Privacy Policy
Effective date: [effective date] · Last updated: October 14, 2026
The short version
- We collect what we need to run your bookings: your account details, your bookings, your messages and reviews. We don't track your location and we don't use advertising trackers.
- The partner running your experience gets your first name and last initial and the booking details they need (date, guests, pickup place, special requests). We don't share your email or phone number with them through the chat.
- Card payments go through Stripe. We never see or store your full card number.
- We use AI to translate listings and to make trip plans. AI providers process the text only to give us the answer, and don't train their models on it.
- We don't sell your personal information.
- You can see and change your details in the app, delete your account there, or email privacy@heytour.ai for anything else.
1. Who we are
Clevers LLC ("HEYTOUR", "we", "us") runs HEYTOUR, a marketplace for tours, activities, guides and transfers: our website (https://heytour.ai), mobile apps, web app and the payment pages we send you links to (the "Platform"). This policy explains how we handle personal information about travellers who use the Platform. Partners (the local businesses that sell on HEYTOUR) are covered by separate notices.
We're the controller of the personal information described here. Each partner is a separate controller of the booking information we pass to it to run your experience, and handles it under its own responsibility and the law.
2. Information we collect
Information you give us
- Account: your first and last name, email address and/or mobile phone number, profile photo (if you add one), language and time zone. A password if you set one (stored only as a one-way hash). If you sign in with Google or Apple, we get an account identifier, your name and the email address (or Apple relay address) they share.
- Bookings: the experience, date and time, the number of guests in each age group, the lead guest's name, email and phone number, pickup place, your special requests and your answers to the partner's questions, the flight number for an airport transfer, any promo code, and the price.
- Other guests: if you give details about the people you book for (for example a lead guest who isn't you, or a special request about a child), make sure they're happy for you to share them.
- Custom trip requests: your dates, group size, budget (if you give one), your message and the quotes you receive.
- Messages: what you write and the photos you send in chats with partners and with our support team, and any report you make about a conversation.
- Reviews: your star rating and review text, and the partner's reply.
- Saved listings and preferences: the listings you save, your notification settings and quiet hours.
- AI trip planner: what you type to describe your trip, and the city, dates and group you choose.
Information about payments
Card details go straight to our payment processor, Stripe; we never see or store your full card number. We keep the Stripe references for your customer record, saved cards and payments, and the payment history of each booking: when your card was saved, held, charged or refunded, and whether a payment failed. To show your saved cards, we read the card brand, last four digits and expiry date from Stripe. If we run a card check (a small temporary hold for a large booking), we keep its result and the attempts made.
Information collected automatically
- Sign-in and security: one-time codes we send (only a hashed version), your sessions (when and how you signed in, IP address, browser or app), sign-in attempts, and a log of security-related actions.
- Device: for the mobile apps, the device model, operating system, app version, a random install identifier and, if you allow notifications, a push notification token.
- Usage and logs: the requests your app or browser makes to our servers, error reports, and the IP address they come from, used to run and secure the Platform.
- Check-in: when the partner scans your booking's QR code and when you were checked in.
- Cookies: only what's strictly necessary. See our Cookie Policy.
Information from others
- Partners: if a partner sends you an offer by link, they give us the name, phone number or email address you gave them. Partners also tell us about your booking (for example that they confirmed it, or checked you in).
- Sign-in providers: Google or Apple, if you choose to sign in with them.
- Stripe: whether a payment succeeded or failed, and fraud-prevention signals.
What we don't collect
We don't collect your device's location, your contacts, or health information, and the apps don't contain advertising or analytics trackers. Please don't send us sensitive information (such as health details or ID documents) in chats or special requests unless the partner really needs it for your experience (for example a medical condition relevant to an activity); if you do, it's used only for that booking.
