Privacy policy

Who runs WalkTortoise

WalkTortoise is a business based in Canada. In this policy, we, us and WalkTortoise mean that business.

We decide why and how your personal data is used, which makes us responsible for it under Canadian privacy law, and its controller under laws such as the UK GDPR and the EU GDPR.

You can contact us about privacy at any time through walktortoise.com/contact.

What we collect

Depending on how you use WalkTortoise, we collect:

• Account details: your email address and password. Your password goes straight from your browser to our sign-in provider, Supabase, which stores it in hashed form. It never reaches our own servers.
• Google sign-in details: if you sign in with Google, Google shares your email address, your name, your profile picture and an ID for your Google account, and Supabase stores them with your account. The next section explains exactly how we handle them.
• Your account record: when you joined, your token balance and token history, how many scenes you have made, and your account status, for example whether it is suspended.
• Sign-in and security details: the IP address and time of your latest visit while signed in, and Supabase's log of sign-in events, which includes IP addresses.
• Your uploads: the videos or photos you upload, a small preview image from each video, and the titles, room names, tour names, room lists and property addresses you type in.
• What your files contain: recordings made in our app have no sound. A file you upload from your device is stored as it is, including any sound and any details your phone added to it, such as the date, the phone model or the place it was taken. To leave the place out, turn off location tagging in your camera settings before filming.
• Capture reports: while you record a room in our app, your phone's motion and compass sensors guide you. Those readings stay on your phone. We receive only a short summary, such as how far you moved, how much of the room you covered and how blurry or dark the recording was, plus the resolution of each video.
• What we make for you: the 3D scene file, the camera path, the fly-through video and any tour video combined from your rooms.
• Payments: the amount paid, the number of tokens and the Stripe reference for each purchase. Stripe collects your card or other payment details on its own checkout page, and they never reach our servers.
• Messages: the name, email address, subject and message you send through our contact form, our reply, and the messages you exchange with us in the in-app chat.
• YouTube choices: whether you accepted or declined an invitation to feature a scene on our YouTube channel, and when you accepted.
• Visits: Google Analytics records how the site is used, such as pages viewed, device, browser and approximate location. See Google Analytics below.
• Security records: when our security system flags a request, for example a known attack pattern, too many requests or a blocked address, we record the IP address, browser details, the page requested, the time and the country of the IP address. Our web server also keeps standard technical logs of requests, which include IP addresses.

If you sign in with Google

Signing in with Google is optional. You can always create an account with an email address and password instead.

What we receive: when you choose Google, Google asks for your permission and then shares your email address, your name, your profile picture and an ID for your Google account. We use only Google's basic sign-in permissions. We never see your Google password, and we cannot access your Gmail, contacts, files, calendar or any other Google data.

How we use it: only to create your WalkTortoise account, sign you in and keep your account secure. Your email address also identifies your account: Stripe receives it when you buy tokens, and our team uses it to recognise your account, for example in purchase alerts or when you contact us. We do not use your name, your profile picture or your Google account ID for anything else.

Who receives it: only the service providers that run WalkTortoise for us, and only for that purpose. Supabase stores it with your account, Stripe receives your email address when you pay, and Resend delivers our team's purchase and failed-render alerts, which include your email address, to our team's mailbox at Microsoft (Outlook.com). We may also disclose it when the law requires it. We do not sell Google user data, we do not use it for advertising, and we do not use it to train AI or machine-learning models.

How we protect it: it travels only over encrypted connections (HTTPS) and is stored in our database at Supabase, which encrypts data at rest. Database rules keep each account's records private to that account, and only named staff accounts have admin access.

How long we keep it: for as long as you have an account. If you ask us to delete your account through walktortoise.com/contact, we delete these details with it within 30 days. You can also remove WalkTortoise from your Google Account at any time at myaccount.google.com/connections. That stops Google sign-in to WalkTortoise but does not delete your WalkTortoise account, so ask us as well if you want it deleted.

WalkTortoise's use of information received from Google APIs adheres to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

How we use your data

We do not sell your personal data, and we do not use your uploads to train general AI models.

Our team can see your account details, uploads and messages when that is needed to run the service or to help you.

We use your data to:

• create your account, sign you in and keep your account secure;
• store your uploads, turn them into 3D scenes and videos, and show them to you and to anyone you share a link with;
• process an upload again, for example to retry a failed render or to improve a poor one;
• take payments, add tokens to your balance and keep purchase records;
• answer your messages and help you with renders;
• email our team when someone buys tokens or a render fails, so we can follow up;
• protect the service, for example by blocking attacks, enforcing upload limits and suspending accounts that break our terms;
• see how visitors use the site and improve it, through Google Analytics;
• suggest a room name while you record, when that feature is switched on;
• feature a scene on our YouTube channel, only if you accept.

