Privacy Policy

This Privacy Policy explains how PLATEIA HABITUAL LDA (“we”, “us” or “our”) collects, uses, shares and protects your personal data when you use the Pocket Theatre audio walking application and website (together, the “Service”).

We process personal data in accordance with Regulation (EU) 2016/679 (the “GDPR”), Portuguese Law No. 58/2019 and other applicable data protection laws.

Privacy at a glance

This summary highlights the main points of our privacy practices. The full Policy below provides more detailed information.

• We do not sell your personal data.
• GPS mode is optional. You can complete a tour in manual mode without granting location permission.
• If you choose GPS mode, we process your current location as necessary to provide GPS-based features and calculate walking routes.
• We retain GPS route points for route analytics only where you have separately consented to that optional processing.
• Optional behavioural analytics and marketing attribution are used only where the required consent has been obtained.
• Payments are processed by Stripe. We do not receive or store your complete payment-card number.
• You can exercise your data protection rights or ask privacy questions by contacting dpo@notbad.show.

1. Data controller and contact details

The controller responsible for your personal data is:

PLATEIA HABITUAL LDA
Avenida Manuel Violas, 476
São Félix da Marinha
4410-137 Portugal
NIF: 519005813

Email: info@notbad.show
Privacy enquiries and data protection requests: dpo@notbad.show
Phone: +351 915 529 055

The email address dpo@notbad.show is our privacy contact. It does not indicate that we have formally appointed a Data Protection Officer under Articles 37–39 GDPR.

2. Data protection principles

We process personal data lawfully, fairly and transparently. We collect only the data reasonably necessary for the purposes described in this Policy, take reasonable steps to keep it accurate and secure, and retain it only for as long as necessary or legally required.

3. Personal data we collect

Depending on how you use the Service, we may collect the following categories of personal data.

Contact data

Your email address, including an address you enter to unlock or purchase a tour or that we receive from our payment provider in connection with a purchase.

An email address may be required to complete a purchase, receive an access code, restore access or save progress across devices. If you do not provide it, some of these features may not be available.

Access and purchase data

Access and promotional codes, purchase references, transaction amounts and statuses, refund information, tour entitlements and whether you have used a free demonstration.

Tour usage and progress data

The tour, show and stop you are using; audio start, pause, resume and completion events; listening time; playback speed and position; pop-up interactions; autoplay failures; saved progress; and survey or feedback responses, including NPS scores and any free text you submit.

Some of this information is processed as essential session or progress data needed to provide and restore the Service. More detailed behavioural analytics are processed only as described under “Analytics data” below.

Location data

If you choose GPS mode and grant location permission, we process your device’s latitude, longitude and reported accuracy while a tour is running.

Depending on your device and settings, coordinates may be sampled approximately every 15 seconds or after about 15 metres of movement. They may be used to:

• determine your position and unlock nearby tour stops;
• display your walking route;
• maintain the operation and safety of GPS-based features; and
• where you have separately consented, analyse routes and improve the tours we design.

Current coordinates are processed as needed to provide the live GPS functionality. Where a walking route needs to be calculated, the origin and destination coordinates necessary for that calculation are sent by our server to a routing provider.

Unless you have separately consented to optional route analytics, we do not retain your current GPS coordinates in our own analytics records as a history of the route you walked.

GPS mode is optional. If you do not grant location permission, you can complete the tour in manual mode.

You can withdraw your device’s location permission through its operating-system settings. This prevents future access to your location but does not automatically delete information already lawfully collected. You may contact us to request deletion, subject to applicable legal exceptions.

Technical and security data

IP address, request date and time, browser and device type, operating system, cookies and similar identifiers, page and route paths, error information and security logs.

Some technical information is generated automatically when your device communicates with our hosting, content-delivery, map, routing or other infrastructure providers.

Analytics data

If you consent, we may collect additional detailed information about how you interact with the Service, including feature and pop-up interactions, interface and autoplay diagnostics, listening behaviour and, where separately enabled, GPS route points used to analyse walked routes.

