Privacy

Last updated 12 November 2026

This notice covers the KUKUVIA audio guide at audioguide.kukuvia.com and live-tour bookings made on this site. We collect as little as we can: you can listen to the first stop without giving us anything.

Who we are

KUKUVIA, Obrt za usluge, Vl. Jelena Tanjić, Vukovarska 3, 21000 Split, Croatia · OIB 10177167823. We decide how your data is used (the “controller”). Questions or requests: info@kukuvia.com.

What we collect, and why

• When you buy the guide: Stripe handles the payment. We never see your card. Stripe sends us your email address and a payment reference, which we use to unlock the guide, let you sign in on another phone, and keep the purchase records Croatian accounting law requires.
• When you sign in with your email: we email you a 6-digit code that works for 10 minutes. We store your email address, the code only in scrambled (hashed) form, and a scrambled form of your IP address to stop abuse. We send you no other emails.
• Your access: your phone keeps a random access key so the guide stays unlocked. On our side it's linked to your purchase or the access code you used.
• Listening and follis: we record which stops you finished, when, and how much of each one you played, so rewards are fair. If you turn on location, your position is sent once per stop to check you're near it. We keep only the distance in metres, never your location. Auto-play by location happens on your phone, and so does the dot that shows where you are on the map: for that, your position is not sent to us at all.
• Local deals: when you unlock a partner's deal we record which deal and when it was used. Partners see monthly totals only, never who you are.
• Partner QR codes: if you open the guide from a partner's QR code, your phone remembers that partner for 30 days so a purchase can be credited to them. They see totals only.
• Booking a live tour: the name, email and other details you enter, and the payment through Stripe, are used to run your tour and keep the required records.
• Usage statistics: we count how the guide is used, for example which stops are started and how many people open the buy screen. We use PostHog on servers in the EU. These counts don't include your name or email, and payment links are removed. Nothing is stored on your phone for them, so a later visit isn't linked to an earlier one. Vercel measures page speed without cookies.

Stored on your phone

The guide saves on your phone, in the browser: your access key, your progress, the partner you came through (30 days), the email you signed in with, the tour list, the latest list of events, what you chose to see on the map, and any stops you downloaded to play offline. These are needed for the guide to work, and there are no advertising or tracking cookies. To remove them, clear this site's data in your browser settings. If you bought the guide or signed in, you can get your access back by signing in with your email.

Who processes data for us

• Supabase: our database and file storage (EU, Ireland)
• Vercel: website hosting
• Stripe: payments
• Resend: sends the sign-in code emails
• PostHog: usage statistics (EU)
• Mapbox: the map, which loads from Mapbox when you open it

Some of these companies are based in the USA. Where data leaves the EU, they rely on the EU–US Data Privacy Framework or the EU's standard contractual clauses. The narration is made with ElevenLabs from our own texts. None of your data is sent to ElevenLabs.

How long we keep it

• Purchases and bookings (email, payment reference, booking details): 11 years from the end of the year of the purchase, because Croatian accounting law (Zakon o računovodstvu) requires us to keep business records that long.
• Your sign-in email, listening progress and deals: while you use the guide, and deleted three years after your last visit, or sooner if you ask.
• Sign-in codes stop working after 10 minutes. The codes and the scrambled IP addresses are deleted after 30 days.
• Partner QR codes: your phone forgets the partner after 30 days.
• Usage statistics don't identify you and are kept by PostHog under its standard retention.

Your rights

You can ask to see, correct or delete your data, or object to how it's used. Write to info@kukuvia.com. You can also complain to the Croatian data protection authority, AZOP (azop.hr).