Privacy Notice
Pura Vida B.V. · 17/06/2026
Pura Vida B.V. ("we", "us"), a company registered in the Netherlands, operates CityWalkGems. We are the data controller for the personal data we process about you. This Notice explains what we collect, why, how long we keep it, who we share it with, and your rights.
1. Data We Collect
• Account data: email address, password hash, display name, sign-in provider (e.g. Google) and timestamps. • Location data: GPS coordinates while a tour is active, used to unlock location-based stops and to display your position on the map. • Progress and gameplay data: tours started/completed, badges, points, photos you choose to upload, feedback you submit. • Device and technical data: device type, browser, language, IP address, app version, crash logs, and basic usage telemetry. • Payment metadata: order ID, product purchased, amount, currency, country (collected by Paddle and shared with us — we do NOT receive your full card details).
2. Why We Use Your Data (Purposes and Legal Basis)
• To provide the service (account, tours, location features, progress tracking) — performance of our contract with you. • To process payments and prevent fraud — performance of contract and legitimate interest. • To improve route quality and app performance using aggregated/anonymized usage data — legitimate interest. • To send essential service emails (purchase confirmations, account changes) — performance of contract. • To send marketing emails — only with your consent, which you can withdraw at any time. • To comply with legal obligations (tax, accounting, responses to lawful requests) — legal obligation.
3. Who We Share Data With
• Paddle.com Market Limited and Paddle.com Inc. — our Merchant of Record. Paddle processes payments, subscription billing, tax compliance and invoicing. See Paddle's Privacy Notice: https://www.paddle.com/legal/privacy. • Hosting and infrastructure: Supabase / Cloudflare for application hosting, database storage and global content delivery. • Email delivery: our transactional email provider for purchase receipts and account notifications. • Analytics: providers used to understand aggregate usage of the service. • Authentication providers: Google, when you choose to sign in with Google. • Professional advisers (legal, accounting) and authorities where required by law. We do not sell your personal data.
4. International Data Transfers
Data is primarily processed within the EEA. Where transfers outside the EEA take place (e.g. via Paddle's US entity or other sub-processors), we rely on adequacy decisions or the EU Standard Contractual Clauses to provide appropriate safeguards.
5. Data Retention
• Account data: kept while your account is active and up to 24 months after deletion for fraud prevention and legal claims. • Gameplay data: kept while your account is active; anonymized analytics may be retained indefinitely. • Payment records: retained by Paddle and by us for 7 years to meet Dutch tax and accounting obligations. • Support correspondence: up to 24 months. We delete or anonymize personal data when it is no longer needed.
6. Security
We apply appropriate technical and organizational measures including encryption in transit (HTTPS), encryption at rest, role-based access controls, row-level security on our database, secure password hashing, and regular security reviews.
7. Your Rights (GDPR)
If you are in the EEA or UK, you have the right to: access your personal data; request correction or deletion; restrict or object to processing; data portability; withdraw consent at any time; and lodge a complaint with your local supervisory authority (in the Netherlands: the Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl). To exercise your rights, email vidaventuresbv@gmail.com. We will respond within one month.
8. Cookies and Similar Technologies
We use strictly necessary cookies and local storage to keep you signed in, remember your language preference, and protect against abuse. We may use analytics cookies to understand usage; these are loaded only with your consent where required. You can manage cookies in your browser settings.
9. Children
CityWalkGems is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.
10. Changes
We may update this Notice. Material changes will be communicated in-app or by email. The "updated" date below reflects the latest revision.
11. Contact
Pura Vida B.V., the Netherlands. Email: vidaventuresbv@gmail.com