Whether or not you consent to optional analytics, we may process limited operational information needed to provide, restore, maintain and protect the Service. This may include tour and session state, stops reached or completed, audio start and completion status, listening time, saved playback position and speed, route-calculation status and necessary security, error and request-log information.

We do not use these essential operational records to retain a history of your GPS route unless you have given the relevant consent.

If you refuse analytics consent, we do not use optional analytics cookies or retain optional behavioural analytics or GPS route histories.

Marketing attribution data

If you consent, we may collect and store UTM parameters, campaign, advertisement or ad-set identifiers, source information, referring website and landing-page information, including information used to distinguish first- and last-touch attribution.

Payment data

Payments are processed by Stripe. Stripe collects and processes payment details such as card information directly. We do not receive or store complete card numbers.

We receive limited transaction information needed to confirm and administer a purchase, such as the payment reference, amount, currency, status and associated email address.

Information we do not request

We do not ask for passport information, personal tax identification numbers, dates of birth, nationality, photographs or videos.

We do not intentionally request personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric information, health information, or information concerning a person’s sex life or sexual orientation.

Please do not include sensitive personal information in free-text feedback. If such information is provided unexpectedly, we will process or delete it as appropriate and in accordance with applicable law.

4. How we obtain personal data

We obtain personal data:

• directly from you when you enter information, purchase or unlock a tour, adjust your preferences, submit feedback or contact us;
• automatically from your browser or device when you use the Service;
• from Stripe in connection with payments and refunds; and
• from referring websites or advertising links where applicable and permitted by your consent choices.

5. Purposes and legal bases

We process personal data for the following purposes and legal bases.

Performance of a contract — Article 6(1)(b) GDPR

We process data as necessary to:

• provide access to purchased or unlocked tours;
• deliver tour content and essential functionality;
• operate GPS mode when you choose it, including processing your current location and requesting a walking route as necessary to provide that feature;
• save and restore your progress;
• send access codes and service-related messages;
• administer purchases and refunds; and
• provide customer support connected with the Service.

Compliance with legal obligations — Article 6(1)(c) GDPR

We process and retain information where necessary for invoicing, accounting, tax compliance, fraud reporting, responses to lawful authority requests and other legal obligations.

Legitimate interests — Article 6(1)(f) GDPR

We process limited personal data where necessary for our legitimate interests in:

• operating, maintaining and securing the Service;
• preventing fraud, abuse and unauthorised access;
• diagnosing errors and technical problems;
• answering general customer enquiries;
• establishing, exercising or defending legal claims; and
• producing basic aggregated or anonymised service statistics.

When relying on legitimate interests, we consider the necessity and proportionality of the processing and its possible impact on your rights and freedoms.

Consent — Article 6(1)(a) GDPR

Where required, we rely on your consent for:

• non-essential analytics cookies;
• additional detailed behavioural and product analytics;
• storing and analysing GPS route histories for product and route improvement;
• marketing-attribution cookies and marketing-attribution records; and
• marketing emails.

You can withdraw consent at any time through “Cookie settings” in the website footer, through the settings made available in the Service, by using the unsubscribe link in a marketing email, or by contacting dpo@notbad.show.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

6. Automated decision-making

We do not use personal data to make decisions based solely on automated processing that produce legal effects or similarly significant effects concerning you.

7. Service providers and other recipients

We disclose personal data only where reasonably necessary to operate the Service, complete transactions, comply with the law or protect our rights.

