Privacy Policy

1. Who We Are and How to Contact Us

1.1 Data Controller Identity

The data controller responsible for your personal data is:

CU DPK (trading as Peekabl)
Registered in the Republic of Bulgaria
Registered address: Sofia, Bulgaria
Email (including data protection enquiries): [email protected]
Website: peekabl.com

Because the controller is established in the EU, no EU representative under GDPR Article 27 is required.

1.2 Supervisory Authority

As a Bulgarian-registered entity, our lead supervisory authority for GDPR purposes is the Commission for Personal Data Protection of the Republic of Bulgaria (CPDP):

Commission for Personal Data Protection
2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
Website: cpdp.bg
Email: [email protected]

Complaints may be lodged with the CPDP, or with the supervisory authority in the complainant's country of residence, at any time.

2. What Personal Data We Collect

We only collect personal data that is necessary for the purposes described in this Policy. The categories of data we collect depend on whether you are a user, a host, or simply a visitor to our website.

2.1 Data You Provide Directly

• Account registration data: first name, last name and email address. Peekabl does not use passwords: sign-in is by a one-time code sent to the email address
• Profile data (hosts only): profile photo, short biography, and country and city. Other users do not have a profile photo, biography or location
• Payment data: payment details, such as card details and billing information, are entered with and held by our third-party payment and payout providers under PCI DSS standards. Peekabl keeps only transaction records: amounts, dates, payment status and references to the provider's records
• Communications: support requests submitted in the app and emails sent to Peekabl
• Reviews and ratings: content you post as reviews or ratings of hosts or experiences
• Preferences: tours you mark as favourites and the interest categories you choose
• Chat messages: messages sent during live experience sessions. These are handled by our live video and chat service provider and are not stored in Peekabl's own systems. Your name is shown next to messages you send
• Host application data (hosts only): experience descriptions, profile content and an optional tourist guide licence number. Identity verification and payout details are provided directly to our payment and payout providers and are not stored by Peekabl
• Live session content (hosts only): video and audio streamed during a live experience, handled by our live video service provider. The mobile app asks for camera and microphone access for this

2.2 Data Collected Automatically

• Device and technical data: IP address, device type, operating system, browser type and version, and a short device description saved with your sign-in session. Screen resolution may also be collected by analytics tools, where you have allowed them
• Usage data: pages visited, features used, experiences viewed or joined, session duration, clicks, and navigation paths
• Log data: server logs including timestamps, errors, and access records
• Account records: your marketing choice and the version and date of the Terms and this Policy you accepted; for hosts, the acceptance of the host agreement, including the IP address and browser details used
• Push notification token: if you use the mobile app and allow notifications, an identifier used to send them
• Streaming session metadata: session start, end and join times, and session identifiers. Connection quality data is held by our live video provider
• Live session recordings: live sessions may be recorded by our live video service provider, as described in Section 4.4
• Cookie and tracking data: as described in our Cookie Policy

2.3 Data We Receive From Third Parties

• Payment provider: confirmation of transactions, payment and refund status, and the status of host payout accounts
• Analytics and advertising partners: information about how you reached Peekabl and how you use it, and reports on the performance of our campaigns

2.4 Data We Do Not Collect

Peekabl does not collect:

• Biometric or facial recognition data
• Government-issued ID data from users (hosts may be asked for identity verification during onboarding - this is handled by our payment provider and is not stored by Peekabl directly)
• Sensitive special category data under GDPR Article 9 (racial origin, health data, political opinions, etc.). Peekabl does not ask for this information. If it is volunteered in a free-text field such as a bio or chat, it is processed only as needed to provide the service and is not used for any other purpose

3. Why We Process Your Data - Lawful Basis

The GDPR requires a lawful basis for every type of data processing. This section sets out why each category of data is processed and the legal basis relied on. Personal data is not processed for any purpose not listed in this Policy.

