Privacy Policy

The controller of your personal data is:

Ourguid
Winselingseweg 10 A52
6541 AK Nijmegen
The Netherlands
Chamber of Commerce (KvK) number: 98099698
company@ourguid.com

For any question about this policy or your data, including requests to exercise your rights, write to the address above or email us. We answer within one month.

• Account data: name, email address, password (stored only as a salted hash), profile picture, language, time zone and country.
• Teacher data (teachers only): biography, teaching experience, qualifications, introduction video, identity or certificate documents you upload for verification, and payout details.
• Lesson data: bookings, schedules, cancellations, lesson balance, notes and reviews.
• Messages: the chat messages you exchange with teachers, students or our support team through the Service.
• Payment data: amount, currency, date, invoice details and the payment provider's transaction reference. Card numbers are handled by Stripe and never reach our servers. For bank transfers we receive the name and reference shown on the transfer.
• Google data (optional, see the dedicated section below): basic profile data when you sign in with Google, and calendar busy times when a teacher connects Google Calendar.
• Technical data: IP address, browser and device type, pages visited, timestamps and error reports, collected through server logs, cookies and similar technologies described in our Cookie Policy.

We do not knowingly collect special categories of personal data (such as health, religion or ethnicity). Please do not share such data in your profile or messages.

Under the GDPR we may only process personal data when we have a legal basis. We rely on the following:

• Performance of a contract (Art. 6(1)(b)): creating and managing your account, matching students and teachers, scheduling and delivering lessons, in-app messaging, processing payments and payouts, and sending service emails such as booking confirmations, reminders and receipts.
• Legal obligation (Art. 6(1)(c)): keeping invoices and accounting records, responding to lawful requests from authorities, and handling tax and anti-fraud duties.
• Legitimate interests (Art. 6(1)(f)): keeping the Service secure and reliable (error monitoring, rate limiting, abuse prevention), verifying teachers to protect students, improving the Service using aggregated statistics, and defending legal claims. You can object to processing based on legitimate interests at any time.
• Consent (Art. 6(1)(a)): optional analytics and marketing cookies, marketing emails, connecting Google Calendar, and a teacher's public introduction video. You can withdraw consent at any time without affecting earlier processing.

We do not use your data for automated decision-making that produces legal or similarly significant effects, and we do not sell personal data.

Other users. Teachers see the name, profile picture, time zone and messages of the students who book them; students see the public profile of teachers. Nothing else from your account is visible to other users.

Service providers (processors). We use a small number of providers that process data on our behalf, under written data processing agreements and only for the purposes below:

Authorities and legal reasons. We disclose data when the law requires it, to protect the rights and safety of users, or in connection with a merger or sale of the business (you would be informed beforehand). We never sell or rent personal data.

Ourguid is established in the Netherlands, and our application servers, database and cache are hosted by Railway in Amsterdam, the Netherlands, inside the European Economic Area (EEA). Uploaded files are stored by Amazon Web Services in Paris. A few of the providers listed above (for example Vercel, Stripe, Cloudinary, Agora and Google) may process limited data in the United States or other countries outside the EEA. Whenever personal data leaves the EEA we rely on safeguards recognised by the GDPR (Chapter V): the EU-US Data Privacy Framework for providers certified under it, and otherwise the European Commission's Standard Contractual Clauses together with additional technical measures such as encryption in transit and at rest. You can ask us for a copy of the relevant safeguards at company@ourguid.com.

Ourguid uses Google services in two optional ways. If you choose Sign in with Google, we receive your name, email address and profile picture, and use them only to create and sign you in to your Ourguid account.

Teachers can choose to connect Google Calendar. Many teachers teach on several platforms, and connecting the calendar prevents double bookings. With your permission we:

• read the events in your calendars to know when you are busy, so those times are not offered to students on Ourguid. For each event we store only its start time, end time and title. The title is shown to you alone, inside your own Ourguid calendar; students and other users never see it. We do not store event descriptions, attendees, locations or attachments;
• create, update and delete calendar events for the lessons booked with you on Ourguid. We only change events that Ourguid created and never modify your other events.

We do not sell Google user data, do not use it for advertising, and do not share it with third parties, except with the infrastructure providers that host our service on our behalf and under confidentiality obligations, or where the law requires it. We do not use Google user data to develop, improve or train generalized or non-personalized artificial intelligence or machine learning models.

Ourguid's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Retention and deletion. Stored busy times are refreshed at every sync and cover only a rolling window of recent and upcoming weeks. You can disconnect Google Calendar at any time from your Ourguid calendar page: we then revoke our access with Google and delete the stored tokens and busy times immediately. Deleting your Ourguid account deletes them as well. You can also remove Ourguid's access from your Google Account permissions page, or ask us to delete your data at company@ourguid.com.

We apply technical and organisational measures (GDPR Art. 32) to protect personal data, including sensitive data such as Google user data:

• Encryption in transit. All traffic between your browser, our servers and third-party providers uses HTTPS/TLS.
• Encryption at rest. The long-lived Google authorization (refresh) token is encrypted with authenticated AES encryption before it is written to our database, with a key kept separately from the data.
• Access control. Calendar data is tied to the teacher's account and served only to that authenticated teacher. Access to production systems is restricted to authorised personnel who need it to operate the service, and is protected by strong authentication.
• Data minimisation. We request the narrowest permissions that make a feature work and store only the fields listed in this policy.
• Passwords and payments. Passwords are stored only as salted hashes. Card payments are processed by Stripe; we never store card numbers.
• Processor agreements. Every provider that handles personal data for us is bound by a data processing agreement (GDPR Art. 28).

No system is perfectly secure. If a personal data breach is likely to result in a risk to your rights, we will notify the Dutch Data Protection Authority within 72 hours and inform you without undue delay, as GDPR Articles 33 and 34 require.

We keep personal data only for as long as needed for the purposes described above, then delete or anonymise it:

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• rectify inaccurate or incomplete data (most of it directly in your account settings);
• erase your data ("right to be forgotten") — you can delete your account yourself from your settings page;
• restrict processing in certain circumstances;
• data portability: receive the data you gave us in a structured, machine-readable format;
• object to processing based on legitimate interests, and to direct marketing at any time;
• withdraw consent at any time, for example by disconnecting Google Calendar, changing your cookie preferences, or unsubscribing from marketing emails.

To exercise a right, email company@ourguid.com from the address linked to your account. We reply within one month (extendable by two months for complex requests) and free of charge. We may ask you to confirm your identity first.

You also have the right to lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority). You may also complain to the authority of the EU country where you live or work. Users outside the EU, including California residents under the CCPA, have equivalent rights to know, access, delete and not be discriminated against; we do not sell personal data.

We use strictly necessary cookies to run the Service, and analytics or marketing cookies only after you opt in through our consent banner. You can change your choice at any time from the Cookie Policy page, which lists every cookie and forms part of this Privacy Policy.

The Service is intended for adults. Under Dutch law, children under 16 may only use online services that process their personal data with the consent of a parent or guardian. We do not knowingly collect data from anyone under 16 without such consent; if you believe a child has given us data, contact us and we will delete it.

We may update this policy from time to time. When we make a material change we will update the date at the top of this page and, where appropriate, notify you by email or in the app. Questions, requests and complaints can be sent to company@ourguid.com or by post to Ourguid, Winselingseweg 10 A52, 6541 AK Nijmegen, The Netherlands.