Privacy Policy

Who we are

The Service is operated by Ilia Krivopolenov PR Računarsko programiranje IK SOFT Novi Sad (“IK SOFT”), Novi Sad, Republic of Serbia — the data controller. For any privacy question or request, contact owner@fixers.guide.

What we collect

We collect only what we need to run the Service. We don't ask for your phone number or postal address. We ask for your email address only if you sign up or sign in with email, add email sign-in to your account, or join the app waitlist. Giving it is your choice: you can't use those features without it, but you never need it to use the Service through Telegram. In this beta we do not process payments.

• Telegram account data (if you use the bot or Mini App): your Telegram user ID and your Telegram name as it was when you first signed in (first and last name, or only your first name if you started in the bot), used to create and label your account and to authenticate you. One Telegram user maps to one Fixers Guide account. Telegram also gives us your username, language and other profile details when you use the bot or open the Mini App. We use them only to sign you in, and your Telegram language to choose your tours' language when you haven't chosen one in Settings or we can't read your choice. We don't keep them, except as the language of each tour you request.
• Email account data (if you sign up with email or add email sign-in): your email address, a display name if you give one when you sign up, whether your email is verified, and your password — stored only as a one-way hash, never the password itself. If you add email sign-in to your Telegram account (for example with /linkemail in our bot), both sign-ins open the same account; an account you create with an email address is separate from any Telegram account. In the bot you type your email and password as messages in your private chat with it: the bot deletes each message you send in reply to its email or password question as soon as it receives it. If you still see one in the chat, delete it yourself; Telegram keeps your chat under its own policy.
• Sign-in security: the number of failed email sign-ins since your last successful one or last lockout, and any temporary lockout (after 5 failed attempts, email sign-in is locked for 15 minutes); and your sign-in sessions: a one-way hash of each session token, the device label the app sent, and when the session was created, expires, or was revoked or replaced.
• Tour requests: the city, theme, duration and language of each tour you request: the language you pick, your Settings language or your Telegram language.
• Settings: the language you choose in Settings in the bot or the Mini App. We use it to write and narrate your tours, to find existing tours in that language and, once the Service is available in that language, to show the Service in it.
• Generated content: the tours we produce for you (stops, descriptions, routes, audio) and their metadata.
• Usage & credits: a per-account credit balance and a ledger of generations (for metering).
• A device identifier, used to attribute requests: in the bot and the Mini App, tg- followed by your Telegram user ID; in our mobile app, a random value the app makes the first time you sign in or create an account on a phone. The app keeps it until it's removed or its data is cleared, and sends the same value for every account used on that phone, so it shows which accounts were used on one phone. We keep it with your account, your sign-in sessions and your tour requests.
• Operational logs: standard server logs (timestamps, request/response status, errors) to operate and secure the Service. We do not use them for advertising profiles.
• App waitlist (if you join it on fixers.guide): your email address and when you submitted it.
• Beta waitlist: while the beta has a cap on testers, if it is full when you first sign in, we keep a waitlist entry — for Telegram, your Telegram user ID and name; for email sign-up, your email address and any display name you entered — with the sign-in method and when the entry was made.

How we use it

• Provide the Service: authenticate you, generate and deliver tours, meter credits.
• Send account emails if you have email sign-in: a link to verify your address, a password-reset link when you ask for one and, occasionally, important notices about your account or the Service. These aren't marketing.
• Run the app waitlist: email you about our mobile app's launch and early access and about changes to this policy that affect you, and add the starting credits we promised to your account. To do that we match your waitlist email to a verified email on your account, or you confirm from your waitlist address which account is yours.
• Run the capped beta: keep the beta waitlist so we can invite people when places open.
• Operate, secure, debug and improve the Service.
• Comply with law and enforce our Terms.

Who we share it with (sub-processors)

To generate tours we send your tour-request text (e.g. the city and theme) and derived prompts to the providers below. We also use providers to host the Service and our website, send account emails and run the app waitlist. We do not sell your data.

Our website also loads fonts from Google Fonts and styles from the Tailwind CDN. Like any web request, these services receive your IP address and browser details; they may process them outside Serbia and the EU, including in the United States, and we have no data-processing terms with them.

Each provider processes data under its own terms. We share only what's needed for the stated purpose.

Where data is stored & how long

Our API and bot servers, database and server logs are hosted by Microsoft Azure in the EU (Sweden Central); the Mini App's web pages are served from Microsoft's global network. OpenAI, Google (Maps Platform and Workspace), ElevenLabs, Cloudflare and Microsoft may process data outside Serbia and the EU, including in the United States. Each of these transfers rests on a ground that Serbian law and the GDPR allow: an adequacy decision, such as the EU–US Data Privacy Framework for a provider certified under it, or safeguards such as standard contractual clauses. Email us to learn which applies to a provider, or for a copy of the safeguards. Telegram handles your chats under its own policy. We keep your account (including your email address, password hash, settings and sign-in sessions), tours and usage records until you ask us to delete your account. Server logs (the application and error logs our servers write) are kept for 30 days. App waitlist entries are deleted within 30 days of our mobile app's launch, after we've added the starting credits we promised to each account claimed by then (we'll email you how to claim them and by when), and in any case no later than 12 months after you join. Beta waitlist entries are kept for no more than 6 months; if you try again after yours is deleted and the beta is still full, we make a new one. Emails you send us are kept as long as we need them to answer you and keep a record of your request. When we delete data from our database, copies can remain in its backups for up to 14 days. You can ask us to delete your account and associated data (see Your choices); we may retain minimal records where required by law.

Legal basis

Where Serbia's Law on Personal Data Protection (ZZPL) or the EU/UK GDPR applies, we process data to perform the service you request, including your account and account emails. We process data for our legitimate interests in operating and securing the Service and our website, such as protecting accounts against password guessing and keeping the beta waitlist so we can invite people when places open. For the app waitlist we rely on your consent: we keep the email address you submit to tell you about our mobile app's launch and early access and about changes to this policy that affect you, and to add your starting credits; you can withdraw at any time by emailing owner@fixers.guide or replying to one of our waitlist emails. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. Some limits apply automatically: email sign-in is locked for 15 minutes after 5 failed attempts; while the beta is full, new sign-ups are refused and put on the beta waitlist; an action that needs more credits than you have is refused; and our AI may decline a tour request it can't fulfil for that city. IK SOFT is the controller.

Your choices & rights

• Access / deletion: email owner@fixers.guide to request a copy or deletion of your data.
• Your right to object: where we rely on our legitimate interests (for example the beta waitlist or account security), you can object at any time by emailing owner@fixers.guide. If you object to the beta waitlist, we delete your entry.
• Leaving the app waitlist: email owner@fixers.guide or reply to any of our waitlist emails; we stop emailing you and delete your entry.
• Stop using the Service: stop using the bot or Mini App; ask us to delete your account to remove stored data.
• You also have rights of access, rectification, erasure, restriction and portability; contact us to exercise them.
• Complaints: you can complain to the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia (poverenik.rs) or to the data-protection authority where you live.

Children

The Service is not directed to children under 16 (or the minimum age in your country). Do not use it if you are under that age.

Changes

We may update this policy; we'll change the effective date above and, for material changes, note it in the Service and email the people on the app waitlist if the change affects them. If a change needs your consent, such as a new use of your app-waitlist email, we'll ask for it first. Continued use of the Service after an update means you accept the revised policy.

Contact

owner@fixers.guide

See also our Terms of Service.