3.1 To Provide the Platform and Perform Our Contract With You

Lawful basis: Contract (GDPR Article 6(1)(b))

We process the following data because it is necessary to deliver the service you signed up for:

• Account and profile data - to create and manage your account
• Payment data - to process purchases and manage subscriptions
• Usage data - to deliver experiences, track Stamps (the credits used to book live sessions), and manage your account activity
• Host data - to onboard, verify, and pay hosts
• Session metadata - to connect users and hosts and ensure technical delivery of experiences

3.2 To Comply With Legal Obligations

Lawful basis: Legal obligation (GDPR Article 6(1)(c))

• Financial transaction records - required for tax and accounting compliance
• Data breach notifications - required under GDPR Article 33
• Responding to valid legal requests from courts or regulatory authorities

3.3 For Our Legitimate Interests

Lawful basis: Legitimate interests (GDPR Article 6(1)(f))

We rely on legitimate interests only where our interests are not overridden by your rights and freedoms. These purposes include:

• Platform security and fraud prevention - detecting, investigating, and preventing abuse, fraud, and security incidents
• Live session recordings for quality and dispute resolution - reviewing recordings held by our live video service provider to assess service quality, investigate disputes between users and hosts, and support safety and fraud investigations, as described in Section 4.4
• Platform improvement - analysing aggregated usage data to improve features, performance, and user experience
• Trust and safety - investigating reports of conduct violations and enforcing our Community Guidelines
• Business communications - sending important operational notices about the Platform, your account, or changes to our policies
• Legal defence - maintaining records that may be needed to defend legal claims

3.4 With Your Consent

Lawful basis: Consent (GDPR Article 6(1)(a))

We rely on your consent for:

• Marketing communications - sending promotional emails, newsletters, or notifications about new features and experiences. You can withdraw consent at any time by clicking unsubscribe in any email or by contacting us (see Section 1.1)
• Non-essential cookies and similar technologies - analytics, marketing and website session recordings (recordings of how you use our pages, which are separate from the recordings of live experiences in Section 4.4) - as described in our Cookie Policy. Whether this requires your opt-in consent or is subject to your right to opt out depends on your location (see Section 9.3). Session recordings always require your opt-in consent. You can manage your preferences at any time via our cookie settings tool
• Any use of live session recordings beyond the quality, safety, and dispute-resolution purposes described in Section 4.4 - for example, any promotional or marketing use - would require your separate, explicit consent

4. How We Use Your Data - Specific Purposes

4.1 Account Management

We use your registration data to create and maintain your account, authenticate you at login by a one-time code sent to your email address, and communicate with you about your account.

4.2 Delivering Experiences

We use session metadata, usage data, and account data to match users with available experiences, facilitate connections between users and hosts, deliver the streaming infrastructure, process Stamps and payments, and provide booking confirmations and access to your booking history and billing records.

4.3 Payments and Financial Processing

We share necessary billing data with our payment and payout providers to process your payments and payouts. We retain transaction records for accounting and legal compliance purposes. We do not use your payment data for any marketing or profiling purpose.

4.4 Safety, Trust, and Moderation

We use account data, usage data, and reported content to investigate complaints and reports of conduct violations, enforce our Community Guidelines and Terms & Conditions, detect and prevent fraud and abuse, and - where required by law - report illegal content to the relevant authorities.

Chat during live sessions is provided by our live video and chat service provider, and moderation tools offered by that provider may be used. Peekabl may also review chat messages and other user-generated content, in particular in response to reports. This is done for the purposes of safety, fraud prevention, illegal content detection, and enforcement of our Community Guidelines.

We do not use chat content for commercial profiling or marketing purposes. Where we identify content that may be illegal - including content involving the exploitation of minors - we will take immediate action and report it to the relevant authorities.

Host accounts are reviewed and activated by our team before a host can create experiences. Images and other visual content that hosts upload as part of their profile or experience listings may be reviewed, including in response to reports, to detect policy violations. This is done to protect the safety and integrity of our community.

