Privacy notice

Who is responsible

[TODO: controller name.] [TODO: full legal name and postal address.] Contact: [TODO: contact address, not live yet].

What we collect

When you send a request for an experience, we collect your name, your email address, a message, your preferred dates in your own words, your group size, your guest group, and the page you came from. Our other forms collect only what each form asks for, for example your name, email address, your interest or experience idea, and your consent. Phone numbers are optional.

We do not collect payment details, and nothing is charged on this site.

Why we collect it

To reply to you, to assess Host applications, to plan experiences and events, and to understand which experiences people want. We do not sell your data or use it for advertising.

Where your request goes

The request form is run by Tally. We also keep a copy of your request in our own database, which is hosted at Cloudflare.

At the moment the Hosts and experiences on this site are examples. For a request about an example Host or experience, nobody but Localbird sees your request, and no Host is contacted.

If your request is for a real Host, we would email that Host your first name, your group size, your dates and your message, so they can answer. Your email address and contact details would not be included in that email. We would also email you about your request, through the email provider named below. [TODO: legal wording.]

Who processes it

• Tally: our form processor. Form submissions are stored on Tally's servers in the European Union. [TODO: confirm Tally's legal entity and its data processing agreement.]
• Cloudflare: hosts this website and delivers it securely. For requests it also hosts our database and runs the scheduled jobs that go with it. Cloudflare processes technical data such as IP addresses to serve pages and protect the site. [TODO: confirm the Cloudflare legal entity, where the database is stored and the data processing terms.]
• Resend: our email provider. It sends the emails that go with a request, including notes to Localbird, and so processes your email address and the message. Resend is a US company, so your data may be stored in the US. [TODO: confirm Resend's legal entity, the transfer safeguards and the data processing terms.]
• Google reCAPTCHA (Google): if enabled on a form to block spam, it processes technical data from your browser. [TODO: confirm whether reCAPTCHA is enabled.]
• Cloudflare Web Analytics: counts page views without cookies, without local storage and without fingerprinting, and does not collect visitors' personal data. [TODO: applies only once the analytics beacon is switched on; it is off today.]
• [TODO: Google Sheets, only if we choose to sync submissions there; data would then leave the EU and Switzerland.]

Cookies

This site sets no cookies of its own, and our analytics are cookie-free. The embedded Tally forms may use technically necessary storage to work.

How long we keep it

We keep the personal details in a request for 90 days after the request was last updated. After that we delete them, and keep only the request number, its status and when it was sent and last changed, with no personal data, for 12 months. [TODO: how long the submissions of our other forms are kept.]

We delete the Tally copy of a request on the same 90-day rule. [TODO: keep this sentence only once the deletion of Tally responses is running.]

After we delete a request from our database, a copy can stay in Cloudflare's database backups for up to 7 days before it is gone. The email provider keeps message logs for up to 30 days.

Your rights and how to ask

You can ask for a copy of what we hold about you, have it corrected or deleted, withdraw your consent, and object to processing. Write to [TODO: contact address, not live yet]. You can also complain to the Swiss data protection authority (FDPIC) or, in the EU, to your local data protection authority.

If you are invited to be a Host

Hosts join by invitation. If you are invited, we would use your email address only to send you requests from guests and to get in touch about hosting, and you may leave at any time. If you leave, we would delete your email address 30 days after you leave at the latest, or sooner if you ask. [TODO: legal wording for Host data.]