PRIVACY POLICY

LAST UPDATED 6 OCTOBER 2026

01WHO WE ARE

Tezeta is a city discovery app operated by Tezeta Ltd, a private limited company registered in England and Wales (company number 17493999). Its registered office is 5th Floor, 167-169 Great Portland Street, London, W1W 5PF. In this policy, "we", "us" and "our" mean Tezeta Ltd, and "Tezeta" means the website and app it operates.

Tezeta Ltd is the controller of all personal data collected through the Tezeta website and app, for the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018). That means Tezeta Ltd decides why and how your data is used, and is the organisation responsible for it. The service providers that store or handle your data for us, described in section 6, do so only on Tezeta Ltd's instructions.

For anything to do with your data, contact Tezeta Ltd at hello@tezeta.co.uk.

02WHAT WE COLLECT

We only collect what the app needs to work. Depending on how you use Tezeta, that is:

• Account details - your email address and password. Your password is stored by our authentication provider in hashed form; we never see it. If you joined from the waitlist we also keep your invite code and who referred you.
• Profile - your name, username, phone number, and optionally a profile photo.
• Date of birth - to confirm you are 18 or over. We derive a broad age bracket from it (for example 25-34), which is used to tune recommendations. Your date of birth is never shown to anyone.
• Taste and preferences - budget, vibe and pace settings, how far you will travel, music genres and artists, places you love, and any "like / not for me" answers you give while training your feed.
• Location - only if you allow it. Your device location is used to show nearby places and travel distances. We store the area you last searched from (a place name and map coordinates) so your feed opens in the right place.
• What you do in the app - ratings and reviews, saved places, lists, plans, favourites, likes, offers you redeem, and which places and events were shown to you and how you responded. We also record when you were last active.
• Friends and contacts - your friend connections. If you choose to import your contacts, the email addresses are sent to our server once to check who is already on Tezeta, and are not stored. We then keep a one-way scrambled code (a "hash") of each contact's email address and phone number, and of your own, so we can suggest friends when someone you know joins later. See section 5.
• Safety records - reports you make or that are made about your content, and people you have blocked.
• Notifications - if you turn on notifications, a technical address your device provides so we can send them.
• Messages - anything you send us by email, and editorial submissions you send in the app.
• Technical data - your IP address and basic device and browser information, handled by our hosting providers in order to deliver the app to you.

We do not use advertising trackers or third-party analytics, and we do not build profiles of you for anyone else.

03HOW WE USE IT, AND WHY WE ARE ALLOWED TO

UK data protection law requires a lawful basis for each use of your data. Ours are:

• To provide Tezeta (your account, profile, feed, friends, lists and plans) - necessary to perform our contract with you, which is our Terms of Use.
• To personalise your feed from your taste, activity, friends' ratings and age bracket - necessary for the contract, because a personalised feed is the service.
• To suggest friends from imported contacts and waitlist referrals - our legitimate interest in helping you find people you know, balanced by only storing hashed contact details and only when you choose to import.
• To keep people safe - reviewing reports, removing content, suspending accounts and enforcing blocks. This is our legitimate interest and, where the law requires it, a legal obligation.
• To confirm you are 18 or over - our legitimate interest in keeping the service adults-only.
• Device location and notifications - your consent, given through your device's permission prompt. You can withdraw it at any time in your device settings or in Preferences.
• To stop offers being claimed more than once - checking, in the iPhone app, whether an offer was already redeemed on your phone by another account. Our legitimate interest in keeping offers fair for venues, using only offer and account identifiers.
• To improve our recommendations - our legitimate interest in making the ranking better, using activity across the app in aggregate.
• To contact you about your account (sign-in links, password resets, important changes) - necessary for the contract.

What you have to give us. To have an account you must provide an email address, password, name, username, phone number and date of birth; without them we cannot create or run your account. Everything else - a photo, your location, your contacts, notifications, taste settings - is optional, and Tezeta works without it, though recommendations will be less personal.

Automated recommendations. Your feed is ordered automatically, using your taste settings, your activity, your friends' ratings and your age bracket to predict which places you are likely to enjoy. This is a form of profiling, but it only decides which places you are shown and in what order. We do not make decisions about you by automated means that have legal or similarly significant effects.

04WHAT OTHER PEOPLE CAN SEE

• Any signed-in Tezeta user can see your name, username and profile photo, and can find you by searching for them.
• Your friends can also see your saved places, ratings, reviews, lists and plans, and your activity in their friends feed.
• Your written reviews appear to your friends alongside the place you reviewed. Short phrases from reviews may be shown to other users as unattributed "what people say" highlights.
• People in a plan with you can see each other and the plan. Anyone you send a plan's share link to can view that plan without an account.
• If you submit a plan to the editorial section and we publish it, it is shown to everyone with credit to you.
• If you block someone, neither of you can see the other's profile, reviews or lists.

05CONTACTS AND PEOPLE WHO ARE NOT ON TEZETA

Importing contacts is optional. When you do, we check the email addresses against existing accounts and then discard them. What we keep is a SHA-256 hash of each email address and phone number - a fixed-length code made from the original that cannot be turned back into it directly. When somebody later joins with a matching email or phone number, we can suggest you to each other.

Hashing protects contact details, but it is not complete anonymisation: someone who already knew a phone number could check whether its hash is present. For that reason we treat these hashes as personal data, store them only against your account, never show them to anyone, and delete them when you delete your account.

If you are not on Tezeta and want any hash of your details removed, email hello@tezeta.co.uk with the email address or phone number concerned.

06WHO WE SHARE DATA WITH

We do not sell your personal data. We may share aggregated statistics that cannot identify you - for example, how many people saved a venue this month - including with venues.

