Privacy Policy

Last updated: 11 October 2026

1. Who we are

TellTourer OÜ, registry code 17493478, registered office at Leevikese 1a-7, 50413, Tartu, Estonia, is the data controller for the personal data described in this Policy. You can reach us at [email protected].

This Policy explains how we process personal data when you buy access to one of our self-guided audio tours (each a "Tour"), use our web application (the "Service"), or contact us. We have designed the Service to collect as little personal data as possible: it requires no user account, sets no advertising or analytics trackers, and sends no marketing messages.

2. Purchases through Booking.com and Bókun

Tours are purchased through Booking.com. Booking.com processes your payment and purchase data as an independent data controller under its own privacy policy. We do not receive your payment details.

To deliver your access code and manage bookings, we use Bókun, a booking platform operated by Tripadvisor LLC dba Bókun, which acts as our data processor. Through Bókun we receive booking data: your name, e-mail address (which may be a masked relay address provided by Booking.com), booking reference, and the Tour and travel date. Because Bókun is based in the United States, this data may be transferred outside the EEA; such transfers are protected by the safeguards set out in Bókun's data processing terms.

Once your booking is confirmed, we use your e-mail address to send you your access link. These e-mails are sent through Amazon Simple Email Service (Amazon Web Services), which acts as our processor.

We use this data to issue your access code, provide the Tour you purchased, handle cancellations and refunds, respond to booking-related questions, and meet our legal obligations. The legal bases are performance of a contract (Article 6(1)(b) GDPR) and compliance with legal obligations, in particular accounting law (Article 6(1)(c) GDPR).

3. Location and maps

To show your position on the Tour map, the Service uses your device's location. Your browser will ask for permission before location is accessed, and you can withdraw it at any time in your browser settings (the map will then not show your position).

Your precise location is processed only on your device. We do not receive, store, or log your GPS coordinates.

Map display is provided by Mapbox (Mapbox, Inc., USA). When map tiles are loaded, Mapbox receives technical data such as your IP address and the map area requested, which reflects your approximate location. This data may be transferred to the United States under the EU–U.S. Data Privacy Framework. Mapbox's processing is described in its privacy policy.

4. Tour progress and favourites

When you finish listening to a stop's audio, the Service marks that stop as visited and stores this, with the time, on our servers, linked to your access code. Stops you mark as favourites are stored in the same way. We use this data to show your progress, restore your access if needed, and resolve support requests and refund questions (Article 6(1)(b) and 6(1)(f) GDPR). We do not use it for profiling, advertising, or analytics.

5. Cookies

The Service uses two strictly necessary cookies: a session cookie, which lets us recognise the Tours you have redeemed in this browser, and a security token that protects forms against misuse. Your redeemed access codes are kept in this session on our servers, not in your browser. These cookies are necessary to provide the Service you requested and are therefore used without a consent banner, in line with the ePrivacy rules. We set no advertising, analytics, or third-party tracking cookies.

6. When you contact us

If you email us at [email protected], we process your email address, name if you provide it, and the content of your message, in order to answer your request; for example to restore access to a redeemed Tour or handle a complaint. The legal basis is performance of a contract (Article 6(1)(b) GDPR) or our legitimate interest in responding to enquiries (Article 6(1)(f) GDPR). Our mailbox is provided by Fastmail Pty Ltd (Australia), acting as our processor under its Data Protection Addendum. We use Fastmail's EU (Amsterdam) hosting region; for resiliency, mailbox data is replicated to Fastmail's infrastructure in the United States, and such transfers outside the EEA are protected by the safeguards (including Standard Contractual Clauses) set out in Fastmail's Data Protection Addendum.

7. Technical data and hosting

When you use the Service, our web server processes technical data automatically: your IP address, browser type, requested pages and files, and timestamps. Server logs are used to operate the Service securely, prevent abuse, and diagnose faults (our legitimate interest, Article 6(1)(f) GDPR).

The Service is hosted on Laravel Cloud, a managed hosting platform operated by Laravel Holdings Inc. (USA), running on Amazon Web Services infrastructure in the European Union (EU Central (Frankfurt) region). Tour audio files are stored in the same region. Laravel Cloud acts as our processor under its data processing terms; any access to data from the United States is covered by the EU–U.S. Data Privacy Framework.

8. Who receives your data

We share personal data only with the providers named in this Policy. We may also disclose data where the law requires it, for example to tax authorities or courts. We do not sell personal data and we do not use it for advertising.

9. How long we keep data

• Booking data: 12 months after the end of your access window.
• Tour progress and favourites: 12 months after the end of your access window.
• Support correspondence: 12 months after resolution, unless a longer period is needed for a legal claim or required by law.
• Server logs: 30 days.
• Location data: not stored by us.
• Local storage: remains on your device until you clear it or the access window ends.

10. Your rights

Under the GDPR you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, and to data portability, in each case within the limits set by the GDPR. To exercise these rights, contact us at [email protected]; we will respond within one month. Note that with no user accounts, we may need your booking reference to locate data relating to you.

You also have the right to lodge a complaint with a supervisory authority - in Estonia, the Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) - or with the authority of the EU country where you live.

11. Changes to this Policy

We may update this Policy when our Service or the law changes. The current version, with its date, is always available at https://telltourer.com/privacy; material changes will be announced in the Service in advance.