Section 1: Data Controller

Resounding Histories is the data controller responsible for your personal data. You can contact us at hello@resoundinghistories.com. We are based in Barcelona, Spain. We are committed to processing your data in compliance with the General Data Protection Regulation (GDPR), the Spanish Organic Law on Data Protection (LOPDGDD), and other applicable data protection laws.

Section 2: Information We Collect

Data you provide directly: your email address (provided at the time of purchase to receive your redemption code and receipt), your name (if provided during purchase), and any communications you send us via email for support, feedback, or refund requests. Payment information is processed and stored exclusively by Lemon Squeezy; we do not receive or store your full card number.

Data collected automatically: device information (device model, operating system version, and app version) for compatibility and debugging purposes; tour progress data (which stops you have visited and your playback position), stored locally on your device; and anonymized crash and performance data to help us improve the app.

Location data: The app requests access to your device's location services to provide GPS navigation between tour stops. Location data is processed on-device only, never transmitted to our servers, and entirely optional — you can deny location permissions and navigate manually.

Section 3: Data We Do Not Collect

We do not collect browsing history, contacts, photos, or any data from other apps on your device. We do not use advertising identifiers (IDFA) or participate in ad tracking networks. We do not create user profiles for advertising purposes. We do not sell, rent, or trade your personal data to third parties for their marketing purposes.

Section 4: How We Use Your Information

For contract performance (Art. 6(1)(b) GDPR): delivering your purchased tour content and redemption code, processing payments, providing customer support, and enabling offline downloads and tour playback.

For legitimate interests (Art. 6(1)(f) GDPR): analyzing anonymized crash and performance data, communicating with you about your purchase, and preventing fraud.

With your consent (Art. 6(1)(a) GDPR): sending promotional emails about new tours or features (opt-in only; you may unsubscribe at any time) and processing location data when you grant permissions.

Section 5: Third-Party Disclosure

We share your personal data only with the following recipients and only as necessary: Lemon Squeezy (payment processor — receives your payment information to process transactions); Apple (app distribution via the App Store); privacy-focused analytics providers that process only anonymized or aggregated data; and legal authorities if required by law.

We do not sell your personal data. We do not share your data with advertisers. We do not use your data for profiling or automated decision-making.

Section 6: Data Retention

Purchase records and email addresses are retained for the duration of our business relationship plus 5 years for tax and legal compliance. Support correspondence is retained for 2 years from resolution. Anonymized crash and performance data is retained for up to 12 months. Tour progress data is stored locally on your device and deleted when you uninstall the app.

Section 7: Your Rights (GDPR)

Under the GDPR, you have the right to: access a copy of your personal data; rectify inaccurate or incomplete data; request erasure of your data (subject to legal retention obligations); restrict processing in certain circumstances; receive your data in a portable format; object to processing based on legitimate interests or direct marketing; and withdraw consent at any time.

To exercise any of these rights, contact us at hello@resoundinghistories.com. We will respond within 30 days. If you are unsatisfied with our response, you may lodge a complaint with the Spanish Data Protection Authority (AEPD) at aepd.es, or with your local supervisory authority.

Section 8: International Data Transfers

Our primary data processing occurs within the European Economic Area (EEA). Where data is transferred outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

Section 9: Data Security

We implement appropriate technical and organizational measures to protect your personal data, including encryption of data in transit (HTTPS/TLS), secure payment processing through Lemon Squeezy, on-device storage of tour progress and location data, and limited access to personal data on a need-to-know basis. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Section 10: Children's Privacy

Our services are not directed at children under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe we have collected data from a child under 16, please contact us at hello@resoundinghistories.com and we will delete the data promptly.

Section 11: Cookies

Our website may use essential cookies required for basic site functionality. We do not use cookies for advertising or tracking purposes.

Section 12: Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification. The date at the top of this page indicates when the current version became effective.

Section 13: Contact Us

For questions or concerns about this Privacy Policy or your personal data, contact us at hello@resoundinghistories.com.

Resounding Histories — Barcelona, Spain