Recipients may include:

• Supabase, which provides database, authentication and file-storage services and may store contact and access information, tour progress, survey responses and, where enabled, analytics and location records;
• Lovable and its infrastructure providers, including Cloudflare, which provide application hosting, edge delivery, security and related infrastructure and may process IP addresses, request information and technical logs;
• Stripe, which processes payments and may act as an independent controller for certain fraud-prevention, regulatory and compliance activities;
• Resend, which provides email-delivery services for ticket and access-code emails and processes recipient email addresses, message content and related delivery information;
• Lovable Emails, the email infrastructure built into our hosting platform, which delivers account and sign-in related emails and processes recipient email addresses, message content, queue records and delivery information;

• Cloudflare R2, which hosts audio and image files used by the Service and may receive IP addresses and technical request information when your device downloads that media;
• WhatsApp (Meta), where you choose to contact us through the in-app help link, in which case your phone number, profile information and message content are processed by WhatsApp under its own terms and privacy policy;
• the OpenStreetMap Foundation, whose map-tile infrastructure is used to display maps and may receive IP addresses, technical request information and information about the map tiles or geographic area requested by your browser;
• FOSSGIS-operated OpenStreetMap.de routing services, including Valhalla and OSRM services, and BRouter, which may receive the origin and destination coordinates and technical request information necessary to calculate a walking route when routing is used;
• Google Fonts and UNPKG, while externally hosted fonts or application assets are loaded from those services, which may receive IP addresses and technical request information;

• Google Ireland Limited (Google Analytics), which provides website analytics. Where you consent to analytics cookies, the Google Analytics tag is loaded and Google receives your IP address, cookie identifiers, the pages and routes you view, referrer information, approximate location derived from the IP address, and device, browser and interaction information, which Google processes to produce aggregated statistics for us. We do not send Google your email address, access codes, GPS coordinates or any other information that could identify you directly. For details of how Google handles this information, see How Google uses information from sites or apps that use our services; and

• public authorities, courts, regulators, professional advisers or other parties where disclosure is required by law or reasonably necessary to establish, exercise or defend legal claims.

We do not sell your personal data.

We do not install advertising pixels solely because you arrive through an advertising or referral link. Where campaign identifiers or referring information are available from a link, we retain that information for marketing attribution only where the required consent has been obtained.

Our providers and the infrastructure used by the Service may change as the Service develops. You may contact dpo@notbad.show for further information about the providers currently used and the data they process in connection with the Service.

8. International data transfers

Some service providers or their affiliates may process personal data outside the European Economic Area.

The location in which a particular provider processes data depends on the service and, where applicable, the region configured for our account. The use of an EEA primary hosting or database region does not necessarily mean that all supporting infrastructure, technical logs, backups, edge services or subprocessors are located exclusively within the EEA.

Where personal data is transferred to a country that has not been recognised as providing an adequate level of protection, we use an applicable lawful transfer mechanism. This may include:

• an adequacy decision adopted by the European Commission;
• the EU–US Data Privacy Framework, where the recipient is an active participant and the framework applies to the relevant processing; or
• the European Commission’s Standard Contractual Clauses, together with supplementary safeguards where required.

The mechanism applicable to a particular transfer may depend on the provider, service, processing location and the provider’s current contractual arrangements.

Google Analytics is provided to us by Google Ireland Limited. Google may process the data on infrastructure located outside the EEA, including in the United States, relying on the transfer mechanisms set out in its own data protection terms, which include the European Commission’s Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

You may contact dpo@notbad.show for further information about the transfer mechanism and safeguards applicable to a particular provider.

9. Data retention

Unless a longer period is required by law or reasonably necessary for legal claims, we apply the following retention periods:

• accounting, invoicing and purchase records: 10 years, where required under Portuguese law;
• tour sessions, saved progress and access-code records: 24 months after your last activity;
• optional analytics events, retained GPS route points and marketing-attribution records: 12 months;
• Google Analytics event-level and user-level data: the retention period configured in our Google Analytics property, which does not exceed 14 months, after which Google deletes or aggregates the data. The analytics cookies Google sets in your browser expire as stated in our Cookie Policy;
• marketing contact information: until you withdraw consent or, in any event, no longer than 3 years after your last relevant interaction;
• email suppression and unsubscribe records: for as long as reasonably necessary to honour your opt-out choice and demonstrate compliance with applicable requirements;
• cookies and similar technologies: for the periods specified individually in our Cookie Policy; and
• essential technical and security logs: only for as long as reasonably necessary for security, troubleshooting and fraud prevention. Service providers may retain their own technical and security logs in accordance with their applicable terms, policies and legal obligations.