Recording of live sessions. Live experience sessions may be recorded by our live video service provider. Peekabl does not store these recordings on its own systems. They are held by the provider for a short period (see Section 7.5).

The recordings are available to Peekabl for quality assurance, safety, and the resolution of disputes between users and hosts (for example, refund requests or conduct complaints). They are accessed only by authorised personnel on a need-to-know basis. They are not used for marketing, advertising, or profiling. They are not disclosed to anyone other than the provider that holds them, except where we are legally required to do so.

The provider deletes recordings automatically after the period in Section 7.5, unless a specific recording is required for an ongoing dispute, safety investigation, or legal proceeding. In that case it is retained only until the matter is resolved. We rely on our legitimate interests (Section 3.3) as the lawful basis for this processing, having assessed that these interests are not overridden by your rights and freedoms.

4.5 Platform Improvement and Analytics

We use aggregated and, where necessary, pseudonymised usage data to understand how users interact with the Platform, identify technical issues, and improve features and performance. We use analytics tools provided by third parties to do this (see Section 5.1). Our Cookie Policy explains how to control them.

4.6 Marketing and Communications

With your consent, we may send you information about new experiences, hosts, features, and promotions. You can unsubscribe at any time. Messages about bookings and the account cannot be unsubscribed from. Push notifications can be turned off in your device settings.

We also measure the performance of our own marketing. Where you have given the relevant consent (in regions that require it) or have not opted out (in regions that operate on an opt-out basis - see Section 9.3), we use analytics and advertising measurement tools from third parties. They help us understand which campaigns and links bring visitors to Peekabl, attribute sign-ups to specific campaigns, and show Peekabl advertisements to people who have previously visited our Platform (retargeting).

These tools can receive information about your activity on the Platform, as described in Section 5.1. Section 5 and Section 8.2 explain how this is treated under US state privacy laws, and Section 9.3 explains how to opt out. Full details of these tools and how to control them are set out in our Cookie Policy.

4.7 Viewing Activity

Peekabl is a live video platform. We use information about the tours and live sessions you view, join, book and rate to run the Platform: to give you access, handle bookings and payments, show your history and Stamps, respond to support requests, and keep the Platform safe. We also use it, in aggregated or pseudonymised form, to improve the Platform.

Some of our analytics and advertising tools can receive information about the tours and live sessions you view, join, book or rate, as described in Section 5.1. We do not send these tools the video or audio of live sessions. You can control these tools as described in Section 9.

4.8 Personalisation

Peekabl does not currently use artificial intelligence or automated personalisation to make recommendations or decisions based on personal data. If this changes, this Policy will be updated before the feature is activated and, where required by law, consent will be sought.

4.9 Location Data

Peekabl does not currently collect precise geolocation data from your device. We derive your approximate location (country) from your IP address to apply the correct regional consent model (see Section 9.3). If this changes, consent will be requested through the device's standard permission system and this Policy will be updated first.

5. Who We Share Your Data With

We do not sell your personal information in exchange for money. We share data with third parties only where necessary to operate the Platform, measure and promote our services, comply with the law, or protect our legitimate interests.

5.1 Service Providers and Partners

We use carefully selected third-party companies to help us run Peekabl. They fall into two groups.

Service providers. These companies process information on our behalf and under our instructions to provide services to us. Our current categories are:

• Payment processing and payouts
• Live video, streaming and in-session chat
• Cloud hosting, storage and security
• Email and messaging, including transactional and marketing email and our internal business communications

They are bound by agreements, including data processing agreements where the law requires them, and may use your information only to provide their services to us, which can include maintaining and improving those services.

Analytics and advertising partners. We use tools from third-party analytics and advertising providers. They help us understand how Peekabl is used, measure our own marketing, and show Peekabl advertisements to people who have visited us.

