Wayfindr — Privacy Policy

HH Ventures ("we", "us" or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect personal data when you use the Wayfindr application and associated services (the "Service"). It also explains your rights under applicable data protection law.

This Privacy Policy should be read alongside our Terms and Conditions and End User Licence Agreement (EULA). By using the Service, you acknowledge that you have read and understood this policy.

1. Who We Are and How to Contact Us

HH Ventures is the data controller for personal data processed through the Wayfindr Service. Data protection enquiries: support@hhventures.co

If you have concerns about how we handle your data that we have been unable to resolve, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

2. The Legal Framework

We process your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For every category of personal data we process, we rely on one or more of the following lawful bases:

• Contract performance — processing is necessary to provide you with the Service you have requested.
• Legitimate interests — processing is necessary for our legitimate business interests, where those interests are not overridden by your rights.
• Legal obligation — processing is necessary to comply with a legal requirement.
• Consent — you have given us explicit consent for a specific purpose, which you may withdraw at any time.

3. What Data We Collect and Why

3.1 Data You Provide Directly

• Account registration data: your name, email address, and chosen password.
• Profile preferences: activity type, fitness level, and terrain preferences used to personalise route generation.
• Conversational inputs: the natural language descriptions, follow-up messages, and refinements you type into the route planner.
• Payment information: billing details for paid subscriptions, processed by our payment provider. We do not store full card numbers.
• Support communications: messages you send us via email or in-app support channels.

3.2 Data Collected Automatically

• Location and GPS data: your real-time device location is used during navigation mode to display your position and trigger off-route alerts. By default, GPS data is not retained on our servers after the session ends.
• Device and technical data: device model, operating system version, app version, and unique device identifiers.
• Usage analytics: features you interact with, session duration, and route generation frequency.
• Crash and error logs: diagnostic data generated when the App encounters an error.
• Offline cache data: map tiles cached to your device are stored locally and not transmitted to our servers.

3.3 Data from Third-Party Sources

• Ordnance Survey: path and rights-of-way query data may be sent to OS-licensed data services to generate legally compliant routes.
• Google Places: named destination queries are resolved via the Google Places API. Google's privacy policy governs their handling of query data.
• Met Office: if you request a route forecast, representative coordinates along the route are sent to the Met Office Weather DataHub without your account identity. Your chosen departure time is used by Wayfindr to match forecast periods and is not included in the Met Office request.
• Sign-in providers: if you use Apple or Google Sign-In, we receive limited profile data (name and email) from that provider.

4. Data Processing Summary

Account information (name, email) — Account creation, service access, communications — Contract performance — Retained for duration of account + 6 years

Location / GPS data — Route generation, live navigation, off-route alerting — Contract performance / Legitimate interests — Session only; not stored server-side by default

Conversational route inputs — AI route generation and refinement — Contract performance — 90 days, then anonymised

Forecast request data (route sample coordinates and planned departure time) — Producing a route-specific weather forecast — Contract performance — Processed transiently; forecast responses may be cached for up to 15 minutes

Device and technical data — App performance, bug diagnosis, compatibility — Legitimate interests — 13 months

Usage analytics — Service improvement, product development — Legitimate interests — 13 months

Payment data — Subscription management, billing disputes — Contract performance / Legal obligation — 7 years

Cached map data (device-side) — Offline navigation — Contract performance — Until user clears cache

Support communications — Resolving queries and complaints — Legitimate interests / Legal obligation — 3 years

Remembered preferences (explicit "remember…" requests) — Personalising route planning across conversations — Consent — Until you delete them (You → Memory, or "forget" in a chat) or close your account

5. AI and Conversational Data

• Your conversational inputs are retained for up to 90 days to enable route history and refinement features, after which they are anonymised.
• We do not use your identifiable personal inputs to train or fine-tune AI models without your explicit, opt-in consent.
• Anonymised and aggregated data may be used to improve routing accuracy and model performance.
• We do not share your conversational inputs with third parties for advertising or profiling purposes.

