigate a security incident, or where the law requires it.
4. The system makes no decisions producing legal effects concerning you or similarly significantly affecting you. Automation concerns the content you receive, not your rights.
5. You can ask us to look at how the system behaved in your case — write to desk@weguide.ai.

7. Advertising

In the app. The advertising is our own — it concerns our service, particular routes or regions. We serve it identically to all users on a given plan. We do not tailor it to your profile, we store no identifier on your device for that purpose, and we pass no data to third parties in connection with it. Audio advertising is clearly separated from the guide's narration and marked as advertising — the guide never urges you to buy during the story.

On the website. We use third-party marketing and measurement tools (Meta and Google) and the Microsoft Clarity analytics tool. They run only after you consent and you can withdraw that consent at any time. See sections 8 and 11.

8. Who we share data with

We do not sell your data. We share it only with those we need in order to run the service.

We will give you the full list of recipients by name on request — write to desk@weguide.ai.

We may also disclose data to public authorities where the law requires it, and to advisers and auditors to the extent needed to run our business.

The provider of the footfall data we use to plan routes receives no data about you. It supplies us with information about places, not about people.

9. Joint controllership with Meta and Google

For the marketing tools on the website, we determine the purposes of processing jointly with Meta and Google. This means that:

• we are responsible for placing those tools on the site, for obtaining your consent before they run, and for informing you;
• they are responsible for the further processing of the data once received, including handling your rights against them;
• you can exercise your rights against either of us, independently. If you write to us, we will pass the matter on and help you pursue it.

We will make the essence of these arrangements available to you on request.

10. Transfers outside the European Economic Area

Our servers are located in the European Economic Area.

Some of our providers are, however, US entities or belong to groups that transfer data to the United States. This concerns in particular ElevenLabs, Microsoft, Meta, Google, Stripe and Mailchimp.

Such transfers take place on one of two bases: a European Commission adequacy decision under the EU‑U.S. Data Privacy Framework — where the recipient concerned holds an active certification under that programme — or standard contractual clauses approved by the European Commission, supplemented by additional safeguards.

On request we will tell you which basis applies to a given recipient and provide a copy of the safeguards.

11. Cookies and access to your device

1. We use cookies and similar technologies on the website.
2. Without your consent, only those that are strictly necessary operate — to display the page, keep your session and maintain security. This follows directly from the law: storing information on your device and gaining access to it require consent unless they are necessary to deliver the service you asked for.
3. Analytics, marketing tools and recording of behaviour on the site run only after you consent.
4. You give consent in the choice panel shown on your first visit. You can withdraw it at any time — through the consent settings on the site or through your browser settings. Withdrawal does not affect the lawfulness of what we did before.
5. In the app we use equivalents of these technologies — local storage and session identifiers. Those that are not necessary for the app to work also run only after you consent.

12. How long we keep data

Deleting your account does not delete everything — and we want you to know that before you tap the button.

We delete: your profile, preferences, trip history, location trail, conversations with the guide, credit balance, your content.

We keep: accounting records relating to purchases, for the period required by tax law. We use them for no other purpose.

Deleting your account also means losing unused credits, any active plan and access to signature routes you bought. We remind you of this on the deletion screen, before you confirm.

Backups of our systems may contain deleted data for up to 30 days, after which they are overwritten.

13. Your rights

You can:

• access your data and receive a copy;
• rectify inaccurate data or complete incomplete data;
• erase your data — including by deleting your account;
• restrict processing;
• port your data to another provider in a commonly used format;
• object to processing based on our legitimate interest;
• withdraw consent at any time, where we process data on that basis;
• lodge a complaint with a supervisory authority.

Write to desk@weguide.ai. We reply within one month; for complex matters we may extend that, telling you and giving the reason. We may ask you to confirm your identity — so that we do not hand your data to someone else.

Supervisory authority in Poland: President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00‑193 Warsaw, uodo.gov.pl. If you live in another country of the European Economic Area, you can also complain to the authority there. If you are in Japan — to the Personal Information Protection Commission.

14. Security and reporting incidents

1. We transmit data over encrypted connections, limit access to those who need it, and monitor our systems for errors and unauthorised access.
2. Internally, responsibility for data protection is personal: decisions on data protection matters and contact with the supervisory authority rest with the Chief Executive; technical detection and containment of incidents with the Chief Technology Officer. Either may act alone in place of the other, with no further formalities.
3. If you notice anything worrying — a vulnerability, a leak, someone else's data on your screen — write immediately to desk@weguide.ai with "Incident" in the subject line. We check the inbox every day and handle messages marked this way as a priority.
4. If a personal data breach occurs that is likely to result in a high risk to you, we will notify you without undue delay, describing what happened, which data it concerns and what we are doing.
5. No safeguards are absolute. That is why we keep data for short periods — the less we hold, the less can be lost.

15. Children and young people

The service is available to people aged 13 and over; those under 18 may use it with the consent and under the supervision of a guardian. We do not target the service at children under 13 and do not knowingly collect their data. If we learn that an account was created by someone younger, we will delete it together with the data. A guardian can contact us about the data of a person in their care at desk@weguide.ai.

16. Changes to this policy

We may change this policy when the service, the law or the way we process data changes. We will notify you of material changes by e‑mail and in the app at least 14 days before they take effect. The version date is always at the end of this document.

17. Services not yet launched

For completeness: we plan a group-trips feature and a persistent interest profile built from conversations with the guide. Neither is live today and neither processes your data. Before we launch them, we will describe them here and notify you of the change.

Version 1.1 · 12 August 2026 · effective 1 September 2026 Replaces the Privacy Policy of 20 March 2026.