Privacy policy

Controller and contact

The data controller is the owner of Xplore, identified in the legal notice. For queries or requests about your data, write to support@tryxplore.com or use the postal address given there.

What data we use and what for

Browsing and security

The infrastructure receives the IP address and technical data of requests in order to serve pages, diagnose errors and mitigate abuse. Processing is based on our legitimate interest in operating and protecting the site.

Assistant and itinerary

We use what you write and the criteria you give, such as date, group size and budget, to reply and help you plan. You can use the text chat as a guest. The items you save and the theme you choose are remembered in your browser. The basis is providing the service you request. Avoid entering identity documents, medical information or payment details in the conversation.

Queries and partnerships

We process your email, the content of the message and the data needed to reply, deal with problems or consider a partnership. Depending on the query, the basis is handling your request, preparing or performing a contract, our legitimate interest in helping you, or a legal obligation.

Counting clicks to sellers

When you press the link to a Viator activity, we store the activity code, the destination, the page you pressed it from, the language, the campaign and the date. It tells us which destinations and sections are useful and lets us reconcile affiliate commissions. We do not store your IP address, your browser, your account or any identifier, and we use no cookies for this, so this record cannot identify you. The basis is our legitimate interest in measuring and improving the service.

Optional measurement

With your consent we also record selection and review actions and the activity identifier, to measure the purchase journey. These events do not include the chat text, your email or an advertising identifier. You can withdraw consent in preferences.

Account and enabled purchases

The text chat needs no account. If you create a free account, with your email or with Google, we use that email to authenticate you and, where applicable, to sync the plan and manage bookings or the subscription. When you request an integrated purchase, we share with the seller the traveller and booking data it needs. The provider’s form collects the card details. We process your data to provide the service, meet legal obligations and deal with problems.

Live agent

This is a feature for subscribers. If you allow the microphone, the audio and transcripts are processed to hold the conversation. We also process the minutes used in order to apply your balance. The basis is providing the session you requested. You can close the session or withdraw the browser permission and carry on by text.

Providers and recipients

Vercel hosts the website and Vercel AI Gateway takes part in processing messages when it is enabled. Anthropic processes the messages sent to the guide in order to generate the replies. Email providers let us answer messages. Supabase stores the anonymous click count and, if those features are enabled, provides authentication and storage; LiveAvatar by HeyGen and ElevenLabs process the audiovisual session, and Stripe handles the subscription payment.

If you buy from a provider such as Viator, see its privacy notice and that of the seller identified in the offer. If you go to an external site, that site processes the data you give it under its own conditions. We may also disclose information to authorities where there is a legal obligation.

If a provider processes data outside the European Economic Area, we apply, as appropriate, an adequacy decision or safeguards such as standard contractual clauses. You can ask for information about the safeguards used through the privacy email.

Retention and decisions

We keep technical logs for as long as needed to operate the website and resolve problems. We keep queries while we handle them and for the applicable periods if we need to evidence how they were handled or respond to claims. Where applicable, account data is kept while we provide the service, and billing data for the applicable legal period. The click count, which contains no personal data, is kept for as long as it is useful for measuring how the service performs. Browser storage periods are explained in Cookies and preferences.

Your email is needed to verify an account. The details marked as required during a purchase identify the traveller and process the booking. You can keep browsing the catalogue and planning as a guest.

Suggestions adapt to the plan you describe. The assistant does not by itself take decisions that have legal or similar effects on you.

Your rights

You can request access, rectification, erasure, restriction, objection or portability, as applicable, and withdraw consent at any time. Write to us at support@tryxplore.com with the subject “Privacy” and say which right you want to exercise. We may ask for a proportionate check if we have doubts about the identity of the person making the request.

You can also lodge a complaint with the Spanish Data Protection Agency.