Depending on your location and your choices (see Section 9.3), these partners can receive information about your activity on the Platform. This includes the pages you visit, your searches, the tours and live sessions you view, join, book or rate, and the steps you take to sign up and pay. It also includes online identifiers such as cookie IDs, device and browser details, your IP address and, when you are signed in, an account identifier.

If you opt in to website session recordings, a recording provider also receives information about how you use our pages. Some of these partners also use the information under their own terms and privacy policies. Our Cookie Policy lists the tools and how to control them.

Because these partners may use the information for their own purposes, US state privacy laws may treat this as "sharing", a "sale" or "targeted advertising", even though we receive no money for it. Sections 8.2 and 9.3 explain your choices.

5.2 Other Users and Hosts

Chat messages sent during a live session are visible to the host and the other participants, and are shown with the sender's name as it appears on the account (first and last name). Users who are not signed in appear as "Guest". Other information, such as email address, payment details and account history, is not shown to other users or hosts. Hosts' profile information, such as a short biography, is shown on their tours and profile pages.

5.3 Legal and Regulatory Disclosure

We may disclose your personal data to law enforcement agencies, courts, regulators, or other public authorities where we are legally required to do so, or where disclosure is necessary to protect the safety of any person, prevent fraud, or defend Peekabl's legal rights.

5.4 Business Transfers

If Peekabl is involved in a merger, acquisition, asset sale, or similar transaction, your personal data may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.

5.5 What We Do Not Do

• We do not share your payment card details, identity documents or recordings of live sessions with advertisers or marketing partners

6. International Data Transfers

Peekabl is registered in Bulgaria and operates within the EU. Some of our third-party service providers are located outside the EU/EEA, including in the United States. Where personal data is transferred outside the EU/EEA, we ensure that appropriate safeguards are in place as required by GDPR Chapter V.

Personal data is held primarily in the EU. To improve loading speed, the Platform is served from servers in both the EU and the United States, and a read-only copy of our database is held on infrastructure located in the United States. Some of our service providers are also located in the United States.

The safeguards we rely on include:

• Standard Contractual Clauses (SCCs) approved by the European Commission - used in our agreements with US-based service providers
• Adequacy decisions - where the European Commission has determined that a country offers an adequate level of data protection

You may request a copy of the relevant transfer safeguards we have in place by contacting us (see Section 1.1).

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our retention approach by data category is:

7.1 Active Account Data

Data associated with your active account is retained for as long as your account remains open. Accounts can be closed as described in our Terms & Conditions.

7.2 Financial and Transaction Records

Transaction and payment records are retained for a minimum of 5 years from the date of the transaction in accordance with Bulgarian and EU financial record-keeping requirements.

7.3 Account Closure

When an account is closed, it is deactivated. The account holder can no longer sign in and the account no longer appears on the Platform.

Personal data is kept after closure where the law requires it (for example, financial records, see Section 7.2), where it is needed for safety records or to defend a legal claim (see Section 7.4), and otherwise until deletion or anonymisation is requested. Deletion or anonymisation may be requested at any time (see Section 8.4) and is handled as a data rights request under Section 8.

Please note that due to the way secure backup systems operate, residual copies of your data may persist in encrypted backup storage for a limited additional period before they are purged in the normal cycle. These copies are not accessible to our operational systems and are handled with the same security standards as live data.

7.4 Moderation and Safety Records

Records relating to conduct violations, safety investigations, or legal disputes may be retained for up to 3 years after the matter is resolved, to enable us to identify repeat violations and respond to any related legal proceedings.

7.5 Live Session Recordings

Recordings of live experience sessions are held by our live video service provider for 14 days, after which they are automatically deleted. Where a specific recording is required for an ongoing dispute, safety investigation, or legal claim, it is retained only for as long as necessary to resolve that matter, after which it is deleted.

7.6 Marketing Data

If you have consented to marketing communications, we retain your contact details for this purpose until you withdraw consent. After withdrawal, we retain a suppression record to ensure we do not re-contact you.

