Privacy Policy

1. Who is responsible

The controller for Mini Locals is Zaubar UG (haftungsbeschränkt), Nollendorfstraße 20, 10777 Berlin, Germany, represented by its managing directors Anne-Sophie Panzer, Stefan Marx. Email hello@zaubar.com (subject "Privacy"), phone +49 176 45709672.

The same contact is our person in charge of the protection of personal information (Quebec), our contact for data subjects (encarregado, Brazil) and our privacy contact for every other country. We have not appointed a data protection officer, as the law does not currently require one for us.

This policy covers the website minilocals.com, the Mini Locals web app and the Mini Locals apps for Android and iOS. It does not cover other websites or products of ZAUBAR, or services of other companies you reach through Mini Locals.

2. Visiting this website

• Server logs. When you open minilocals.com, our host Netlify processes technical data your browser sends, such as your IP address, the page requested, date and time, browser and operating system, to deliver the page and keep it secure. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). Netlify keeps these logs for a short time.
• Videos and images are delivered by ImageKit. Your browser connects to ImageKit, which receives your IP address and browser data to deliver them. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• No cookies, no tracking. This website sets no cookies and uses no analytics or advertising tools. Our fonts are hosted by us, so your browser does not contact a font service.
• Cancellation and withdrawal forms. If you use cancel contracts here or withdraw from contract here, see section 3, "Requests you send us".

3. Requests you send us

When you write to us, use our cancellation or withdrawal forms, send feedback or report content, we process what you send (for example name, email address, order number, your message) and the time of receipt, to handle your request, confirm it and keep a record. Form submissions are sent by email through Resend to you and to our team mailbox. Legal basis: performing our contract with you or steps you request (Art. 6(1)(b) GDPR), our legal obligations, for example to confirm cancellations and withdrawals (Art. 6(1)(c) GDPR), and our legitimate interest in answering you (Art. 6(1)(f) GDPR). We keep these records for as long as claims can be raised, generally three years from the end of the year, and longer where commercial or tax law requires.

4. Using Mini Locals: what we process and why

You are not legally obliged to give us personal data. Without an account you can use Mini Locals as a guest; without location you can search places by hand; without a payment you can use the free tier.

5. More about location

Mini Locals is about where you are, but location is always your choice. We ask for access only when you use a feature that needs it, and you can say no and choose a region instead. To look up places, addresses and routes, our servers send the coordinates to Google Maps Platform. Your saved home area is rounded to about 1 km. We do not sell location data, do not use it for advertising, and do not use it for anything other than the features you use. Mini Locals does not access your location in the background unless the Android app tells you and you allow it for an active walk or session.

6. More about AI and your voice

When you hold to ask, the Android app records your voice only while you hold the button and streams it, with current camera images where a camera is active, to Google's Gemini models, which generate the answer on our behalf. We do not create, collect or store voiceprints or any other biometric identifier, and we never use your voice to identify or verify you. We do not use your questions, voice, photos or other personal data to train AI models, and our agreements with our AI provider do not allow it to use them to train its models. Answers are generated by AI. More on how we make stories.

7. Cookies and storage on your device

This website sets no cookies. The Mini Locals apps and web app store information on your device that they need to work, such as your sign-in session, settings, profile and listening allowance, and our analytics tool stores a pseudonymous identifier. Details, and how to remove it, are on cookies and storage.

8. Service providers and other recipients

We use carefully chosen service providers who process personal data on our behalf and on our instructions, under data processing agreements (Art. 28 GDPR):

Independent controllers. Some companies process your data under their own responsibility and privacy policies: our reseller Paddle.com (Paddle.com Market Ltd and its affiliates) for web purchases, including payment details, invoices and taxes; Google and Apple for store purchases and when you sign in with them; Spotify if you link it. When the app shows content from Wikimedia Commons, embedded YouTube videos (through youtube-nocookie.com), Google Maps or fonts from Google Fonts, your device connects directly to those services, which receive your IP address.

