Privacy Policy

1. Who we are and what this policy covers

ExploraQuest (“ExploraQuest,” “we,” “us”) is a brand of and is operated by Dovetail Ventures LLC, a Texas limited liability company with its principal address at 5900 Balcones Dr, Ste 100, Austin, TX 78731-4298, USA. For the purposes of the EU and UK General Data Protection Regulation (“GDPR”), we are the controller of the personal information described in this policy.

This policy applies to exploraquest.com, the ExploraQuest web application, the printable guides we generate, the Trip Companion and Emergency Contact pages reached by scanning a guide’s QR codes, and the emails we send (together, the “Service”). It does not apply to third-party websites or services we link to, which have their own privacy policies.

This policy should be read together with our Terms of Service.

2. Children’s privacy

We deliberately ask for as little as possible about children, and we encourage you to add each child by a codename or nickname rather than their real name. That way nothing identifying needs to appear on a printed page. We do not ask for a child’s full name, date of birth, photograph, school, address, precise location, or contact details.

What we hold about a child, and why

• Codename or nickname. Printed on the guide and shown on its Trip Companion page, so the guide feels personal.
• Age. Used only to pick the right age band (e.g. 5–7, 8–10, 11–13) for reading level, difficulty and scoring.
• Gender (optional). Used only to choose which version of our guide character, Quest, appears in the guide.
• Character appearance (optional). You may pick which illustrated Quest your child sees, for example a skin-tone variant of the artwork. This is a choice of illustration, not a statement of your child’s race or ethnicity, and we never ask for or record ethnicity. Because it could be read as revealing something sensitive, we treat it with extra care. We use it only to pick artwork, report on it only as totals across all users, and never share it with third parties.
• Interests, reading level and adventure theme (optional). Used to tailor the guide.

Parental rights

As a parent or guardian, you can at any time review the information we hold about your child, correct it, delete it, or tell us to stop using it. You can edit a child profile directly in your account. Removing a profile there hides it from your account and stops it being used for new guides. To have it permanently erased from our systems, or for anything else, email support@exploraquest.com. If you ask us to stop using a child’s information, we will no longer be able to make guides for that child.

Children’s Online Privacy Protection Act (COPPA) and similar laws

We do not knowingly collect personal information directly from children under 13 (or under the equivalent minimum age in your country). If you believe a child has given us personal information directly, for example by creating an account or contacting us, please email support@exploraquest.com. We will delete it promptly.

We do not use children’s information for advertising, we do not build profiles of children for marketing, we do not sell or “share” it (as those terms are defined in U.S. state privacy laws), and we do not use it to train artificial-intelligence models.

3. Information we collect

3.1 Information you give us

• Account information: your email address and password. Passwords are stored only in hashed form; we never see or store them in plain text. We also store your preferred language and your guide-credit balance.
• Child profiles: as described in section 2.
• Trip information:an optional trip name, travel dates, the cities and countries you’re visiting, the specific places (for example, a museum or landmark) you want guides for, and which children each guide is for.
• Alternate delivery email (optional):a second email address, such as another parent’s, that you ask us to send a “guides ready” email to. Please only give us an address when you have that person’s permission.
• Reviews and feedback: a star rating and optional comments you submit after a trip.
• Support messages: anything you send when you contact us.

3.2 Purchase information

Payments are handled by Stripe on a Stripe-hosted checkout page. For purchases of guide-credit packs, Stripe acts as the merchant of record and reseller (through its Managed Payments service). Stripe collects your payment card or other payment details, billing name and address, email address, and the information needed to calculate and collect sales tax or VAT. It processes them under its own privacy policy. We never receive or store your full card number. From Stripe we receive a checkout reference, the pack you bought, the amount paid, the credits granted, and the payment status.

3.3 Information we create when we provide the Service

• Generated guides: the guide content, the finished PDF, and two unique, hard-to-guess codes per guide. One code powers the Trip Companion QR code and the other powers the Emergency Contact QR code (see sections 4 and 5).
• Order records: which guides were ordered, their status, when they were generated, and whether a credit was refunded after a failed generation.
• Email records: which service and marketing emails we sent you and when, and your subscription or unsubscribe status.

3.4 Information from people who scan a guide

A printed guide may be seen by anyone who picks it up. When someone scans a guide’s QR code:

• Trip Companion page:we record the time of the visit, the visitor’s browser “user agent” string (which describes the browser and device type), the referring page if any, and which outbound links (food, directions, tickets, events) they click.
• Emergency Contact page:if someone uses this page to report that they have found a child, we collect what they choose to give us: a description of where they are, a phone number, and any messages. Any replies are collected too, and either side can share a message with their own precise device location if they choose to tap “Use my location.” We also log the IP address and browser “user agent” string of everyone who posts to the thread. See section 5.

3.5 Information collected automatically

• Usage events we log ourselves:when a guide PDF is downloaded, and when a link in one of our emails is clicked. For each we record the time and your browser’s user-agent string.
• Server and security logs: our hosting and infrastructure providers automatically process technical data such as IP address, request time, requested page, and browser type. They do this to deliver the Service, prevent abuse, and diagnose errors.
• Cookies: a small number of essential cookies (see section 11).

