Rong Zhu, operating as VoyAssist, is the data controller for the personal data described here. This notice explains what we collect, why, who we share it with, and the rights you have.
Data we collect and why
- Account data (email, password hash, sign-in provider ID) — to create and secure your account. Legal basis: performance of our contract with you.
- Trip data (destinations, dates, preferences, selected sights, generated itineraries) — to provide the planning and tour features. Legal basis: contract.
- Location data (device location while a tour is running) — to give you directions and trigger audio guidance at each sight. Processed only while you use tour mode. Legal basis: consent (your device permission), which you can withdraw at any time in your device settings.
- Voice recordings and transcripts — when you hold the ask button, your question is transcribed and sent to our AI provider to generate an answer. Legal basis: contract.
- Photos you take to ask a question — sent to our AI vision provider to answer that question. Legal basis: contract.
- Usage and technical data (IP address, device/browser type, tour counts, error logs) — to enforce free-tier limits, prevent abuse and fraud, and improve reliability. Legal basis: legitimate interests.
- Support messages — to answer your enquiries. Legal basis: legitimate interests.
We do not sell your personal data and we do not use your trip content for advertising.
Who we share data with
- Service providers / subprocessors — hosting and database providers, map and routing providers (Google Maps, Mapbox) for directions, and AI providers for itinerary generation, audio guidance and question answering.
- Paddle.com — our Merchant of Record for the sale of subscriptions and tour passes, subscription management, payments, tax compliance and invoicing. Paddle collects payment details directly; we never see your full card number.
- Professional advisers — legal and accounting, where necessary.
- Authorities — where required by law.
International transfers
Our providers may process data outside your country, including in the United States. Where data leaves the UK/EEA we rely on adequacy decisions or Standard Contractual Clauses with appropriate safeguards.
Retention
Account and trip data are kept while your account is active and for up to 12 months after you delete it or it becomes inactive, then deleted or anonymised. Voice recordings and photos are processed transiently to answer your question and are not stored long term. Billing records are retained by Paddle as required by tax law.
Security
We apply appropriate technical and organisational measures, including encryption in transit, access controls, row-level database security and least-privilege service credentials.
Cookies and local storage
We use strictly necessary cookies and browser storage to keep you signed in, remember your map provider preference, and cache directions to reduce API usage. We do not use advertising cookies. You can clear this data in your browser settings, though sign-in will stop working until you log in again.
Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or port your data, to object to processing based on legitimate interests, and to withdraw consent. If you are in the UK or EEA you can also complain to your supervisory authority. Email tzsmile2023@gmail.com and we will respond within one month.
Contact
Rong Zhu — tzsmile2023@gmail.com