Privacy Policy

Last updated: 19 July 2026

This Privacy Policy explains how the RAGUSA mobile app and website (“RAGUSA”, “we”, “us”, “our”) collect, use and protect your personal information, and the rights you have. RAGUSA is a travel-guide service for Dubrovnik, Croatia, operated as a registered sole proprietorship (obrt) in Croatia. We are the data controller for the personal data described below. You can reach us any time at info@ragusaguide.com.

Information we collect

Account information. If you create an account, we collect your name, date of birth, email address, phone number and a password (stored in encrypted form by our authentication provider). If you sign in with Apple or Google instead, we receive your name and email address from them. You can browse much of the app without an account.
Booking information. When you request an airport transfer or a boat experience, we collect your name, email, phone number and trip details (pick-up and drop-off, dates and times, flight number, hotel or address, number of passengers and suitcases, and any notes). We use this to arrange the service and pass it to the local operator who fulfils it.
Your questions to the AI guide. When you use “Ask RAGUSA”, the text of your questions and any photo you choose to attach are sent to our AI provider to generate a response. Please don’t include sensitive personal information in these messages.
Approximate location. Only if you grant permission, and only while the app is open, we use your device location to show your position on the map and suggest nearby places. We do not track your location in the background and do not store your location history. Weather is based on Dubrovnik’s fixed coordinates, not your location.
Purchases. If you buy a pass, the transaction is processed by the app store (Apple App Store or Google Play) and our subscription provider. We receive a record of what you purchased and its status — never your full card details.
Usage and content activity. We record basic product analytics (which features are used) and which stories or guides you complete, to run and improve the app. This is linked to your account when you are signed in.
Saved places. Places you save are stored on your device.

How we use your information

To provide the app and your account, and to keep you signed in — performance of a contract.
To arrange the transfers and experiences you request, and communicate with you about them — performance of a contract.
To answer your questions through the AI guide — performance of a contract.
To process purchases and provide the features they unlock — performance of a contract / legal obligation.
To understand usage, fix problems and improve RAGUSA — our legitimate interest in operating a reliable, useful service.
To comply with legal, accounting and tax obligations — legal obligation.

Who we share it with

We do not sell your personal data. We share it only with the service providers that make RAGUSA work, and only as needed:

Supabase — database, account authentication and hosting of your account, bookings and analytics data.
OpenAI — processes the questions and photos you send to the AI guide to generate replies.
RevenueCat, Apple App Store and Google Play — process and validate your purchases.
Resend — sends transactional email such as your verification code and your booking request.
Local transfer and boat operators — receive the booking details you submit, to fulfil the service you requested.
Open-Meteo (weather) and OpenFreeMap / MapLibre (map tiles) — receive technical requests to display weather and maps; these do not include your identity.

We may also disclose information if required by law, or to protect our rights, users or the public.

International transfers

Some of our providers (for example, OpenAI) process data on servers outside the European Economic Area, including in the United States. Where that happens, the transfer is protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

How long we keep it

We keep your account information for as long as your account exists. Booking records are kept as long as needed to provide the service and to meet legal and accounting requirements. Analytics are kept for a limited period. Data stored on your device (such as saved places) stays until you clear it or uninstall the app.

Your rights

Under the GDPR you have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent at any time. To exercise any of these, email info@ragusaguide.com. You also have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP, azop.hr) or your local supervisory authority.

Deleting your account

You can ask us to delete your RAGUSA account and the personal data associated with it at any time. Email info@ragusaguide.com with the subject “Delete my account” from the address on your account, or use the account-deletion option in the app where available. We will delete your account and associated personal data within 30 days, except where we are required to retain certain records (for example, purchase and accounting records) by law.

Security

We protect your data with encryption in transit (HTTPS), encrypted password storage, and access controls that limit who can reach it. No method of transmission or storage is completely secure, but we work to protect your information and to notify you and the authorities of any breach as required by law.

Children

RAGUSA is intended for people aged 13 and over and is not directed at children under 13. We do not knowingly collect personal data from children under 13; if you believe a child has provided us data, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. We will post the new version here and update the “Last updated” date; significant changes will be highlighted in the app or by email where appropriate.

Contact

Questions about privacy, or to exercise your rights? Email info@ragusaguide.com or use our contact page.