To run Tezeta we rely on a small number of specialist service providers. Tezeta Ltd remains the controller of your data throughout.

Providers that handle data for us. These act as our processors: they handle your data only on our instructions, under a written contract, and only to provide their service to us. They are not allowed to use it for their own purposes.

• Database, sign-in and file storage provider - a cloud platform that stores your account and everything you add to Tezeta (profile, photo, ratings, reviews, lists, plans, friends, preferences and safety records), checks your password when you sign in, and runs the server-side code behind features such as friend suggestions and account deletion. This data is held in a data centre in London, UK.
• Website hosting and content delivery provider - a network that delivers the Tezeta website and venue photos to your device. To do that it processes your IP address and basic browser and device information, and keeps short-lived technical logs for security and reliability.
• Mapping provider - draws the maps in the app. Your device requests map images from it directly, so it receives your IP address and the area of the map you are viewing. It is not sent your name, email address or account details.
• Email delivery - sign-in links and password emails are sent by an email delivery service acting for us, which receives your email address and the content of the message.

Services your device or our servers connect to. A few parts of the app rely on outside services that receive a limited amount of technical data and handle it under their own privacy terms. None of them is sent your name, email address or anything from your Tezeta profile.

• Place information and font services - supply venue details and photos where we do not hold our own copy, and the typefaces the app is displayed in. These are loaded by your device, so the service receives your IP address and basic browser information.
• Public transport journey planner - calculates travel times between the places in a plan or list. We send it only the start and end points of the journey.
• Push notification services - if you turn on notifications, each one is delivered through the notification service run by the maker of your phone or browser. It receives the technical address of your device and the content of the notification.

We only use providers that protect your data to at least the standard set out in this policy and required by UK data protection law. We do not share your data with advertisers, data brokers or analytics companies.

If you would like to know the names of the specific providers we currently use, email hello@tezeta.co.uk and we will tell you.

Event listings are supplied to us by third-party ticketing and listings services. This is one-way: we receive listings from them and send them nothing about you.

We may also disclose data where the law requires it, to protect someone's safety, or to a buyer or successor if Tezeta Ltd or the Tezeta service is ever sold or reorganised - in which case this policy would continue to apply to your data.

07DATA OUTSIDE THE UK

Your account and app data are stored in the UK. Some of the providers above are based in, or use infrastructure in, the United States and other countries. Where personal data leaves the UK, we rely on the protections UK law requires: an adequacy decision (including the UK-US Data Bridge where the provider is certified under it) or the UK International Data Transfer Addendum to the provider's standard contractual clauses.

You can ask for a copy of the safeguards that apply to a particular transfer by emailing hello@tezeta.co.uk.

08HOW LONG WE KEEP IT

• While your account is open, we keep your data for as long as you use Tezeta.
• When you delete your account (Profile, Preferences, Delete account), your profile, photo, saves, lists, friendships, contact hashes, music and taste data, notifications and activity records are deleted immediately.
• Your ratings and reviews stay on Tezeta but are detached from you and shown as "Deleted user", because other people's feeds rely on them. The same applies to any editorial submission. If you want your reviews removed as well, delete them before deleting your account, or email us.
• Plans that other people are still in are kept for them, with ownership passing to another member. Plans left with no members are deleted.
• Deleted data can remain in encrypted backups for up to 7 days before being overwritten.
• Reports about content or behaviour are kept for up to two years after they are resolved, so we can deal with repeat abuse.
• If you joined the waitlist but never created an account, we keep your email until launch and for up to 12 months after, unless you ask us to delete it sooner.

09YOUR RIGHTS

Under UK data protection law you have the right to:

• get a copy of your personal data;
• have inaccurate data corrected - most of it you can edit yourself in the app;
• have your data deleted - you can delete your account yourself at any time;
• object to, or ask us to restrict, how we use it;
• receive the data you gave us in a portable format;
• withdraw consent at any time, where we rely on consent.

To use any of these rights, contact Tezeta Ltd at hello@tezeta.co.uk. We will respond within one month, and we do not charge for this. We may need to confirm your identity first.

If you are unhappy with how we handle your data, you have the right to complain to us. Email hello@tezeta.co.uk and say it is a data protection complaint. We will acknowledge it within 30 days, look into it without undue delay, and tell you the outcome. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

10AGE LIMIT

Tezeta is for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe someone under 18 has an account, email hello@tezeta.co.uk and we will delete it.

11SECURITY

All connections to Tezeta are encrypted. Access to each person's data is enforced by the database itself, not just by the app, so one user cannot read another's private information. Passwords are never stored in readable form. No system is perfectly secure, but if a breach ever puts your data at risk we will tell you and the ICO as the law requires.

12COOKIES AND STORAGE ON YOUR DEVICE

Tezeta does not use advertising or analytics cookies. The app stores a small amount of information in your browser or device - mainly your sign-in session and a few display preferences, such as recently viewed items - which is strictly necessary for the app to work, so no cookie banner is needed. Clearing your browser storage signs you out.

In the iPhone app we also keep a record, in your phone's secure storage (the iOS Keychain), of which offers have been redeemed on that phone and by which Tezeta account. It contains only offer and account identifiers, stays on the phone, and is used for one thing: stopping the same offer being claimed twice on one phone from different accounts. It is created only when you redeem an offer, and it is not deleted when you sign out, so that the check still works for the next account.

13CHANGES TO THIS POLICY

If we change this policy we will update the date at the top. If a change significantly affects how your data is used, we will tell you in the app or by email before it takes effect, and where the law requires your consent we will ask for it rather than assume it.