Other disclosures. We disclose personal data to authorities, courts or other parties only where the law requires it, or where it is necessary to establish, exercise or defend legal claims or to protect the rights and safety of people. If our business or the Service is sold or merged, personal data may pass to the new owner, who must respect this policy. We never sell personal data.

9. International transfers

Several of our providers are located, or process data, outside the European Economic Area, in particular in the United States and India. Where the European Commission has decided that a country ensures an adequate level of protection, or a US provider is certified under the EU-US Data Privacy Framework (with the UK Extension and the Swiss-US framework), we rely on that. Otherwise we use the European Commission's Standard Contractual Clauses, with the UK Addendum and Swiss amendments where needed, together with additional safeguards where appropriate. You can ask us for a copy of the safeguards at hello@zaubar.com.

For the purposes of Swiss, Japanese, Australian, Canadian and other laws that ask us to name countries: personal data may be processed in Germany and other EU countries, the United Kingdom, the United States and India, and through content delivery networks in other countries where you use the Service.

10. How long we keep data

• Account, profile, preferences, walks, replays and social activity: as long as your account exists. When you delete your account, we delete them or make them anonymous, as described on delete your account.
• Guest data: as long as the guest identifier exists; you can ask us to delete it at any time.
• Shared replays stay online until you delete them in the app or ask us to remove them, also after you delete your account. Please delete them first if you no longer want them online.
• Session recordings with audio glasses (Android): position logs are deleted after 30 days; camera images are kept until you delete your account or ask us to remove them.
• Purchase and accounting records: as long as commercial and tax law requires, in Germany up to ten years. Records of gift codes stay as long as the code and claims about it can be raised.
• Newsletter answers: as long as we may need to prove your choice.
• Analytics and error reports: no longer than needed to analyse and fix problems, then deleted or anonymised by our providers' retention settings.
• Server logs: a short period, kept by our hosting providers for security.

11. Your rights

Under the GDPR and many other laws you have the right to:

• access your personal data and get a copy (Art. 15);
• rectification of inaccurate data (Art. 16);
• erasure (Art. 17), for example by deleting your account;
• restriction of processing (Art. 18);
• data portability, to receive data you gave us in a common machine-readable format (Art. 20);
• withdraw consent at any time, with effect for the future (Art. 7(3));
• not be subject to decisions based solely on automated processing that produce legal or similarly significant effects (Art. 22). We make no such decisions.

To use your rights, write to hello@zaubar.com with the subject "Privacy", ideally from the email address of your account. We may ask you to confirm your identity. We answer within one month, which can be extended by two months for complex requests; we tell you if so. Using your rights is free of charge.

Complaints. You can complain to a data protection authority, in particular in the country where you live or work or where an infringement took place. Our lead authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, Germany, datenschutz-berlin.de. We would be glad if you contacted us first.

12. Recommendations and profiling

The order in which we show stories depends on where you are, the length you choose and, if you agree to personalisation in the app, what you listened to and liked. This is ordinary personalisation, not a decision with legal or similarly significant effects about you. We do not use personal data to train large language models.

13. Children

Mini Locals is not directed at children under 13, and we do not knowingly collect personal data from them. Teenagers need to be at least 16, or at least 13 with the permission of a parent or guardian, or the higher age the law of their country requires. If you believe a child under 13 has given us personal data, write to hello@zaubar.com and we will delete it.

14. Security

We protect personal data with technical and organisational measures suited to the risk, including encryption in transit (HTTPS), access controls, pseudonymous identifiers in analytics, scrubbing of personal details from error reports, and careful selection of providers. No system is completely secure; if a breach affects you, we inform you and the authorities as the law requires.

15. Notice for residents of the United States

This section applies to residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia and other states with consumer privacy laws, to the extent those laws apply to us.

