Cuyo Privacy Policy

Effective Date: July 15, 2026

Last Updated: July 15, 2026

1. Introduction

Welcome to Cuyo.

Your privacy is important to us. This Privacy Policy explains how Cuyo (“Cuyo”, “we”, “our”, or “us”) collects, uses, stores, shares, and protects your personal data when you use our website, mobile application, digital audio tours, and related services (collectively, the “Services”).

We are committed to processing personal data in accordance with applicable data protection laws, including the General Data Protection Regulation (“GDPR”) where applicable.

By using our Services, you acknowledge that your personal data will be processed as described in this Privacy Policy.

2. Data Controller

Cuyo

Kevin Winhard

Senserstr. 18

81371 Munich

Germany

Email: hello@cuyo.io

VAT ID: to be added

3. Scope of this Privacy Policy

This Privacy Policy applies to:

• the Cuyo website

• the Cuyo mobile application

• digital audio tours

• temporary Shared Tours

• customer support communications

• our waiting list

• any future services unless a separate privacy notice is provided

4. Information We Collect

Depending on how you use our Services, we may collect different categories of personal data.

Information you provide

This may include:

• email address

• first name

• authentication information

• support requests

• waiting list registration

• communications with us

Account information

If you create an account, we may process:

• account identifier

• authentication provider

• email address

• first name

• purchase status

Purchase information

Purchases are processed through Apple App Store or Google Play.

We do not receive or store your payment card details.

We may receive information necessary to verify purchases, including:

• purchased products

• purchase status

• transaction identifiers

• subscription or entitlement status (where applicable in the future)

5. Location Data

During an active tour, Cuyo requests access to your device location.

Location information is used exclusively to:

• determine your progress

• provide navigation assistance

• unlock location-based content

• synchronize temporary Shared Tours where applicable

Location access may continue while the application is running in the background during an active tour.

Cuyo does not permanently store continuous location history after the completion of a tour.

6. Authentication

You may access the Services using:

• Sign in with Apple

• Google Sign-In

• email and password

• Guest Mode

Authentication providers process personal data according to their own privacy policies.

7. Waiting List

If you voluntarily join our waiting list, we process the email address you provide.

Purpose of processing:

• notify you about product launches

• updates

• invitations

• important announcements

Storage provider:

Placeholder – to be updated before launch.

You may unsubscribe at any time using the unsubscribe link included in our communications or by contacting us directly.

8. Customer Support

If you contact us by email, we process the information you voluntarily provide, including:

• your email address

• your message

• any attachments

• any additional information necessary to respond to your request

We use this information solely to communicate with you and resolve your inquiry.

9. How We Use Your Information

We process personal data to:

• provide our Services

• authenticate users

• manage purchases

• enable Shared Tours

• improve navigation

• respond to customer support requests

• maintain account security

• comply with legal obligations

• prevent fraud and abuse

• improve our Services

We process personal data only where we have an appropriate legal basis under applicable law.

10. Legal Bases

Where the GDPR applies, our legal bases may include:

• performance of a contract

• compliance with legal obligations

• legitimate interests

• your consent where required

Whenever consent is required, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

11. Service Providers

To operate and improve our Services, we may engage trusted third-party service providers that process personal data on our behalf or as independent controllers where applicable.

Depending on the Services you use, these providers may include:

• Supabase (backend infrastructure)

• Apple (authentication and App Store purchases)

• Google (authentication and Google Play purchases)

• Hosting providers

• Email service providers

• Analytics providers

• Cloud infrastructure providers

• Customer support providers

• Security providers

We carefully select our service providers and require them to protect personal data in accordance with applicable data protection laws.

A current overview of third-party services is maintained in our Third-Party Services document.

12. Supabase

Our application currently uses Supabase to provide backend infrastructure and account-related services.

Supabase may process information necessary to:

• authenticate users

• manage user accounts

• store account information

• verify purchases

• provide backend functionality

• operate databases

• secure our infrastructure

Supabase processes personal data in accordance with its own privacy documentation and applicable data protection laws.

13. Apple and Google Authentication

Users may choose to authenticate using Sign in with Apple or Google Sign-In.

These authentication providers independently determine which information is shared with Cuyo based on your account settings and permissions.

Typically, this may include:

• your email address

• your name

• a unique authentication identifier

Authentication providers remain independently responsible for their own processing activities.

14. App Store Purchases

Purchases are processed exclusively through Apple App Store or Google Play.

Cuyo does not collect or store payment card information.

We may receive purchase verification information required to unlock purchased digital content and prevent fraud.

Payment processing is governed by the privacy policies and terms of the respective marketplace.

15. Cookies

Our website may use cookies or similar technologies.

At the time this Privacy Policy becomes effective, some cookie categories may not yet be active.

Should additional cookies be introduced in the future, this Privacy Policy and, where legally required, our Cookie Policy and consent mechanisms will be updated accordingly.

Cookies may be used for purposes including:

• website functionality

• user preferences

• analytics

• security

• fraud prevention

• performance monitoring

Where required by law, we will request your consent before placing non-essential cookies.

16. Analytics

We continuously improve our Services.

Mobile Application

Our mobile application currently uses PostHog for product analytics, performance monitoring, and product improvement.

Analytics data helps us understand, among other things:

• feature usage

• crashes

• navigation flows

• product performance

• anonymized usage patterns

Where required by applicable law, analytics processing is performed only after obtaining the necessary user consent.

Website

Analytics for the website may be introduced in the future.

If implemented, this Privacy Policy will be updated before such processing begins.

17. Push Notifications

The Cuyo application may offer push notifications in the future.

If enabled, users may receive notifications relating to:

• purchased tours

• product updates

• account security

• reminders

• feature announcements

• marketing communications (where consent is required)

Users may disable push notifications at any time through their device settings.

18. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy or as required by applicable law.

Retention periods depend on the type of data involved, legal obligations, contractual requirements, and legitimate business interests.

When personal data is no longer required, it will be deleted, anonymized, or securely destroyed.

19. International Data Transfers

Because Cuyo serves users worldwide, personal data may be processed in countries outside your country of residence.

Where required by applicable law, we implement appropriate safeguards for international transfers, including Standard Contractual Clauses or other legally recognized transfer mechanisms.

20. Security

We implement appropriate technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, or destruction.

These measures may include:

• encrypted communications

• access controls

• authentication mechanisms

• infrastructure monitoring

• regular security improvements

Despite reasonable efforts, no internet transmission or electronic storage system can be guaranteed to be completely secure.

Users should also take reasonable steps to protect their own accounts and devices.

21. Your Rights

Where applicable under data protection law, you may have the right to:

• access your personal data

• correct inaccurate information

• request deletion

• request restriction of processing

• object to certain processing activities

• request data portability

• withdraw consent

• lodge a complaint with a competent supervisory authority

Requests may be submitted to:

hello@cuyo.io

We may request additional information to verify your identity before responding to certain requests.

22. Children’s Privacy

Cuyo is not directed at children under the minimum age required to use the Services.

If we become aware that personal data has been collected from a child in violation of applicable law, we will take appropriate steps to delete such information.

Parents or legal guardians who believe that a child has provided personal data may contact us at any time.

23. Third-Party Links

The Services may contain links to third-party websites, businesses, attractions, ticket providers, restaurants, museums, or other external resources.

We are not responsible for the privacy practices or content of those third parties.

Users should review the privacy policies of external services before providing personal information.

24. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• legal developments

• technical changes

• new features

• additional service providers

• security improvements

• changes to our business operations

The updated version will always be published with a revised “Last Updated” date.

Where required by applicable law, users will be informed of material changes before they become effective.

25. Contact