Privacy Policy

1. Data We Collect

Account & Profile Data

When you create an account we collect your name, email address, and password (hashed). You may optionally provide a profile photo, bio, and social links. If you sign in via Google or another social provider, we receive the data that provider shares with us (typically name, email, and profile picture).

Booking Data

We collect data related to bookings you make: service type, provider, dates, number of participants, pricing, booking status, and cancellation or refund events.

Payment Data

Payment data is handled by our gateway partners (Stripe, HyperPay, Tap Payments). We store only tokenised references to your saved payment methods — never raw card numbers, CVVs, or full account numbers. See Section 4 for details.

User Content

We store content you create: reels, stories (until they expire after 24 hours), photos, posts, comments, community contributions, and direct messages.

When you send a voice message, its audio is sent to OpenAI to produce a transcript that only the members of that conversation can see. If a member asks to translate the transcript between Arabic and English, its text is sent to the AI model providers (OpenAI, Anthropic or Google Gemini) configured for the in-app chat assistant. A transcript is deleted when its message is unsent or when your account is deleted.

Usage & Device Data

We collect information about how you use the Platform: pages and screens visited, features used, interactions (likes, reactions, shares), search queries, and session durations. We also collect device information including device type, operating system, browser, language, and timezone.

Visitor Statistics (Country & City)

When another user views your profile, we record the country and city derived from the visitor's IP address to display in your visitor statistics. We never expose raw IP addresses to other users. Administrators may view IP addresses for security and fraud prevention purposes only.

Search History

If you are signed in, we save the searches you make on the Platform to your account so we can show you your recent and pinned searches. This is not shared with other users. You can pause search history, view it, or clear it at any time from Settings > Privacy. Unpinned entries you have not used in 18 months are deleted automatically.

2. How We Use Your Data

• Service Delivery: To process bookings, manage payments, send booking confirmations, and facilitate communications between travellers and providers.
• Personalisation: To recommend activities, destinations, communities, and content based on your preferences and interactions.
• Notifications: To send booking updates, social activity notifications, and platform announcements via in-app, push, email, or web push (subject to your preferences).
• Globe & AI Features: To power AI trip planning, reachability calculations, and route suggestions in Globe Premium.
• Analytics: To understand how the Platform is used, identify bugs, and improve features.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent transactions, account abuse, and security incidents.
• Legal Compliance: To comply with applicable laws, respond to lawful requests from authorities, and enforce our Terms.

3. Music & Audio Data

When you upload a reel or story with audio, or when you use the “Use This Sound” feature, we collect and store the following:

• An audio fingerprint of the content for copyright detection purposes
• Metadata about which sound or track was applied and by whom
• Usage counts and trend data for original sounds and Jamendo tracks

Audio fingerprints are used solely for rights management and moderation. They are not sold or shared with third parties other than as necessary for copyright enforcement.

4. Payment Data

ActivGate processes payments through PCI-DSS compliant third-party gateways: Stripe, HyperPay, and Tap Payments. Each gateway handles the collection, transmission, and storage of raw card data.

• We store only the token (a non-reversible reference) provided by the gateway after a successful authorisation.
• Tokens are used for recurring subscription billing and saved-card checkout — not for any other purpose.
• We store transaction IDs, amounts, currencies, statuses, and timestamps for accounting, dispute resolution, and legal compliance.
• We retain financial records for 7 years as required by tax and accounting regulations.

5. Location Data

We derive your approximate country and city from your IP address to:

• Pre-fill your currency and language preferences on first visit
• Display country and city (not IP) in the profile visitor statistics of users whose profiles you view
• Help detect suspicious login activity

Your raw IP address is visible to ActivGate administrators only and is never shared with other users, advertisers, or third parties except where required by law.

The Globe feature may request permission to access your device's GPS location for precise routing and reachability features. This is optional. We do not share your precise GPS location with other users or third parties.

Live Hiker Pulse (Presence Sharing)

If you opt in, we store your approximate current location (rounded to roughly 50 meters before it is shown to anyone) so friends can see where you are, and/or so we can show an anonymous, aggregated 'how busy is this trail' count. Your exact position is never sent to another user's device. Presence is a single, overwritten record, not a history, and automatically expires 2 hours after your last update.

