Privacy policy

1 · Introduction

This Privacy Policy explains how AITourPilot ApS (“AITourPilot,” “we,” “us,” or “our”) collects, uses, stores, and protects your personal data when you use our website (aitourpilot.com), our campaign and invitation pages (invite.aitourpilot.com), and our AI-powered museum tour services. We are committed to protecting your privacy in compliance with the EU General Data Protection Regulation (GDPR) and applicable Danish data protection law.

2 · Who we are (data controller)

The data controller responsible for your personal data is:

AITourPilot ApS
Fuglsøvej 4
7200 Grindsted, Denmark
Email: info@AITourPilot.com

3 · Data we collect and why

We collect and process personal data only when necessary and for specific, legitimate purposes.

a) Website visitors. Analytics data: only if you consent – pages visited, time on site, device and browser type, referring website, approximate location and five events, collected with Google Analytics 4 to improve our website. Legal basis: consent (Art. 6(1)(a) GDPR); see section 4. Technical data: IP address (anonymized), browser type, operating system, collected automatically by our hosting provider (Vercel). Legal basis: legitimate interest.

b) Contact form submissions. Name, email address, message content: collected when you contact us. Legal basis: taking steps at your request prior to a possible contract (Art. 6(1)(b) GDPR). Museum/Organisation name (if provided): for business inquiries. Legal basis: legitimate interest.

c) Museum partners. Business contact details: name, email, phone, organization name, collected during demo bookings and partnership discussions. Legal basis: pre-contractual/contractual measures (Art. 6(1)(b) GDPR).

d) App users. Usage data: tour interactions, preferences, and feedback within the AITourPilot app. Legal basis: consent and/or contract performance. Conversations with the AI guide: your voice is processed in real time to create the guide’s answers; audio is never stored. A text transcript of each conversation is stored for up to 90 days and then deleted. For museum preview links, we keep transcripts in our own database until the preview link is deleted or our business relationship with the museum ends. Legal basis: your consent, which you give on the information screen before your first conversation (Art. 6(1)(a) GDPR); for museum preview links, our legitimate interest in running the pilot with museum staff (Art. 6(1)(f) GDPR). Details, including the short visit summary that lets the guide remember you, are in the app privacy policy.

We do not collect sensitive personal data (health data, biometric data, political opinions, etc.).

4 · Cookies and analytics

Our website uses a small number of cookies. Some are strictly necessary for the site to work and to remember your choices – these are set without asking. We also use one analytics tool, Google Analytics 4, but only if you agree to it. When you first visit, a banner lets you choose “Accept all” or “Reject all”, shown with equal prominence. Until you select “Accept all”, no analytics cookies are set and nothing is sent to Google.

This section is about how visitors use this marketing website. It is separate from the AITourPilot app and your conversations with Henry: those are handled under the app privacy policy and are never shared with website analytics. Website analytics never receive any of your conversation data.

Google Analytics 4

We use Google Analytics 4 to understand how people find and use this website, so we can improve it. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; the data is processed by Google LLC in the United States. This is a website analytics property of its own, entirely separate from the app.

Legal basis: your consent (Art. 6(1)(a) GDPR), together with the Danish Cookie Order (cookiebekendtgørelsen), which implements Art. 5(3) of the ePrivacy Directive, for storing and reading cookies on your device.

What we collect – only after you accept: the pages you view and how long you stay, your device and browser type, the website that referred you, and your approximate location (country and city, which Google derives from your IP address – GA4 does not store your IP address). We also record five events: that a demo request was sent successfully (only which form was sent; your name, email and message are never sent to Google), a click to the booking calendar, the start of an audio example (the file name only), a click that opens the Henry web app (only which button was clicked), and a language switch.

We have configured Google Analytics conservatively: Google signals and ad personalisation are off, all advertising consent types are denied, granular location and device data are off, data sharing with Google is switched off, and there is no link to Google Ads. We do not use analytics for advertising of any kind.

Withdrawing consent. You can change your mind at any time. “Cookie settings” in the footer of every page reopens the banner. If you reject there, analytics collection stops and the _ga cookies are deleted. Withdrawing consent is as easy as giving it, and it does not affect anything that happened before you withdrew.

International transfer. When you accept analytics, data is transferred to Google LLC in the United States. Google LLC is certified under the EU–US Data Privacy Framework, which the European Commission recognises as ensuring an adequate level of data protection; Standard Contractual Clauses serve as an additional safeguard.

Retention. Analytics data is retained for 14 months and then deleted automatically. For more on how Google processes data, see Google’s privacy policy.

We do not use advertising cookies and we do not sell your data. We do not use Facebook Pixel, Google Ads remarketing, or similar tracking technologies.

5 · Data retention

We retain personal data only as long as necessary for the purpose it was collected. Contact form data: up to 12 months after the last interaction, unless an ongoing business relationship exists. Business partner data: for the duration of the business relationship, plus any legally required retention period. Website analytics (Google Analytics 4, only with your consent): 14 months, then deleted automatically. App usage data: retained for the duration of your account, deleted within 30 days of account deletion.

6 · Your rights (under GDPR)

As a data subject under GDPR, you have the following rights: right of access (Art. 15), request a copy of the personal data we hold about you; right to rectification (Art. 16), request correction of inaccurate data; right to erasure (Art. 17), request deletion of your data (“right to be forgotten”); right to restriction (Art. 18), request that we limit how we process your data; right to data portability (Art. 20), receive your data in a machine-readable format; right to object (Art. 21), object to processing based on legitimate interest; right to withdraw consent (Art. 7), withdraw consent at any time (e.g. through “Cookie settings” in the footer).

To exercise any of these rights, contact us at info@AITourPilot.com. We will respond within 30 days. You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet).

7 · Data transfers outside the EU/EEA

Some of our service providers may process data outside the EU/EEA. Vercel Inc. (hosting): US-based, covered by the EU-US Data Privacy Framework. Google Ireland Limited / Google LLC (United States): website analytics (Google Analytics 4), only where you have given consent; certified under the EU–US Data Privacy Framework, with Standard Contractual Clauses as an additional safeguard. AI service providers: Conversations with Henry are processed by an AI voice provider and an AI language-model provider in the USA, under EU Standard Contractual Clauses. What is stored and for how long is described in the app privacy policy. We ensure all providers meet GDPR requirements through Standard Contractual Clauses (SCCs) or adequacy decisions.

We do not transfer personal data to countries without adequate data protection safeguards unless appropriate legal mechanisms are in place.

8 · Data security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include HTTPS/TLS encryption for all data in transit; encrypted storage for sensitive data at rest; access controls limiting data access to authorized personnel only; regular security reviews of our infrastructure and code; and secure hosting on Vercel with automatic SSL certificate management.

9 · Third-party links

Our website may contain links to third-party websites (e.g. Google Calendar for demo bookings, YouTube for video content, LinkedIn, Instagram). We are not responsible for the privacy practices of these external sites. We encourage you to read their respective privacy policies before providing any personal data.

10 · Children’s privacy

Our website and services are not directed at children under 13. We do not knowingly collect personal data from children under 13. If you become aware that a child has provided us with personal data, please contact us and we will delete it promptly.

11 · Policy updates

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The updated policy will be posted on this page with a revised “Effective Date.” We encourage you to review this page periodically. Material changes will be communicated through a prominent notice on our website.

12 · Contact us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

AITourPilot ApS
Fuglsøvej 4
7200 Grindsted, Denmark
Email: info@AITourPilot.com
Phone: +45 20308202