GDPR
Privacy Policy — HeriTogo
Updated : 14 October 2026
1. Who collects data?
HeriTogo, Lomé, Togo, is the data controller. Contact: privacy@heritogo.tg. We provide Togolese heritage discovery and matching between travellers and certified local guides.
2. What data?
Data minimisation: name, email, password hashed by the auth provider (never in plain text), role, language, optional phone, booking data. GPS only with your consent, in memory during a scan, never stored historically. Notifications only if you enable them. Guide KYC identity documents are processed by a third party; they never transit or sit on our servers. Scan history stays on your device.
3. Why?
To run the service (account, scanner, map, bookings) and keep users safe through verified guides. We do not sell your personal data.
4. Retention
Account and bookings until you delete your account (immediate hard delete). GPS is ephemeral. KYC files stay with the provider; we keep only a session id and status. Session cookies: 7 days.
5. Security
HTTPS/TLS, hashed passwords (bcrypt / Supabase Auth), HttpOnly session cookies (Secure in production, SameSite=Lax).
6. Your rights
Access and rectify data in the dashboard. Withdraw geolocation or notification consent in settings. Permanently delete your account. Manage advertising choices via the link in the footer. Contact privacy@heritogo.tg.
7. Processors & Partners
Supabase (hosting/auth), Google Gemini (scan image, processing time only), KYC provider (Stripe Identity when configured), Google AdSense (display advertising), transactional email.
8. Cookies and Google AdSense Advertising
We use essential cookies to operate the service (session, authentication, language, and theme preferences). To support free access to our cultural heritage guide, we display advertisements via Google AdSense. Google and its certified partners use cookies (such as the DoubleClick cookie) to serve ads based on your prior visits to this or other websites. For visitors in the European Economic Area (GDPR), a Google-certified consent message (Funding Choices) allows you to accept or refuse personalized advertising and third-party tracking. You can review or revoke your choices at any time by clicking "Manage ad preferences" in our footer, or directly via https://adssettings.google.com and www.aboutads.info.
9. Children
The service is not intended for anyone under 16.
10. Contact
privacy@heritogo.tg — HeriTogo, Lomé, Togo.