3. How we use it, and our legal bases
| What we do | Information used | Legal basis (EEA/UK) |
|---|---|---|
| Create and run your account; sign you in; keep it secure | Account, sign-in and security, device | Contract; legitimate interests (security) |
| Take, confirm and manage bookings, custom trips and offers; send them to the partner | Bookings, trip requests, account | Contract |
| Save your card, hold and charge payments, refund, and tell you if a payment fails | Payments, bookings, contact details | Contract |
| Send booking emails, texts and push notifications (confirmations, reminders, payment, changes) | Contact details, bookings, device token | Contract |
| Let you message partners and our support team; help with problems and complaints | Messages, bookings, account | Contract; legitimate interests (support) |
| Publish your review and calculate ratings | Reviews, your first name | Contract; legitimate interests (honest reviews) |
| Make AI trip plans and translate listings and reviews | What you type in the planner; listing and review text | Contract (planner); legitimate interests (translations) |
| Prevent fraud and abuse: card checks, moderating chats and reviews, rate limits | Payments, messages, reviews, logs | Legitimate interests; legal obligation |
| Keep accounting and tax records; answer authorities | Bookings, payments | Legal obligation |
| Improve the Platform, find and fix problems | Logs, usage (aggregated where possible) | Legitimate interests |
| Send you news about HEYTOUR (only if you turn it on) | Contact details | Consent (you can turn it off at any time) |
Where we rely on legitimate interests, we've weighed them against your rights; you can object (section 9). We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. Fraud checks may flag a payment for a person on our team to review.
AI. When you use the AI trip planner, we send what you typed, together with a list of matching HEYTOUR listings, to an AI provider to produce the plan. We don't store your planner conversation; the app keeps it on your device. We also use AI to translate partners' listings and travellers' reviews. We use the providers' business services under terms that don't allow them to use this data to train their models. We record only usage totals (such as the number of requests), not what you typed.
4. Who we share it with
The partner running your experience. To deliver your booking, the partner (and the guide or driver assigned to it) sees your first name and the first letter of your last name, the lead guest's name, the date, the number of guests by age group, pickup place, special requests, your answers to their questions, flight number (airport transfers), the price, whether you've paid and checked in, and your messages with them. We don't share your email address or phone number with them through the Platform. (If you came to HEYTOUR through a partner's offer link, the partner already has the contact details you gave them.) Partners are mostly located in Uzbekistan.
Other travellers and the public. Your published reviews show your first name, rating, text and date.
Our service providers, who process information for us under contract and only on our instructions:
- Google Cloud (hosting, database, file storage, backups) and Firebase Cloud Messaging (push notifications);
- Stripe (payments, saved cards, fraud prevention). Stripe is also a controller of payment data under its own privacy policy;
- Mailgun (email) and Twilio (text messages);
- AI providers (Anthropic, OpenAI, Google) for the trip planner and translations.
The full, current list is on our Subprocessors page.
Services you choose to use. Google or Apple when you sign in with them; Apple Pay or Google Pay; Apple Wallet or Google Wallet when you add a booking to them (Google Wallet receives the booking details on the pass); map or ride apps you open from a listing. Their own privacy policies apply.
When the law requires it or to protect people: to comply with the law, a court order or a valid request from authorities; to prevent fraud; or to protect the safety and rights of travellers, partners, us or others.
If our business changes: if HEYTOUR is merged, acquired or sold, your information may move to the new owner, who must keep honouring this policy.
We don't sell your personal information and don't share it for targeted advertising.
5. International transfers
We host the Platform in the United States (Google Cloud us-central1, Iowa; files in Google Cloud's US multi-region). Our service providers may process information in the United States and other countries. Booking details go to the partner in the country where your experience takes place, mostly Uzbekistan, because that's needed to provide the experience you booked.
Where the law requires it (for example for information from the EEA, UK or Switzerland), we protect transfers with recognised safeguards such as the European Commission's Standard Contractual Clauses with our service providers. [TO CONFIRM: whether Clevers LLC self-certifies under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions); if so, say so here, otherwise remove] Sending your booking to a partner abroad is based on its necessity for performing your booking.
