Last updated: May 2026

1 Data controller

Name: Carlos Benito
NIF: 38459297P
Address: Calle Llull 13 Ático 1, 08005 Barcelona (Spain)
Contact email: ando@ando.tours

2 Personal data we collect

Through the website (ando.tours)

• Registration and login data: name, email address, and Google authentication data (when you use Google Sign-In).
• Purchase data: name, email address, billing details. Payment data (card details) are processed directly by Stripe and are not stored on our systems.
• Browsing data: IP address, browser type, pages visited, time spent. Collected through technical and analytics cookies (Google Analytics).
• Contact data: when you fill in the contact form, we collect your name and email address.

Through the ANDO app

• Authentication data: name and email address from your Google or Apple account.
• Device identifier (deviceId): randomly generated on your device to link your access code. It is not a personal identifier.
• Usage data: redeemed route code, download status, playback time. Stored in Firebase (Google Cloud, region europe-southwest1).
• GPS location data: only during active playback of a route, to display your position on the map and detect proximity to waypoints. Not stored on any server.

3 Purpose and legal basis for processing

• Purchase management and service delivery: Performance of a contract (Art. 6(1)(b) GDPR).
• Authentication and account access: Performance of a contract (Art. 6(1)(b) GDPR).
• Support communications: Legitimate interest and performance of a contract (Art. 6(1)(b) and 6(1)(f) GDPR).
• Web analytics and service improvement: Legitimate interest (Art. 6(1)(f) GDPR). You may object at any time.
• Marketing communications: Express consent (Art. 6(1)(a) GDPR). We will only send you marketing communications if you have expressly requested them.

4 Retention period

• Account and purchase data: retained for as long as you maintain an active account and for an additional 5 years from the last purchase, due to tax and commercial obligations.
• Access codes in Firestore: for the duration of the code validity (48 hours of access), plus an additional 30 days in case issue resolution is needed.
• Web browsing data: maximum 26 months (as per Google Analytics 4 configuration).

5 Recipients and transfers

Your data will not be shared with third parties except in the following cases, which are necessary for the provision of the service:

• Stripe Inc. (payment processing): policy at stripe.com/privacy.
• Google LLC (Firebase, Google Sign-In, Google Analytics, Google Maps): subject to EU Standard Contractual Clauses.
• Apple Inc. (Apple Sign-In, App Store): policy at apple.com/legal/privacy.
• Cloudflare Inc. (audio storage on R2): subject to DPA with Cloudflare.

We do not carry out international transfers outside the European Economic Area except with the providers listed above, which have appropriate safeguards in accordance with the GDPR.

6 User rights

You may exercise the following rights by sending an email to ando@ando.tours with the subject line “Data protection” and a copy of your ID document:

• Access: know what personal data we process about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure (“right to be forgotten”): request the deletion of your data when it is no longer necessary.
• Objection: object to processing based on legitimate interest.
• Restriction of processing: request the suspension of processing in certain cases.
• Portability: receive your data in a structured and commonly used format.

If you believe that the processing is not compliant, you may file a complaint with the Spanish Data Protection Agency (aepd.es).

7 Security

ANDO implements appropriate technical and organisational measures to protect your data: AES-256 encryption for audio storage on the device, time-limited signed URLs for content downloads, delegated authentication to Google/Apple (we do not store passwords), and rate limiting to prevent abuse.

8 Minors

The service is intended for persons aged 14 and over. We do not knowingly collect data from persons under the age of 14. If you become aware that a minor has provided data without consent, please contact us at ando@ando.tours.

9 Changes

This policy may be updated to reflect legal or service changes. When we do so, we will publish the new version on this page with the date of update. For substantial changes, we will notify you by email.