7.7 Public Content After Account Closure

After an account is closed, its profile and ratings are no longer shown on the Platform. The underlying records are kept as described in this Section.

7.8 Analytics and Website Session Recordings

Cookie lifetimes are set out in our Cookie Policy, Section 3. We keep analytics data and website session recordings only as long as needed for the purposes described in this Policy.

8. Your Rights as a Data Subject

This section sets out the rights available to individuals under applicable law and how they may be exercised. Valid requests are answered within 30 days (45 days for California residents under the CCPA).

8.1 Rights Under GDPR (EU/EEA Users)

Individuals located in the EU or EEA have the following rights under the GDPR:

Right of Access (Article 15)
Individuals may obtain confirmation of whether Peekabl processes personal data about them and, if so, a copy of that data together with information about how it is used. This is provided free of charge.

Right to Rectification (Article 16)
Inaccurate personal data is corrected, and incomplete data completed, without undue delay on request. Hosts can update their country, city, biography and profile picture in their profile. Other details, such as name and email address, can be corrected by contacting us.

Right to Erasure - Right to be Forgotten (Article 17)
Deletion of personal data may be requested where it is no longer necessary for the purpose for which it was collected, where consent is withdrawn, or where the individual objects to processing based on legitimate interests. This right is subject to legal retention obligations; for example, financial records that the law requires Peekabl to keep cannot be deleted.

Right to Restriction of Processing (Article 18)
Restriction of processing may be requested in certain circumstances, for example where the accuracy of the data is contested while it is verified.

Right to Data Portability (Article 20)
Where processing is based on consent or contract and carried out by automated means, personal data may be received in a structured, commonly used, machine-readable format and transmitted to another controller.

Right to Object (Article 21)
Individuals may object to processing based on legitimate interests or for direct marketing purposes. Where an individual objects to direct marketing, processing for that purpose stops immediately. Where an individual objects to other legitimate-interest processing, it stops unless Peekabl demonstrates compelling legitimate grounds that override the individual's interests.

Right to Withdraw Consent
Where processing is based on consent, consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Right Not to Be Subject to Automated Decision-Making (Article 22)
Individuals may have a right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. See Section 13.

Right to Lodge a Complaint
Complaints may be lodged with the Bulgarian CPDP or with the supervisory authority in the individual's country of residence at any time. Contact details for the CPDP are in Section 1.2.

8.2 Rights Under CCPA/CPRA (California Residents)

California residents have the following additional rights:

• Right to Know: details of the personal information collected, used, disclosed and sold or shared may be requested
• Right to Delete: deletion of the personal information held may be requested, subject to certain exceptions
• Right to Correct: correction of inaccurate personal information may be requested
• Right to Opt Out of Sale, Sharing and Targeted Advertising: personal information is not sold in exchange for money, but the use of analytics and advertising tools (Section 5.1) may be considered "sharing", a "sale" or "targeted advertising" under California and other US state laws. A visitor may opt out at any time through the "Your Privacy Choices" link in the Platform footer. This choice is available to every visitor in the United States, not only California residents
• Right to Limit Use of Sensitive Personal Information: the use of sensitive personal information may be limited to what is necessary for the service
• Right of Non-Discrimination: no one is treated differently for exercising any of these rights

To exercise California rights, see Section 8.4. We will respond within 45 days of a verified request, as required by California law.

8.3 Rights for Other US State Residents

Residents of Virginia, Colorado, Connecticut, Texas, and other states with applicable privacy laws have similar rights to those described in Section 8.2. Notice of Peekabl's data practices is provided in this Policy. Visitors may opt out of targeted advertising, sale and any sharing at any time through the 'Your Privacy Choices' link and the cookie settings tool in the Platform footer. These rights are honoured regardless of whether Peekabl has reached the technical threshold for mandatory compliance in a given state.