Safety Sharing: Breadcrumbs, Check-ins and SOS

If you start a safety-sharing session before a hike, we collect your planned route, a live trail of your position fixes, expected check-in times, and the name, phone number, and (optionally) email of each emergency contact you add — including people who are not ActivGate users. This lets your contacts see your progress and lets us alert them automatically by SMS if you miss a check-in or trigger an SOS.

Individual position fixes are deleted once the session's retention window passes. The session record itself (planned route and contact details) and your saved emergency-contact book are kept for as long as your account exists, the same as other account data described in Section 9 — we have not yet set a shorter, separate retention window for them, and are working to do so.

Desire-Line Route Learning

Hike recordings you share publicly or with your community already help us learn where people actually walk, to improve route suggestions for everyone. You can additionally opt in, in Settings, to let your private and friends-only hike recordings contribute to this aggregated route-learning as well. This is off by default.

6. Cookies & Tracking

We use the following cookies and local storage items:

For full details see our Cookie Policy.

7. Third-Party Services

We share data with the following third-party service providers to the minimum extent necessary:

We do not sell your personal data to third parties. We do not share your data with advertisers beyond the anonymised, contextual signals described in our Advertising Policy.

8. Notifications

We may send you notifications via the following channels, subject to your preferences:

• In-app: Real-time alerts for social interactions, booking status changes, and platform updates.
• Web Push: Browser push notifications (requires opt-in).
• Mobile Push: Notifications to your mobile device (requires opt-in via device settings).
• Email: Booking confirmations, receipts, password resets, security alerts, and optional marketing emails (opt-in).

You can manage your notification preferences by category (Social, Booking, Payment, Community, Provider, Subscription), set quiet hours, and opt into a daily digest in Settings > Notifications. Transactional notifications (e.g. booking confirmations, security alerts) cannot be disabled.

9. Data Retention

When you delete your account, we begin the erasure process within 30 days. Financial records are retained for the 7-year period for legal compliance. Any identity-verification document (e.g. a passport or ID scan) you submitted is deleted, not merely anonymised, as part of this process.

10. Your Rights

Depending on your jurisdiction (including GDPR, UK GDPR, CCPA), you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request erasure of your personal data (right to be forgotten), subject to legal retention requirements.
• Data Portability: Receive your personal data in a structured, machine-readable format.
• Restriction: Request that we restrict processing of your data in certain circumstances.
• Objection: Object to processing based on legitimate interests, including profiling.
• Withdraw Consent: Where processing is based on consent (e.g. marketing emails), withdraw that consent at any time.

To exercise any of these rights, email us at info@activgate.com with the subject line 'Privacy Request'. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority.

11. Children's Privacy

The Platform is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected personal data from a person under 18 without verified parental consent, we will delete that account and data promptly. If you believe a child has created an account, please contact us at info@activgate.com.

12. International Data Transfers

ActivGate operates globally. Your data may be transferred to and processed in countries outside your own, including countries that may not have the same data protection laws. Where we transfer data internationally, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission, or equivalent mechanisms recognised by applicable law.

13. Security

We implement a range of technical and organisational security measures to protect your personal data:

• TLS/HTTPS encryption for all data in transit
• Encrypted storage for sensitive data at rest
• Password hashing using industry-standard algorithms (bcrypt/PBKDF2)
• Two-factor authentication (2FA) support, including passkeys (WebAuthn)
• Session management with automatic expiry and device tracking
• Role-based access controls limiting staff access to personal data
• Malware scanning of uploaded files before they are stored or shared
• Automatic removal of EXIF metadata (including GPS location and device identifiers) from photos before they are shown to other users
• Regular security reviews and dependency audits

No security system is impenetrable. If you discover a security vulnerability, please disclose it responsibly to info@activgate.com.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes we will notify you by email and/or display a prominent notice on the Platform. The updated policy will be effective from the date shown at the top of this page.

15. Contact

For any privacy-related questions, requests, or concerns: