Privacy policy
Last updated October 22, 2026
1. Who is responsible
UAB NEXTVELO ("we") is the controller of your personal data on localstories.lt. Contact for privacy questions: hello@localstories.lt.
2. What we collect and why
| What | When | Why (purpose) | Legal basis |
|---|---|---|---|
| Account: email, password (stored only as a hash by our sign-in provider), name, site language | You sign up | To run your account and sign you in | Contract |
| Google sign-in: name, email, profile photo from Google | You choose "Continue with Google" | Same as above; the photo is shown as your avatar | Contract |
| News emails choice: whether you want news emails, and when you said so | Sign-up, Account settings | To send news only if you asked, and to prove it | Consent (you can withdraw anytime) |
| Purchases: what you bought, price, VAT, currency, date, Stripe payment and customer IDs, status (paid / refunded) | You buy | To give you access, send confirmations and receipts, handle refunds, keep accounts | Contract; legal obligation (accounting and tax) |
| Withdrawal consent record: the consent text version, language and time you ticked it at checkout | You buy | To prove you asked for access to start right away (14-day withdrawal right) | Legal obligation; legitimate interest |
| Access: which guides and passes you can play, and until when | After a purchase | To let you play what you bought | Contract |
| Listening progress: last stop, stops listened, started / completed | You play a guide | To let you resume on any device and show your progress; and, counted together, to show how many people have listened to a guide (a total number, shown from 50 listeners; no names) | Contract |
| Saved guides | You tap ♡ | To keep your list | Contract |
| Reviews: stars, tags, text, language, date; shown publicly as "First name L." | You post a review | To show reviews to other walkers | Contract; legitimate interest (honest reviews) |
| Notify list: email, site language, where you signed up, when you agreed and the wording you agreed to | You ask to be told when guides go on sale ("Coming soon — get notified") | To email you when guides go on sale | Consent (unsubscribe anytime with the link in the email; your address is then deleted) |
| Your location | During a walk, if you allow it | To start each story when you reach its stop and to show the way to the next one | Consent (browser permission). Used on your phone; we don't store it. If you leave the route, your current position is sent to Mapbox once to work out a new way to the next stop |
| Technical data: IP address, browser, pages requested, error logs, security cookies | Every visit | To deliver the site, keep it secure, fix errors | Legitimate interest |
| Error reports: when something breaks: the browser and device type, the page and what went wrong; we remove email addresses, sign-in tokens and other personal details before it's sent | When an error happens | To find and fix errors | Legitimate interest |
| Usage statistics (anonymous): a few events — a guide page opened, a free sample played, the payment form opened, a purchase completed (product and amount, without your name), a walk started and finished — with the browser and device type and an approximate country | Every visit | To see which guides and pages work and improve them, in total numbers | Legitimate interest. No cookies or other storage on your device, no account or name linked, no recordings; your IP address is used only to count unique visitors with a code that changes daily, and isn't stored |
| Support emails | You write to us | To answer you | Legitimate interest; contract |
We don't sell your data and don't use it for advertising profiles.
Card details are entered in Stripe's payment form and handled by Stripe. We never see or store your full card number.
3. Who we share it with
We use these service providers. They process data for us under data processing agreements, except where noted.
| Provider | What for | Data | Where |
|---|---|---|---|
| Supabase | Database, sign-in, file storage | Account, purchases, access, progress, saved guides, reviews, notify list | EU (Frankfurt, Germany) |
| Vercel | Hosting the site | Technical data (IP, requests, logs) | The site's server runs in the EU (Frankfurt); Vercel Inc. is a US company, so some technical data may be processed in the US (see transfers below) |
| Stripe | Payments, VAT calculation, managing your yearly pass, fraud prevention | Email, payment details, billing country/address, purchase | EU / US. Stripe is also an independent controller for some payment data (fraud prevention, regulatory duties) |
| Mapbox | Maps and walking directions | IP address, the area of the map you view, and your position when a new way to the next stop is worked out | US (see transfers below) |
| "Continue with Google" | What Google shares when you choose it (name, email, photo) | Google is an independent controller for your Google account | |
| Resend | Sending account, purchase and notify-list emails | Email address, email content | EU |
| Sentry | Error reports | Technical data about errors (see section 2), no account data | EU (Frankfurt, Germany) |
| PostHog | Anonymous usage statistics | The events above, browser and device type, approximate country (your IP address isn't stored) | EU |
| ElevenLabs | Generating the narration audio for our guides | None of your data: only our own scripts are sent | — |
We may also share data when the law requires it (for example tax authorities or a court order), or if the business is transferred (the new owner would be bound by this policy).
Transfers outside the EU/EEA happen only with safeguards: the EU-US Data Privacy Framework where the provider is certified, or Standard Contractual Clauses.
4. How long we keep it
| Data | How long |
|---|---|
| Account and profile | Until you delete your account; database backups are overwritten within 7 days |
| Purchases, VAT data, consent records | 10 years after the purchase (accounting rules); after you delete your account they are kept without your name |
| Access, progress, saved guides, reviews | Until you delete them or your account |
| Usage statistics | Up to 2 years (anonymous, in total numbers) |
| News emails consent record | While you're subscribed + 3 years to prove consent |
| Notify list | Until you unsubscribe, or until we've emailed you that guides are on sale (then deleted) |
| Technical logs and error reports | Up to 30 days (logs) and 90 days (error reports) at our providers |
| Support emails | 3 years |
5. Cookies and similar storage
| Name / type | Purpose | Needed? |
|---|---|---|
sb-…-auth-token (Supabase) | Keeps you signed in | Strictly necessary (no consent needed) |
| Stripe cookies (in the payment form) | Payment security and fraud prevention | Strictly necessary for paying |
Browser storage on your phone (ls:…) | Where you are in a walk, your playback speed and auto-play choice, tips you've seen, a guide you asked to save before signing in | Strictly necessary / functional |
We don't use advertising or analytics cookies. Our usage statistics (PostHog, section 2) store nothing on your device.
6. Your rights
You can ask to see, correct, delete or download your data, to restrict or object to processing, and withdraw consent at any time (for example unsubscribe from news emails). You can also delete your account yourself in Account settings. Email hello@localstories.lt; we reply within one month. Some data we must keep by law (for example purchase records for tax) even after you delete your account.
If you think we're handling your data wrongly, you can complain to the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt) or to the authority in your own EU country.
7. Children
localstories isn't aimed at children. You must be at least 14 to create an account.
8. Security
Data is encrypted in transit (HTTPS). Access to your rows in our database is limited to your own account by database rules; only our server can write purchases and access. Passwords are stored only as hashes by our sign-in provider. We review security warnings from our database provider regularly.
9. Changes
We'll update this policy when we change what we collect or which providers we use, and tell you about important changes by email or on the site.