At the end of the applicable period, personal data is deleted or irreversibly anonymised unless continued retention is required by law or necessary to establish, exercise or defend legal claims.

Backups may retain deleted information for a limited additional period until they are securely overwritten. Access to backup data is restricted and it is not used for ordinary business purposes.

10. Your rights

Subject to the conditions and exceptions provided by applicable law, you may have the right to:

• obtain confirmation of whether we process your personal data and request access to it;
• correct inaccurate or incomplete personal data;
• request deletion of personal data;
• request restriction of processing;
• receive personal data you provided in a structured, commonly used and machine-readable format and, where technically feasible, have it transmitted to another controller;
• object to processing based on our legitimate interests on grounds relating to your particular situation;
• object at any time to processing for direct marketing;
• withdraw consent at any time; and
• lodge a complaint with a data protection authority.

These rights are not absolute. For example, we may retain information that we are legally required to keep or that is necessary to establish, exercise or defend legal claims.

To exercise your rights, contact dpo@notbad.show. We may request information reasonably necessary to verify your identity, such as confirmation from the email address used for the tour.

We respond without undue delay and normally within one month. Where permitted by law, this period may be extended by a further two months, taking into account the complexity and number of requests. We will inform you of any extension and the reasons for it within the initial one-month period.

Exercising your data protection rights is normally free of charge. Where a request is manifestly unfounded or excessive, particularly because it is repetitive, we may charge a reasonable fee or refuse to act, as permitted by the GDPR.

You can stop marketing emails at any time by using the unsubscribe link included in each marketing message.

11. Complaints

You have the right to lodge a complaint with the Portuguese supervisory authority:

Comissão Nacional de Proteção de Dados (CNPD)
Avenida D. Carlos I, 134, 1.º
1200-651 Lisboa
Portugal

You can find the CNPD’s official website by searching for “Comissão Nacional de Proteção de Dados Portugal”.

You may also have the right to complain to the competent supervisory authority in the EEA country where you live, work or believe an infringement occurred.

12. Children

The Service is intended for users aged 16 and over. We do not knowingly collect personal data from anyone under 16.

If you believe that a person under 16 has provided us with personal data, please contact dpo@notbad.show. We will investigate and delete the information where appropriate.

13. Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

These measures include access controls, restricted administrative access, row-level database security where applicable, encrypted network connections and security monitoring.

No method of electronic transmission or storage is completely secure. We therefore cannot guarantee absolute security, but we regularly review our measures and seek to improve them as the Service develops.

14. Cookies and similar technologies

We use a consent interface that separates cookies and similar technologies into categories such as necessary, analytics and marketing.

Necessary technologies are used to provide and secure the Service and do not require consent where permitted by law. Analytics and marketing technologies are activated only after any legally required consent has been obtained.

For information about the cookies and similar technologies used, including local and session storage and the Google Analytics cookies, their purposes and durations, see our Cookie Policy.

Your cookie choices are stored in a strictly necessary cookie. Where your browser blocks that cookie, the same record is stored in your browser’s local storage instead, so that your choices can still be honoured on later visits.

You can review or change your choices at any time through “Cookie settings” in the website footer. Withdrawal does not affect processing carried out before your preferences were changed.

15. Changes to this Policy

We may update this Privacy Policy to reflect changes to the Service, our providers, our data practices or applicable law.

The current version will be published on this page with a revised “Last updated” date. If changes materially affect how we use personal data or your rights, we will provide additional notice where appropriate.

16. Contact us

For questions about this Privacy Policy or our handling of personal data, contact:

Email: dpo@notbad.show
General enquiries: info@notbad.show
Phone: +351 915 529 055

© 2026 PLATEIA HABITUAL LDA