Requests are made as described in Section 8.4 and may be made through an authorised agent with the individual's written permission. Where a request is declined, the individual may ask for reconsideration and may also contact the state attorney general.

8.4 How to Submit a Request

Requests are made by email to [email protected] with the subject line "Data Rights Request" and should include the requester's name, the email address associated with the account, and a description of the right to be exercised. Identity may need to be verified before a request is processed. No fee is charged for exercising these rights unless requests are manifestly unfounded or excessive.

9. Cookies and Tracking Technologies

Peekabl uses cookies and similar tracking technologies to operate the Platform, remember your preferences, analyse usage, and support marketing activities. Our full Cookie Policy sets out in detail what cookies we use, why, and how you can manage your preferences.

9.1 Categories of Cookies We Use

• Essential cookies: required for the Platform to function - for example, cookies that keep you signed in (up to 30 days) and the cookie that remembers your consent choices. These cannot be disabled.
• Analytics cookies: help us understand how the Platform is used. Whether we deploy these only after opt-in consent, or subject to your right to opt out, depends on your location (see Section 9.3).
• Marketing cookies: measure our own marketing campaigns and support retargeting. Whether we deploy these only after opt-in consent, or subject to your right to opt out, depends on your location (see Section 9.3).
• Website session recordings: record how you use our pages so we can improve them. These are off by default in every region, including the United States, and need your opt-in consent.

9.2 Managing Your Cookie Preferences

Where opt-in applies, you will be presented with a cookie banner the first time you visit the Platform. It lets you reject all, accept all, or choose analytics, marketing and website session recordings separately.

In the United States and Australia no banner is shown (see Section 9.3). Preferences can be updated at any time through the "Cookie settings" link in the Platform footer. Note that disabling certain cookies may affect Platform functionality. Peekabl does not currently respond to browser "Do Not Track" signals.

9.3 How We Handle Consent by Region

The consent model we apply depends on where you are located, reflecting the different requirements of applicable law:

• Opt-in (the EU, EEA, UK, Switzerland and everywhere else except the United States and Australia) - non-essential cookies and similar technologies (analytics, marketing and website session recordings) are off by default and are activated only after you give explicit opt-in consent through our cookie banner. Our legal basis is your consent (GDPR Article 6(1)(a) and the ePrivacy rules; for Switzerland, the revised Federal Act on Data Protection and Article 45c of the Telecommunications Act). You can withdraw consent at any time.
• United States and Australia - we give notice and operate on an opt-out model. Analytics and marketing tools operate by default, and you can opt out of analytics, marketing and any sale or sharing for advertising at any time using the "Cookie settings" link in our Platform footer (visitors in the United States also see it as "Your Privacy Choices"). Website session recordings are off by default.
• Unknown location - if we cannot tell where you are, we treat you as opt-in.

9.4 Notice at Collection (United States)

Where cookies and similar technologies run by default in the United States, they collect the following: online identifiers (cookie IDs and, when you are signed in, an account identifier); internet activity on Peekabl (pages visited, clicks and scrolling, and the tours and live sessions you view, join, book or rate); and your approximate location (country).

We use this to understand how Peekabl is used and to measure and promote our own services. We do not sell personal information in exchange for money. This use may be considered a "sale", "sharing" or "targeted advertising", and you can opt out with the "Your Privacy Choices" link in the footer. Cookie lifetimes are listed in our Cookie Policy, and how long we keep the data is described in Section 7.8.

Under US state privacy laws, the categories of personal information we collect, as described in Section 2, include identifiers, customer records, commercial information, internet and device activity, approximate location, and audio and video recordings of live sessions (held by our service provider). We use them for the purposes in Sections 3 and 4 and disclose them to the recipients in Section 5.

Your account sign-in details and your payment details are treated as sensitive information under some of these laws. We use them only to provide and secure the Platform. We do not knowingly sell or share the personal information of anyone under 16.

