Privacy Policy
Learn how we collect, safeguard, and respect your personal exploration details.
1. Information We Collect
We collect personal information to provide and improve our Services. This includes:
- Account Credentials: Username, email address, and encrypted passwords used for authentication.
- Profile Information: Optional information you provide, such as your biography, nationality, birthday, location, and profile photograph.
- User Content: Landmark reviews, itinerary plans, photographs, messages shared with friends, and trivia responses.
- Device & Usage Information: IP addresses, browser types, operating systems, and platform interaction histories.
- Location Data: With your permission, we collect precise or approximate geographic coordinates to power mapping features. You can disable this in your device settings.
- Photo Uploads & EXIF Metadata: When you upload photos for memories or trip covers, we temporarily extract location (GPS) and date taken metadata on the client side to suggest location tags or verify visits. During the server-side upload process, however, the image is re-encoded as a progressive JPEG and all EXIF/GPS metadata is permanently stripped from the stored file to safeguard your location privacy.
- Billing Information: For Vestigia+ Premium subscriptions, we collect billing details and pass them securely to Stripe. We do not store or process your credit card numbers on our servers.
In Plain English
We collect information you explicitly provide (like account info, travel reviews, and photos) and technical usage data (like your IP address and optional location data).
2. How We Use Your Information
We process your personal data for the following operational and legal purposes:
- To provide, personalize, and improve our core Services.
- To run interactive maps, trivia challenges, and custom itinerary suggestions.
- To manage your account, authenticate sessions, and protect against security breaches.
- To facilitate communications between you and other community members.
- To communicate updates, security alerts, and support messages.
- To comply with regulatory guidelines and legal demands.
In Plain English
We use your data to power the interactive map, authenticate your login, suggest routes, and make sure the application stays secure.
5. Data Retention & Erasure
We retain your personal data for as long as your account remains active or as required to fulfill the purposes highlighted in this policy.
You can delete your account at any time. When deleted, all profile details, saved trips, and location data are permanently purged from active databases, subject to standard backup recovery retention periods.
In Plain English
Your data stays as long as you keep your account. If you choose to delete your account, your data is erased from our servers.
6. Your Rights (GDPR & CCPA/CPRA)
Depending on your location (such as the European Union under GDPR or California under CCPA/CPRA), you possess specific statutory rights regarding your personal information:
For EEA/UK Residents (GDPR):
- Right of Access & Portability: Request copies of your data in structured formats.
- Right to Rectification & Erasure: Edit incorrect data or request permanent deletion (right to be forgotten).
- Right to Object & Restrict Processing: Limit how we compute your information, including opting out of advertising cookies via Necessary cookies only in our banner.
For California Residents (CCPA/CPRA):
- Right to Know: Request disclosures of what personal data we collect and share.
- Right to Delete: Request deletion of your collected details.
- Right to Correct: Rectify inaccurate personal information.
- Right to Non-Discrimination: Equal service quality even if you exercise privacy rights.
- Right to Opt Out of Sale/Sharing: Choose Necessary cookies only in our cookie banner to disable advertising/partner cookies where applicable.
To exercise any of these rights, please contact us at [email protected].
In Plain English
Users in the EU and California have rights to access, correct, delete, or export their personal data. We respect these globally.
7. Children's Privacy
Vestigia is not intended for children under 13 years of age. We do not knowingly collect personal data from anyone under 13.
If we become aware that we have collected information from a child under 13 without verified parental consent, we will take immediate steps to delete those records.
In Plain English
We don't knowingly collect data from children under 13. Please contact us if you believe a minor has shared info with us.
8. Security Measures
We use robust technical and administrative security measures (including HTTPS transit encryption, database-level encryption at rest, and secure role-level authentication policies) to protect your personal details.
While we take all reasonable precautions, no internet-based service can guarantee complete protection against all unauthorized breaches.
In Plain English
We use secure HTTPS connections and database encryption via Supabase to shield your data. No system is completely unhackable, but we follow industry standards.
9. Changes to This Policy
We may update this Privacy Policy periodically to reflect shifts in technology, regulation, or services.
We will revise the "Effective Date" at the top and distribute notifications if modifications are significant.
In Plain English
We will update this page for major revisions. Check the date at the top to see when it was last changed.
10. Contact Us
If you have questions, complaints, or request queries concerning your privacy on Vestigia, please contact our team:
Email: [email protected]
In Plain English
Reach out to [email protected] for privacy concerns or details requests.