Privacy Notice

Here Got What is a service operated by YS Tang ("we", "us", "our"), an individual sole trader. This Privacy Notice describes how we collect, use and share personal information when you use our website and services ("Service"). For the purposes of applicable data protection laws, YS Tang is the data controller of your personal information. You can contact us at hello@heregotwhat.app.

• Account data: name, email address, password hash, and (if you sign in with Google) your Google account identifier and profile email.
• Tour content: tours, stops, photos, audio recordings, AI-generated narration, storyboards, descriptions and other content you upload.
• Location data: approximate or precise location when you ask us to find places near you (only with your permission).
• Voice / live-tour data: if you enable live voice broadcasting, we store the Agora App ID / certificate or LiveKit credentials you provide, the room identifiers your sessions create, and per-minute usage metering. Voice audio itself is streamed in real time through Agora or LiveKit and is not recorded by us.
• Push notification subscriptions: if you opt in to browser push notifications, we store your push endpoint and VAPID keys so we can notify you when long-running jobs (e.g. AI narration) finish.
• Support messages: emails or messages you send us, including questions submitted to tour guides through tour Q&A forms.
• Usage data: pages viewed, features used, error logs, device and browser information, IP address.
• Cookies and similar technologies: see Section 9.

• To create and operate your account and provide the Service.
• To deliver features you request, including AI generation, transcription, narration, walking maps and live voice broadcasting.
• To process payments for paid tokens (handled by Stripe, see Section 5).
• To respond to your support requests and messages.
• To detect, prevent and investigate fraud, abuse and security incidents.
• To improve the Service through analytics and product research.
• To comply with legal obligations.

Where applicable law (such as the UK or EU GDPR) requires us to identify a legal basis, we rely on:

• Contract: to provide the Service and account features you sign up for.
• Legitimate interests: to keep the Service secure, prevent fraud, and improve our product.
• Consent: for optional features such as precise location, push notifications, marketing emails and non‑essential cookies. You can withdraw consent at any time.
• Legal obligation: to comply with tax, accounting and other legal requirements.

We share personal information only with the following categories of recipients, who act as our processors / subprocessors and may only use the data on our instructions:

• Hosting, database & auth: Supabase (managed Postgres + auth) and Cloudflare (edge runtime, CDN, R2 object storage for photos and audio).
• AI providers: Google (Gemini), OpenAI and ElevenLabs for text generation, translation and text-to-speech narration. Prompts and inputs you submit are transmitted to these providers solely to produce the output you requested.
• Live voice & signalling: Agora and LiveKit, when you enable live voice broadcasting using your own credentials (see Terms §9a).
• Places data: Foursquare and OpenStreetMap (Nominatim) for place search and geocoding. Only the search query and approximate location are sent.
• Push delivery: the W3C Web Push services operated by your browser vendor (e.g. Google FCM, Mozilla autopush, Apple APNs).
• Payment processor: Stripe handles payment, billing and tax calculation. Card details are submitted directly to Stripe and are never stored on our servers. Here Got What is the seller of record.
• Professional advisers: lawyers, accountants and auditors when needed.
• Authorities: where required by law, court order or to protect our rights and the safety of users.
• Successors: in connection with a merger, acquisition or sale of assets, subject to confidentiality.

We do not sell your personal information.

Several of the service providers listed in Section 5 are located outside your country of residence, including in the United States (Cloudflare, Stripe, OpenAI, ElevenLabs, Google, Agora, LiveKit). Where personal data is transferred from the UK or EEA to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable), together with any supplementary measures the recipient has put in place (encryption in transit, access controls, sub-processor audits). You can request a summary of the safeguards in place for a specific provider by emailing hello@heregotwhat.app.

We keep personal information only for as long as needed to provide the Service, comply with our legal obligations and resolve disputes. When data is no longer needed, we delete or anonymise it.

You can delete your account at any time from Account → Delete my account. On deletion we permanently erase: your auth account, email, profile, display name, AI narration audio, storyboards, short-form stories, credit wallet and ledger, live-tour billing records, push-notification subscriptions, voice tokens and Agora / LiveKit credentials.

What we keep, in anonymised form: tours, tour stops and Local Gems you contributed remain visible to the community under "Former contributor", with all personal photos and AI narration audio removed. Other travellers may already rely on these places, so we keep them rather than delete them. Stripe retains transaction records as required for tax and legal compliance. Backups are purged on their normal rotation (within 30 days).

Inactive accounts. To keep the platform sustainable we run an automated dormancy sweep on accounts that have not signed in for a long time. After 12 months of no sign-in your storage cap is reduced to 100 MB and your oldest media (narration audio first, then photos) is deleted to bring you under the cap. After 24 months of no sign-in all remaining media is deleted and your tours / Local Gems are anonymised under "Former contributor". We send a warning email 30 days before each step. Signing in at any point resets the clock — no penalties. Your wallet balance is never expired by inactivity.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your personal information.
• Restrict or object to certain processing.
• Receive a portable copy of your data.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with your local data protection authority.

The fastest way to exercise the right to erasure is the in‑app Delete my account button under Account. For access, correction, export or any other right, email us at hello@heregotwhat.app. We will respond within one month.

We currently only use cookies and local storage that are strictly necessary for the Service to function — for example, keeping you signed in and remembering your preferences. We do not set advertising or third-party analytics cookies. If we add non-essential analytics in the future, we will ask for your consent first via an in-app banner and update this notice.

We use appropriate technical and organisational measures to protect your personal information, including encryption in transit (TLS), encryption at rest for the database and object storage, role-based access controls, row-level security on user-scoped data, and regular dependency and security scans. No system is completely secure, so we cannot guarantee absolute security.

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where the breach is likely to result in a high risk to you, we will notify affected users without undue delay, in line with Articles 33 and 34 of the UK/EU GDPR.

The Service is not directed to children under 16, and by creating an account you confirm you are at least 16 years old (or the higher digital-consent age applicable in your country). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

User-submitted content (tours, stops, hidden gems, storyboards, photos, narration) is screened by automated moderation and may be removed if it appears to break the rules in our Terms (for example, contact details, promotional content, illegal or unsafe content). If your content is removed and you believe the decision is wrong, you can appeal by emailing hello@heregotwhat.app within 30 days. We will review the decision and respond, normally within 14 days.

We may update this Privacy Notice from time to time. When we do, we will change the "Last updated" date above and, where appropriate, notify you in the Service.

For questions about this Privacy Notice, email hello@heregotwhat.app.