Privacy Policy

1. What we collect

When you sign up we collect your email address and an account identifier. If you subscribe to a paid plan, Stripe collects and stores your payment details — we never see your card number. We also collect the media you upload (images, videos), and we log basic usage events (page views, errors) for reliability through Google Analytics.

2. How we use it

We use your information to operate the service: authenticate you, run your tours, bill your subscription, send transactional email (welcome, receipts), and investigate technical issues. We do not use your information for advertising, and we do not sell it.

3. Who we share it with

We share data only with providers who operate the service on our behalf: Google Firebase (authentication, database, storage, hosting), Google Analytics (usage events), Stripe (billing), and Resend (transactional email). These providers are bound by their own privacy and security commitments.

4. Cookies and tracking technologies

We use cookies and similar technologies to operate and improve the service. Specifically:

• Google Analytics (GA4) — collects anonymised usage data such as page views, session duration, and device type to help us understand how the service is used.
• HubSpot — tracks visits and form submissions to manage customer relationships and deliver live-chat support.
• Meta Pixel — measures the effectiveness of advertising campaigns on Facebook and Instagram. No personal data is shared beyond hashed identifiers.
• Google Ads — measures ad conversions and enables remarketing to visitors who have interacted with the service.

You can opt out of analytics tracking at any time from your browser settings or by setting the preference in the application. Most browsers also let you block or delete cookies through their privacy settings.

5. Guest data

When a guest joins a tour via QR code, they may optionally provide their email address. This email is shared only with the tour host for follow-up communication and is subject to the host's retention period as defined by their subscription plan. Guests who do not provide an email join using an anonymous session — we do not collect their name or device identifiers.

6. Retention

Account and media data are kept as long as your account is active. When you close your account we delete your media and host record; session history and invoices are retained for legal and tax purposes.

7. Your rights

You may request a copy of your data, correction of inaccuracies, or deletion of your account at any time. Email contact@getimmersia.com.

8. California residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act and the California Privacy Rights Act give you additional rights:

• Right to know — you can request the categories and specific pieces of personal information we have collected about you.
• Right to delete — you can request that we delete your personal information, subject to certain legal exceptions.
• Right to opt out of sale — we do not sell your personal information. We do not share it for cross-context behavioural advertising.
• Right to non-discrimination — we will not deny you the service or charge different prices for exercising your privacy rights.

To exercise any of these rights, email contact@getimmersia.com. We will verify your identity and respond within 45 days.

9. European residents (GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation provides you with additional rights:

• Lawful basis — we process your data based on contractual necessity (to provide the service you signed up for), legitimate interest (analytics, security), and consent (marketing communications).
• Data access and portability — you may request a machine-readable copy of your personal data.
• Rectification and erasure — you may correct inaccurate data or request deletion.
• Restriction and objection — you may restrict or object to certain processing activities.
• Withdraw consent — where processing is based on consent, you may withdraw it at any time.

Data is stored on Google Cloud infrastructure in the United States. By using the service, your data may be transferred to and processed in the US, which may have different data protection standards than your country. We rely on Google's data processing terms and standard contractual clauses to safeguard these transfers.

To exercise your rights or file a complaint, email contact@getimmersia.com. You also have the right to lodge a complaint with your local data protection authority.

10. Security

Data is encrypted in transit (HTTPS) and at rest on Firebase and Stripe infrastructure. We follow standard access controls and audit logging.

11. Children

Immersia is not directed to children under 13 and we do not knowingly collect their information.

12. Changes

We may update this policy. Material changes are announced by email or in-app notice at least 14 days before taking effect.

13. Contact

Privacy questions: contact@getimmersia.com.

E.N.D. Entertainment Corp., 949 South Hope St, Los Angeles, CA 90015, United States.