What we do not collect:we do not use third-party analytics or advertising trackers, social-media pixels, or fingerprinting, and we do not collect precise geolocation from your device, photos, contacts, or biometric data, except where you or a finder chooses to share it through the Emergency Contact page’s “Use my location” button (see section 3.4 and section 5).

4. QR codes, guide links and who can see them

Because guides are printed and carried around, some information is reachable by anyone who has the guide or its link:

• The printed guideshows your child’s codename, the destination, and any trip date you entered. Treat a printed guide like any other personal paper.
• The Trip Companion page, reached by the guide’s QR code, shows the child’s codename, the destination, and live information such as the weather forecast. It does not show your name, email address, or account details. Anyone who scans the code or has the link can open it.
• Guide PDF filesare stored at unique, hard-to-guess web addresses. Anyone who has a PDF’s address can open it, so don’t post these links publicly.

The Trip Companion page links to third-party services such as Google Maps and Google Search. When you follow one of those links, the destination name travels to that service in the link, and your use of it is governed by that provider’s privacy policy.

5. The Emergency Contact feature

Each guide carries an Emergency Contact QR code. If your child is separated from you and a helpful adult scans it, that person can send you a message, their location description, and their phone number without seeing any of your contact details. We email you the moment the first message arrives, and you can reply through the same page.

• What the finder or parent shares:whoever is on the thread chooses what to type. We ask the finder for a location description and a phone number so you can reach them. Either side can instead (or also) tap “Use my location” to share their device’s precise GPS location — this only happens if they grant their browser’s location permission, and we never collect it otherwise.
• Who can see the thread:anyone who has that guide’s emergency link can read and add to the conversation, until both sides confirm you’ve reconnected. That includes you and the finder, and anyone else who scans the code on that guide.
• When the conversation closes:once both you and the finder confirm you’re reconnected, the thread closes permanently. No further messages can be added.
• Why we process it: to help reunite a child with their family. That is in the vital interests of the child and in the legitimate interests of the family and the finder.
• Retention: once closed, we keep the thread — including any location shared and the technical logs described in section 3.4 — for at least 7 years. See section 10.

This feature is not an emergency service. Anyone who believes a child is in danger should contact local emergency services (911 in the United States) first. See our Terms of Service.

6. How we use information

We use personal information to:

• Provide the Service: create and manage your account, save your children and trips, generate personalized guides and PDFs, and run the Trip Companion and Emergency Contact pages.
• Process purchases: add purchased credits to your account, handle failed-generation credit refunds, and keep financial records.
• Send service emails: account confirmation, “your guides are ready,” and emergency-contact alerts. These are essential to the Service, and you cannot opt out of them while you have an account.
• Send product emails: trip reminders, draft-trip nudges, post-trip review requests, and trip anniversaries. Every one includes a one-click unsubscribe link (see section 12).
• Support you: respond to questions, requests and complaints.
• Keep the Service safe: detect and prevent fraud, abuse, and security incidents, and enforce our Terms.
• Improve the Service: for example, measuring how often guides are downloaded, how often QR codes are scanned, and whether email links are clicked. Where practical, we do this with totals across all users rather than per person.
• Comply with law: meet tax, accounting, and legal obligations, and respond to lawful requests.

We do not sell personal information, use it for targeted or cross-context behavioral advertising, or make decisions about you based solely on automated processing that have legal or similarly significant effects.

7. How we use artificial intelligence

Guide text and some illustrations are produced with the help of generative AI models provided by OpenAI. We send these models only what they need to write about a place:

• the destination name (city, country, and place) you entered;
• the age band (for example, “8–10”) and the guide language; and
• the activity types chosen for the guide.

We do not send your child’s codename, age, gender, character appearance, or interests, or your name or email address, to AI providers. Personalization such as printing your child’s codename and choosing their illustrated character happens on our own systems after the AI step.

Under OpenAI’s API terms, content sent through its API is not used to train its models by default. OpenAI may keep it for a limited period to monitor for abuse. Please don’t put personal details in free-text fields such as the trip name or place names.

8. Legal bases for processing (EEA, UK and Switzerland)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on these legal bases:

Where we rely on legitimate interests, we have weighed them against your rights. You can object at any time (see section 13).

9. How we share information

We share personal information only with the service providers (“processors”) that help us run ExploraQuest, under contracts that limit how they can use it, and in the limited circumstances described below.

We will update this list if the providers we rely on change.

We may also share information:

• With the people you ask us to: for example, the alternate delivery email address you enter, or a finder through the Emergency Contact thread.
• For legal reasons: to comply with law, legal process, or government requests; to protect the rights, property, or safety of ExploraQuest, our users, children, or the public; or to enforce our Terms.
• In a business transfer: if we are involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that deal, subject to this policy. We will notify you before your information becomes subject to a materially different privacy policy.
• With your consent: for any other purpose you agree to.

