ULocals — Privacy Policy
Effective Date: June 1, 2026
Last Updated: June 1, 2026
At ULocals, we take your privacy seriously. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use our mobile apps, websites, and services (collectively, the "Services").
By using ULocals, you consent to the practices described in this Policy. If you do not agree, please do not use the Services.
1. Information We Collect
1.1 Information You Provide Directly
Account Information: Name, email address, phone number, password, profile photo, date of birth, gender, and login credentials (including Instagram profile data if you use Sign-In with Instagram).
Travel Preferences: Dietary restrictions, budget range, interests, accommodation details, and trip duration.
Payment Information: Billing details processed by third-party payment providers. We do not store full credit card numbers.
User Content: Photos, reviews, saved places, check-ins, tour creations, and messages sent via AI chat.
Emergency Data: Information transmitted when you activate the Emergency Button, which may include your real-time location, device identifier, and timestamp.
1.2 Information Collected Automatically
Precise Location Data: GPS coordinates, location history, routes taken, and saved waypoints. This is essential for contextual recommendations, danger zone alerts, offline navigation, and the "return to hotel" feature.
Device Information: Device type, operating system (iOS/Android), unique device identifiers, IP address, language settings, and app version.
Usage Data: Features accessed, recommendations viewed, gamification progress (points/badges), time spent in app, and interaction logs.
Contextual Parameters: Local weather, time of day, day of week, and ambient data used to personalize recommendations.
Offline Data: Because ULocals is offline-first, much data is stored locally on your device and synchronized with our servers when you are online.
1.3 Information from Third Parties
Instagram (Meta): If you sign in with Instagram, we receive your public profile information (name, username, profile picture) in accordance with your Instagram privacy settings.
Payment Processors: Transaction confirmation and status.
Franchise Partners: Local curators may provide enriched content data tied to locations you visit.
Government and Safety Databases: Publicly available data on risk zones, tourist registrations (CadasTur), and local event calendars.
2. How We Use Your Information
We use your information to:
Provide contextual, two-option recommendations based on your real-time location, weather, budget, preferences, and trip context.
Enable offline functionality, including saved maps, location history, and cached recommendations.
Deliver safety features, including danger zone audio alerts, mapped risk areas, and emergency assistance routing.
Process payments for Day Passes, discounted plans, and gift cards.
Operate gamification features (points, badges, "Perfect Day" tracking, Top Ten rankings).
Facilitate user-generated content (photos, reviews, saved places).
Improve our AI assistant and recommendation algorithms.
Communicate with you about your account, promotions, and service updates.
Prevent fraud, enforce our Terms, and comply with legal obligations.
Support our franchise model by sharing aggregated, non-identifiable data with local curators to improve city-specific content.
3. Legal Basis for Processing (for EEA/UK Users)
If you are in the European Economic Area or United Kingdom, our legal bases are:
Contractual necessity: To provide the Services you requested.
Consent: For location tracking, marketing communications, and Instagram sign-in.
Legitimate interests: For fraud prevention, service improvement, and franchise operations.
Legal obligation: To comply with applicable laws and emergency requests.
You may withdraw consent at any time in your device or app settings, though this may limit functionality.
4. How We Share Your Information
We do not sell your personal information. We share data only in the following circumstances:
4.1 Service Providers
With trusted third parties who perform services on our behalf, including:
Cloud hosting (Hostinger)
Payment processing
Map and weather APIs
Analytics and crash reporting
Email and push notification delivery
4.2 Franchisees and Local Curators
We may share anonymized or aggregated location and preference data with local franchise partners to curate better content. We do not share your exact real-time location or identity with Franchisees without your consent.
4.3 Emergency and Safety Partners
If you activate the Emergency Button, we may share your precise location and relevant profile data with:
Local emergency services (e.g., police, medical responders)
Your designated emergency contacts
Local authorities, as required by law
4.4 Legal Compliance
We may disclose information if required by law, subpoena, court order, or to protect our rights, property, or safety, or that of our users or the public.
4.5 Business Transfers
In the event of a merger, acquisition, or asset sale, your information may be transferred as part of the transaction, subject to confidentiality obligations.
5. Data Retention
Account Data: Retained for as long as your account is active. You may delete your account at any time via the app settings or by contacting us.
Location History: Retained for 90 days after collection, unless you choose to save specific waypoints in your account, which are retained until deletion.
Payment Records: Retained for 7 years to comply with tax and accounting obligations.
User Content: Retained until you delete it or close your account, unless we are legally required to keep it.
Emergency Data: Retained for 1 year after the incident for safety audits and legal compliance.
Upon account deletion, we will delete or anonymize your personal data within 30 days, except where retention is required by law.
6. Data Security
We implement industry-standard security measures, including:
Encryption: TLS/SSL for data in transit; AES-256 encryption for sensitive data at rest.
Offline Security: Local data on your device is protected by your device's native security (biometrics, passcodes).
Access Controls: Strict internal access limitations and role-based permissions.
Regular Audits: Security assessments of our infrastructure and third-party providers.
No system is 100% secure. You are responsible for maintaining the security of your device and credentials.
7. Your Privacy Rights
Depending on your jurisdiction, you may have the right to:
Access the personal information we hold about you.
Correct inaccurate or incomplete data.
Delete your personal data ("right to be forgotten").
Restrict or object to certain processing activities.
Data Portability: Receive your data in a structured, machine-readable format.
Withdraw Consent: For location tracking, marketing, or Instagram integration.
To exercise these rights, contact us at [email protected]. We will respond within 30 days.
California Residents (CCPA/CPRA): You have the right to know, delete, and opt-out of the "sale" or "sharing" of personal information. ULocals does not sell personal information. To opt-out of targeted advertising or analytics sharing, adjust your app permissions or contact us.
8. Children's Privacy
ULocals is not directed at children under 13 years of age (or 16 in certain jurisdictions). We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such data, contact us immediately and we will delete it.
Teenagers between 13 and 17 must use ULocals under parental or guardian supervision, and the adult assumes responsibility for the account.
9. International Data Transfers
ULocals is headquartered in Brazil. Your data may be transferred to and processed in countries outside your residence, including Brazil and the United States (for cloud/hosting services). We ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs), to protect your data during international transfers.
10. Cookies and Tracking Technologies
Our websites (ulocals.com, ulocals.travel, help.ulocals.com) use cookies and similar technologies to:
Remember your preferences
Analyze traffic and usage patterns
Deliver targeted marketing (with your consent)
You can manage cookie preferences through your browser settings. The mobile app does not use traditional cookies but may use device identifiers for analytics.
11. Offline-First Architecture and Local Storage
Because ULocals is designed to work primarily offline, significant data (maps, recommendations, location history, safety zones) is stored locally on your device. This means:
Data may persist on your device even if deleted from our servers.
You are responsible for securing your device (passcode, biometrics).
Clearing app data or uninstalling the app will remove local storage.
12. AI and Automated Decision-Making
Our AI assistant processes your contextual data (location, weather, preferences) to generate recommendations. This involves automated decision-making that affects the content you see. You may opt-out of AI personalization in your account settings, though this will reduce the relevance of recommendations.
13. Changes to This Privacy Policy
We may update this Policy periodically. Material changes will be communicated via in-app notice or email at least 30 days before taking effect. The "Last Updated" date at the top indicates the most recent revision.
14. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or your data:
Data Controller: ULocals
Email: [email protected]
Website: https://ulocals.com
Admin Portal: https://ulocals.cloud
For data protection inquiries, please include "Privacy Request" in the subject line.