6. How long we keep it
| Information | How long |
|---|---|
| Account (name, email, phone, photo) | Until you delete your account. Deletion signs you out everywhere and clears your email and phone at once; the rest is erased within 30 days |
| Bookings and payment records | [TO CONFIRM: e.g. 7 years after the experience, as tax and accounting law requires] |
| Messages and photos in chats | [TO CONFIRM: e.g. 3 years after the last message in the conversation] |
| Support conversations | [TO CONFIRM: support message retention period] |
| Reviews | While the listing is on HEYTOUR. If you delete your account, a published review may stay up shown as "Deleted user" ([TO CONFIRM]) |
| Sessions and sign-in records | [TO CONFIRM: how long ended or revoked session records are kept] |
| Server logs | [TO CONFIRM: server and load balancer log retention period] |
| AI trip planner text | Not stored by us |
| Record of the Terms and Privacy Policy you accepted | As long as needed to show what you agreed to |
We may keep information longer if the law requires it, or to resolve a dispute, a chargeback or a safety or fraud investigation.
7. Security
We protect your information with encryption in transit (HTTPS) and at rest, extra encryption of fields such as email addresses and phone numbers, hashed passwords and one-time codes, rate limits and alerts on sign-in, optional two-factor authentication, and access limited to staff who need it. Card details are handled by Stripe, which is certified to the PCI DSS standard. No system is perfectly secure; if a breach affects your information, we'll tell you and the authorities as the law requires.
8. Your choices
- Profile: see and change your name, email, phone and photo in the app.
- Notifications: choose which notifications you get and on which channels, and set quiet hours, in the app. Security alerts and essential emails about your bookings and payments are always sent, because they're part of the service.
- Push notifications and photos: you can turn off notifications or the app's access to your camera and photos in your device settings.
- Sessions: see where you're signed in and sign out any device.
- Delete your account: in the app (Profile → Delete account). Deletion is final. Cancel any upcoming bookings you don't want before deleting. [TO CONFIRM: what happens to upcoming bookings when an account is deleted.]
9. Your rights
Depending on where you live, you may have the right to:
- access your personal information and get a copy of it, in a portable format;
- correct it;
- delete it;
- object to, or ask us to restrict, how we use it (including for direct marketing, at any time);
- withdraw your consent, where we rely on consent (this doesn't affect what we did before);
- complain to your data protection authority. In the EEA you can find yours on the EDPB website; in the UK, it's the ICO.
To use your rights, write to privacy@heytour.ai from the email address on your account (or tell us the phone number on it). We may need to confirm it's you. We'll answer within the time the law sets, usually one month (45 days in California). We won't treat you differently for using your rights. For information a partner holds as its own controller, we'll help pass your request on.
US state privacy rights (including California). We collect the categories of information described in section 2 (identifiers, commercial information such as bookings, internet activity, photos you upload and, for payments, limited financial information through Stripe), for the purposes in section 3, from the sources in section 2, and disclose them for business purposes to the recipients in section 4. We don't sell or share personal information for cross-context behavioural advertising, and haven't in the past 12 months. We use sensitive information (your sign-in credentials) only to provide and secure the Platform. You can use your rights to know, access, correct and delete by emailing privacy@heytour.ai; an authorised agent can act for you with your permission.
10. Children
You must be at least 16 to have a HEYTOUR account and at least 18 to make a booking. We don't knowingly collect information from children under 16. Children may take part in experiences booked by an adult; for them we collect only the number of guests in each age group, and any detail the adult chooses to give in special requests. If you think a child has given us information, contact privacy@heytour.ai and we'll delete it.
11. Changes to this policy
We'll post changes on this page and update the date at the top. If a change is important, we'll tell you in the app or by email before it takes effect.
12. Contact
Clevers LLC, [company postal address]
- Privacy questions and requests: privacy@heytour.ai
- Data protection officer: [name or role of the data protection officer, or "not appointed"; reachable at privacy@heytour.ai]
- EU representative: [EU representative under GDPR Article 27, if required]
- UK representative: [UK representative under UK GDPR Article 27, if required]
- Help with a booking: help@heytour.ai