We do not sell personal information and we do not “share” it for cross-context behavioral advertising, and we have not done so in the past 12 months.

10. How long we keep information

We keep personal information only as long as we need it for the purposes above. Unless the law requires otherwise, we keep it for these periods:

Guide PDFs you have already downloaded or printed are outside our control. Deleting your account does not delete copies you hold.

11. Cookies

We use only the cookies needed to run the Service. We do not use advertising or third-party analytics cookies.

When you buy credits you are taken to Stripe’s checkout page, where Stripe sets its own cookies to process the payment and prevent fraud. Because we use only strictly necessary cookies, we do not show a cookie consent banner. You can block or delete cookies in your browser settings, but you won’t be able to sign in without the authentication cookies.

12. Emails and your choices

Service emails(account confirmation, guides ready, emergency alerts) are part of the Service. The “guides ready” email goes to your account address and to any alternate delivery address you enter for that trip.

Product emails (trip reminders, draft-trip nudges, review requests, trip anniversaries) include a one-click unsubscribe link. Unsubscribing takes effect immediately and applies to that email address. You can also email support@exploraquest.com to unsubscribe.

Email link tracking: links in our emails pass briefly through our servers so we can count clicks before sending you on to the right page. We do not use tracking pixels to detect when an email is opened.

13. Your privacy rights

Depending on where you live, you may have some or all of these rights:

• Access: find out what personal information we hold about you or your child and get a copy.
• Correction: fix inaccurate information.
• Deletion: ask us to delete personal information, including your whole account.
• Portability: receive your information in a structured, machine-readable format.
• Objection and restriction: object to, or ask us to limit, processing based on legitimate interests, including direct marketing.
• Withdraw consent: where we rely on consent. This does not affect processing that already took place.
• Opt out of sale, sharing, targeted advertising or profiling: we don’t do any of these, so there is nothing to opt out of.
• Non-discrimination: we will not treat you differently for exercising your rights.

How to exercise your rights

You can edit child profiles and trips in your account. For everything else, including permanent erasure and account deletion, email support@exploraquest.com from the address on your account. We may need to verify your identity before we act. We respond within one month (GDPR), or within 45 days where U.S. state law applies, and we will tell you if we need more time as the law allows. You may use an authorized agent where the law permits. We may ask for proof of their authority.

If we decline your request, you may appeal by replying to our decision. We will respond to your appeal within the time the law requires. If you are unhappy with how we handle your information, you can complain to your local data protection authority. In the UK that is the Information Commissioner’s Office. In the EU it is the authority in your country of residence.

California residents

In the past 12 months we have collected these categories of personal information, as defined by the California Consumer Privacy Act: identifiers (email address); commercial information (credit purchases); internet or other electronic network activity (the usage events in section 3.5); approximate geolocation (the destinations you enter; a finder’s location description); precise geolocation (if you or a finder taps “Use my location” on the Emergency Contact page); and personal information about children as described in section 2. We collect it from you, from people who scan a guide, and automatically, for the purposes in section 6. We disclose it for business purposes only to the service providers in section 9. We do not sell or share it, and we do not use sensitive personal information to infer characteristics about you.

Global Privacy Control / Do Not Track: because we do not sell or share personal information or use it for targeted advertising, these browser signals do not change how we process your information.

14. International data transfers

ExploraQuest is operated from, and our servers are located in, the United States. If you use the Service from outside the United States, your information will be transferred to, stored, and processed in the United States and other countries where our service providers operate. Their data protection laws may differ from those in your country.

Where we transfer personal information out of the EEA, UK or Switzerland, we rely on appropriate safeguards. These include the European Commission’s Standard Contractual Clauses (and the UK Addendum), or a provider’s certification under the EU–U.S. Data Privacy Framework and its UK and Swiss extensions. You can ask for more information about these safeguards at support@exploraquest.com.

15. How we protect information

We use administrative, technical and physical safeguards appropriate to the information we hold, including:

• encryption of data in transit (HTTPS/TLS), and encryption of our backups;
• database access controls, with sensitive internal records (such as emergency messages and email logs) reachable only by our own servers;
• unique, randomly generated, hard-to-guess codes for guide QR links, emergency links, and unsubscribe links;
• restricting administrative access to a small number of authorized people; and
• asking you to use codenames for children, so less identifying information exists in the first place.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we learn of a breach that affects your personal information, we will notify you and the relevant authorities as the law requires. Please keep your password confidential, and tell us right away at support@exploraquest.com if you suspect unauthorized access to your account.

16. Changes to this policy

We may update this policy from time to time. When we do, we will change the “Last updated” date above. If a change is material, especially one about children’s information, we will give you notice by email or in the Service before it takes effect. Where the law requires, we will ask for your consent.

17. Contact us

For questions about this policy or your information, contact:

Dovetail Ventures LLC (ExploraQuest)
Attn: Privacy
5900 Balcones Dr, Ste 100
Austin, TX 78731-4298, USA
Email: support@exploraquest.com