Categories we collect (in the 12 months before this policy and going forward): identifiers (such as email address, account and device IDs, IP address); commercial information (purchases and plan status); internet or other electronic network activity (use of the Service); geolocation data, including precise geolocation if you allow it, which is sensitive personal information; audio and visual information (your voice when you hold to ask, photos and camera images you take or allow); and inferences about your interests, if you agree to personalisation. Sources: you, your device, and our service providers. Purposes and retention: as described in sections 4 to 10.

Disclosures. We disclose these categories for business purposes to the service providers listed in section 8. We do not sell personal information and do not share it for cross-context behavioural advertising or targeted advertising, and we have not done so in the past 12 months. We do not knowingly sell or share personal information of consumers under 16. We use sensitive personal information only with your consent and only to provide the features you request, not to infer characteristics about you, so no "limit the use" link is needed.

Your rights. Depending on your state, you have the right to know and access the personal information we hold about you, to correct it, to delete it, to receive it in a portable format, and to opt out of sale, targeted advertising and certain profiling (we do none of these). We treat Global Privacy Control signals as a valid opt-out request. We will not discriminate against you for using your rights. To use them, email hello@zaubar.com with the subject "Privacy". We verify requests by matching them to the email address of your account. You may use an authorised agent, who must show your signed permission; we may still ask you to verify your identity.

Appeals. If we decline your request, you may appeal by replying to our decision or writing to hello@zaubar.com with the subject "Privacy appeal". We answer within the time your state's law sets, usually 45 or 60 days. If you are not satisfied, you can contact your state attorney general.

California. California residents can also contact the California Privacy Protection Agency (cppa.ca.gov). We do not disclose personal information to third parties for their own direct marketing purposes.

16. United Kingdom and Switzerland

United Kingdom. The UK GDPR and the Data Protection Act 2018 apply. You can complain to us first; we acknowledge complaints within 30 days and handle them without undue delay. You can also complain to the Information Commissioner's Office (ico.org.uk).

Switzerland. The Federal Act on Data Protection applies. Personal data may be disclosed to the countries named in section 9, with the safeguards described there. You can complain to the Federal Data Protection and Information Commissioner (edoeb.admin.ch).

17. Canada and Quebec

We handle personal information in line with PIPEDA and, for Quebec residents, the Act respecting the protection of personal information in the private sector. Our person in charge of the protection of personal information is our management, reachable at hello@zaubar.com. Your personal information may be communicated outside Quebec and Canada, to the countries in section 9. Location features are off until you turn them on. You may access and correct your information and withdraw consent, and you can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

18. Other countries

• Brazil (LGPD). You have the rights in Art. 18 LGPD, including confirmation of processing, access, correction, anonymisation, portability, deletion, information about sharing and withdrawal of consent. Contact: hello@zaubar.com. You can also petition the Autoridade Nacional de Proteção de Dados (ANPD).
• Australia and New Zealand. We handle personal information in line with the Australian Privacy Principles and the New Zealand Privacy Act 2020. Overseas recipients are in the countries named in section 9. You can complain to us, and then to the Office of the Australian Information Commissioner or the New Zealand Privacy Commissioner.
• Japan. Personal data may be transferred to the countries in section 9. Their data protection systems differ from Japan's; providers we use are bound by contract to protect your data. You can request disclosure, correction and suspension of use.
• South Korea. Personal information may be transferred overseas to the providers, countries and purposes listed in sections 8 and 9, by network transmission when you use the Service, and kept for the periods in section 10. You can refuse the transfer by not using the features concerned or by deleting your account.
• India. You may access, correct, update and erase your personal data, withdraw consent, nominate another person to exercise your rights, and raise grievances with us at hello@zaubar.com, and then with the Data Protection Board of India.
• Singapore, Türkiye, South Africa, the Gulf states and elsewhere. You have the rights your local law gives you; write to hello@zaubar.com and we will help.
• China. Mini Locals is not offered to people in mainland China.

19. Changes to this policy

We update this policy when the Service or the law changes. The date at the top shows the current version. If changes affect you significantly, we tell you in the app or by email before they take effect.