10. Data Security

Peekabl takes the security of your personal data seriously. We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction, or disclosure. These measures include:

• Encryption of data in transit using TLS and at rest using industry-standard encryption
• Access controls, including network restrictions, so that personal data is accessible only to authorised personnel on a need-to-know basis
• Regular security reviews and testing of our systems

10.1 Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Bulgarian CPDP within 72 hours of becoming aware of the breach, as required by GDPR Article 33. Where the breach is likely to result in a high risk to you personally, we will also notify you directly without undue delay, as required by GDPR Article 34.

10.2 Your Role in Security

Account holders also play a role in keeping their data secure. Because sign-in is by a one-time code sent to an email address, anyone with access to that address can sign in to the account. Users should keep access to the email address used for sign-in secure, should not share one-time sign-in codes, and should notify Peekabl immediately (see Section 1.1) if they suspect unauthorised access to their account.

11. Children's Privacy

Peekabl accounts are for adults. You must be at least 18 years old to register, and you confirm this when you sign up. Our Terms & Conditions require every account holder to be at least 18 years of age. We do not knowingly collect personal data from anyone under 18.

A child may watch a live tour with the consent of a parent or guardian, under that adult's account. A parent or guardian who allows a child to watch under their account consents, on the child's behalf, to the processing described in this Policy for that viewing. We do not ask for the child's details, and we treat activity on the account as the account holder's.

If we become aware that we hold personal data from someone under 18, we will delete it promptly. If you believe a minor has created an account on Peekabl, please notify us (see Section 1.1) and we will investigate and take appropriate action.

12. Third-Party Links and Services

The Platform may contain links to third-party websites, services, or content. This Privacy Policy applies only to Peekabl's own processing of your data. We are not responsible for the privacy practices of third-party websites or services. We encourage you to review the privacy policy of any third-party service you access through or alongside the Platform. Hosts can copy or share links to their tours on social platforms; sharing takes place on those platforms under their own terms.

13. Automated Decision-Making and Profiling

Peekabl may in future use AI-driven personalisation to recommend experiences to users based on their preferences and activity on the Platform. This processing involves automated analysis of your usage data and stated preferences.

This personalisation does not constitute automated decision-making that produces legal or similarly significant effects in the sense of GDPR Article 22. It is a recommendation tool only - you are never required to follow recommendations and Peekabl does not take decisions with legal or similarly significant effects solely by automated means, other than restrictions applied after checks by our payment provider, such as restricting payouts.

If we introduce any automated decision-making that does produce significant effects - for example, automated account suspension decisions - we will update this Policy and ensure you have the right to human review, as required by GDPR Article 22.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, our data practices, or the Platform. When we make changes, we will:

• Post the updated Policy on the Platform with a revised "Last Updated" date. Changes take effect when posted, unless stated otherwise
• Where a change materially and adversely affects your rights - for example, a new use of your data that reduces your existing protections - we will give you advance notice by email or in-Platform notification before that specific change takes effect, and, where the law requires it, obtain your fresh consent before relying on it
• If we change this Privacy Policy in a way that reduces protection for personal data collected earlier, we will not apply the change to that data without your consent

Corrections, clarifications, new optional features that require your consent, and other changes that do not adversely affect your rights take effect when posted. We encourage you to review this Policy periodically. Continued use of the Platform after a revised Policy takes effect constitutes your acceptance of the updated terms, except where applicable law requires us to obtain fresh consent.

15. Contact Us

Questions about this Privacy Policy, requests to exercise data rights, and concerns about the handling of personal data may be sent to the data protection contact in Section 1.1 ([email protected]). General support: [email protected].

We aim to respond to all privacy-related enquiries within 5 business days and to all formal data rights requests within 30 days (45 days for California residents).

Complaints that are not resolved to the complainant's satisfaction may be escalated to the Bulgarian Commission for Personal Data Protection (cpdp.bg) or to the supervisory authority in the complainant's country of residence.