You can delete your route history at any time through the account settings in the App. This removes your stored inputs from our systems within 30 days.

5.1 Remembered Preferences ("Memory")

If you explicitly ask Wayfindr to remember something about how you like to walk — for example "remember I hate stiles" or "from now on, no steep climbs" — we store that preference or fact against your account so future conversations can use it. What we store is the memory type and the short verbatim sentence you said (up to 120 characters), which may include statements about physical comfort, such as avoiding steep climbs or not being comfortable with heights. We only save a memory when you use remembering words yourself; passing remarks shape the current conversation only and are never silently made permanent.

Remembered preferences are used solely to plan and describe routes for you. They are visible under You → Memory in the App, where you can delete any single memory or all of them at any time — or simply say "forget that" in a chat. They never leave our systems, are never shared with third parties, and are not used to train AI models. Closing your account deletes all remembered preferences with it.

6. Location Data

6.1 Route Generation

Your starting point is used to query path data and is not retained to build a historical location record.

6.2 Navigation Mode

During an active session, your GPS coordinates are processed on-device. By default, your precise GPS track is not transmitted to or stored on our servers. If you opt in to route-sharing features, this will be clearly indicated and you can revoke consent at any time.

6.3 Location Permissions

The App requests access to your device location. "Always" access is required for background navigation alerts. You can change your location permissions at any time in your device settings; restricting access will limit navigation functionality.

7. Sharing Your Data

We do not sell your personal data. We may share it only in the following circumstances:

• Service providers — cloud hosting, payment processing, analytics, crash reporting, and customer support, all bound by data processing agreements.
• Third-party data services — Ordnance Survey, Google Places, and Met Office weather queries, without your account identity.
• Legal requirements — where required by law, court order, or regulatory authority.
• Business transfers — in the event of a merger or acquisition, with prior notification to you.
• With your consent — for any other purpose, with your explicit consent which you may withdraw at any time.

8. Cookies and Tracking Technologies

The Wayfindr mobile app does not use traditional browser cookies. We use device identifiers, analytics SDKs, and crash reporting SDKs as described in Section 3. You can limit analytics data collection through the privacy settings in the App. If you access the Service through our website, standard browser cookies are used for session management, analytics, and security.

9. International Data Transfers

We primarily process data within the UK and EEA. Where data is transferred outside the UK, we use appropriate safeguards including the UK International Data Transfer Agreement (IDTA) or adequacy regulations. Contact us for further detail.

10. Data Retention

We retain personal data only as long as necessary, as set out in the table in Section 4. When you close your account, we delete or anonymise your personal data within 90 days, except where required by law (for example, financial records retained for 7 years).

11. Your Rights

Under UK GDPR, you have the right to:

• Access — request a copy of your personal data.
• Rectification — ask us to correct inaccurate data.
• Erasure — ask us to delete your data, subject to legal exceptions.
• Restriction — ask us to limit processing in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interests.
• Automated decisions — not to be subject to solely automated decisions that produce significant effects. All Wayfindr route outputs are advisory and can be overridden by you.

To exercise any of these rights, contact us at support@hhventures.co. We will respond within one calendar month and may ask you to verify your identity.

12. Children's Privacy

Wayfindr is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us with personal data, contact us at support@hhventures.co and we will delete it promptly.

13. Security

We implement appropriate technical and organisational measures including TLS encryption in transit, encryption at rest, strict access controls, and regular security assessments. In the event of a breach likely to affect your rights, we will notify the ICO within 72 hours and affected users without undue delay.

14. Changes to This Policy

We will notify you of material changes to this policy at least 14 days before they take effect.

15. Complaints

For complaints, contact us first at support@hhventures.co. If unresolved, you can complain to the ICO at ico.org.uk, by phone on 0303 123 1113, or by post to: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.