Privacy policy

Last updated: 2026-10-04

This policy explains how Xplorout processes personal data when you use our website, mobile application, discovery tools, provider features and social features.

1. Controller and contact

The data controller is Sid A. Abdala Balal. Public disclosure wording: "XplorOut is operated by Sid Balal.", 4 Stirling Lane, Apt 506, GX11 1AA, Gibraltar. Privacy enquiries and rights requests may be sent to privacy@xplorout.com. General support is available at hello@xplorout.com.

2. Data we collect

• Account and profile: email address, display name, preferred language, account type, preferences, email-verification status and a securely hashed password. We do not store your password in readable form.
• Location and search: a city you select, search filters and foreground device coordinates when you choose to use nearby discovery or travel-time features. Xplorout does not request background location and does not create a continuous account-linked location history.
• Plans and activity: saved listings, plans, interests, searches, social invitations, group membership and the actions needed to deliver those features.
• User content and communications: provider/business submissions, listing information, uploaded images, social posts, messages, reports, blocks and communications with support.
• Device and technical data: session identifiers, push-notification token if enabled, operating system and app version, IP address and security, diagnostic and error logs.
• Commercial interaction: booking-link and referral click-outs, including the listing and partner selected. Xplorout does not receive or store payment-card details for purchases completed with third-party providers.

3. How data is obtained

We receive data directly from you, automatically from your device when you use a feature, from providers or business representatives who submit listings, and from event, activity, mapping, weather and booking sources used to supply the service. Public listing information is not treated as an endorsement or verification of the operator.

4. Purposes and legal bases

• Service delivery and account administration: to create your account, personalise discovery, save plans and provide requested features. The legal basis is performance of our contract with you.
• Location-based results: to find relevant activities and estimate travel feasibility when you activate location access. The basis is your permission and, where applicable, consent; you can withdraw device permission at any time.
• Notifications: to send alerts you request. The basis is consent, which can be withdrawn in the app or device settings.
• Safety and moderation: to investigate reports, prevent abuse, enforce our terms, protect users and preserve evidence. The basis is our legitimate interests and, where applicable, legal obligations.
• Security and reliability: to authenticate users, prevent fraud, diagnose faults and defend the service. The basis is performance of the service, legitimate interests and legal obligations.
• Referral measurement: to record partner click-outs, calculate attribution and understand service performance. The basis is our legitimate interest in operating and funding Xplorout. Where consent is legally required for a technology, we will request it.
• Legal compliance: to respond to lawful requests, establish or defend legal claims and comply with applicable law.

We do not sell personal data and do not use precise location for targeted advertising.

5. Recommendations and automated processing

Xplorout may automatically rank listings using factors such as selected city or foreground location, distance, date, time, availability, category, weather, transport mode and stated interests. These recommendations help organise options; they do not produce legal or similarly significant effects about you. You can change filters, location and preferences at any time.

6. When we share data

We share only what is reasonably necessary with contracted service providers that support hosting, databases, authentication, email delivery, push notifications, mapping, routing, weather, translation and error monitoring. When you deliberately open a third-party booking link, that provider receives your browser request and applies its own privacy policy. Other social users may see the display name, post and message information necessary for the shared feature, but not your email address or precise live GPS position.

We may disclose data when required by law, to protect users or the service, in connection with a corporate reorganisation subject to appropriate safeguards, or with your direction or consent.

7. International transfers

Some service providers may process data outside your country or the European Economic Area. Where required, we use an adequacy decision, approved contractual safeguards such as the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism. You may ask for information about applicable safeguards.

8. Retention

• Account and profile: while your account remains active and then deleted or anonymised following deletion, except where retention is legally required.
• Plans, saves, invitations and provider content: while needed for the feature or until deleted, expired or the account is deleted.
• Messages: account attribution is removed on deletion and message content may be replaced with a deletion marker where necessary to preserve conversation integrity for other participants.
• Safety reports, blocks and moderation records: for as long as reasonably necessary to protect users, prevent repeat abuse, comply with law or establish and defend legal claims.
• Referral/click-out records: 12 months Policy: - Raw identifiable clickout/referral records are retained for up to 90 days. - At the end of that period, those records should be deleted or irreversibly anonymised. - Aggregated statistics that no longer identify an individual may be retained for longer where needed for analytics and business reporting. - Records that must legally be retained for accounting, fraud prevention, dispute resolution, or affiliate-payment reconciliation may be retained for the applicable required period., then deleted or irreversibly aggregated.
• Security and diagnostic logs: only for the period reasonably necessary for security, troubleshooting and legal compliance.

Backups may retain deleted data for a limited rolling period before automatic overwrite. Data placed under a legal hold may be retained until the relevant matter ends.

9. Security

We use proportionate technical and organisational safeguards, including encrypted transport, access controls, password hashing, session controls, data minimisation, monitoring and restricted administrative access. No online service can guarantee absolute security. Contact hello@xplorout.com if you believe your account or data may be at risk.

10. Your choices and rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability or objection; withdraw consent without affecting earlier lawful processing; and complain to a supervisory authority. In Spain, this is the Agencia Española de Protección de Datos. We may need to verify your identity before acting. Contact privacy@xplorout.com.

You can change location and notification permissions in device settings, update account settings in the app, block or report users, and delete your account using the process below.

11. Account deletion

You can delete your account directly in the app or use the instructions at xplorout.com/delete-account. Deletion covers the account and associated personal data unless limited retention is necessary for security, fraud prevention, legal compliance or legal claims, as explained on that page.

12. Website storage and third-party sites

The website may use essential browser storage to remember settings such as language. Xplorout links to independent booking providers and other websites; their privacy notices apply once you leave Xplorout. We are not responsible for their data practices.

13. Age

Xplorout and its social meeting features are intended for adults aged 18 or over. We do not knowingly permit children to create accounts. Contact us if you believe a child has provided personal data.

14. Changes to this policy

We may update this policy as the service or law changes. We will publish the revised version with a new date and provide additional notice where a change materially affects your rights or how we use personal data.