Our legal bases (UK and EU)

Where the UK GDPR or the EU GDPR applies, we rely on these legal bases.

• Contract: to provide what you sign up and pay for, including your account, processing, share links, payments and support.
• Legitimate interests: to keep the service secure, prevent abuse and fraud, alert our team about purchases and failed renders, keep a record of admin actions, suggest room names, see how the site is used through Google Analytics and improve the service. You can object to these uses.
• Consent: for featuring a scene on YouTube. You can withdraw consent at any time.
• Legal obligation: to keep payment and tax records.

Who receives your data

We use the service providers below to run WalkTortoise. Each one receives only what it needs for its task.

We may also disclose data when the law requires it, or when it is needed to protect our users, the public or our legal rights.

• Supabase: our database, sign-in system and file storage. It holds your account, your uploads, the files we make from them, your messages and the other records in this policy, and it sends our account emails, such as sign-up confirmations and password reset links.
• Linode, part of Akamai: hosts the server that runs our website.
• Our own processing computers: we turn uploads into 3D scenes on GPU computers that our team runs, not on a third-party cloud service. Your upload is copied to one of them for processing.
• Stripe: processes payments. With each checkout it receives your email address and your WalkTortoise account ID, plus the payment details you enter on its checkout page.
• Google: provides Google sign-in if you use it, and Google Analytics on every page of our site. If you accept a YouTube feature, your video is published on YouTube, which Google runs.
• Anthropic: when the room-name suggestion is switched on and you record a room for a tour in our app, we send one small still image from the recording to Anthropic's AI service, which replies with a suggested room name. We do not send your name or email address with it, and we do not keep the image.
• Resend: delivers email for us, including alerts to our team when someone buys tokens or a render fails. These alerts include the customer's email address and details of the purchase or the failed upload.
• Microsoft: hosts our team's mailbox (Outlook.com), which receives and stores those alerts.
• ipwho.is: when our security system records a flagged request, it looks up the country of the IP address with this service, which receives that IP address.

What is public by link

Every scene and tour has its own share link. Anyone who has the link can open it without signing in. Links contain a long random code, so they cannot be guessed, but anyone you send a link to can pass it on.

A share page shows the title and room names, the property address if you entered one, the date, the 3D scene, the fly-through video and your original recording. Visitors can download the videos.

A tour's link works whether or not you have pressed Publish.

The files behind these pages are kept in public storage: anyone who has a file's exact address can open it, but nobody can list or browse the files.

We ask search engines not to index share pages, but we cannot control what people do with a link or a downloaded file. When you paste a link into a messaging app or social network, that service may fetch the page title and preview image to show a preview. The share buttons on share pages open Facebook, WhatsApp or X with the link filled in; nothing goes to them unless you click one.

Our team can allow a scene's fly-through video to be embedded on other websites. Only our team can switch this on, one scene at a time.

To stop a link working, delete the scene or tour from your dashboard. The rooms of a deleted tour stay in your dashboard as separate scenes, each with its own link. Our team can also disable any share link.

Featuring on YouTube

Our team may invite you to feature one of your scenes on the WalkTortoise YouTube channel. The invitation appears on your dashboard, and nothing is published unless you press Accept.

If you accept, we publish the scene's fly-through video, or your original recording if there is no fly-through, as a public YouTube video with a title based on the scene's name. YouTube then holds it under Google's own terms and privacy policy.

You can withdraw your consent at any time through walktortoise.com/contact, and we will remove the video from our channel within 7 days. We cannot recall copies that others made while it was public.

How long we keep data

We keep your account, uploads, scenes and tours until you delete them or ask us to delete your account. Nothing expires automatically.

You can delete things yourself in your dashboard. Deleting an upload that is waiting in the queue or has failed removes its files. Deleting a scene removes the scene, its 3D files and its fly-through video. Deleting a tour removes the tour page, but its rooms stay as separate scenes.

Some files are not removed by those buttons: your original upload stays stored after you delete a finished scene, a combined tour video stays stored after you delete its tour, and working copies can stay on our processing computer. Ask us through walktortoise.com/contact and we will remove them.

You cannot delete your account yourself yet. Ask us through walktortoise.com/contact and we will delete your account, uploads, scenes, tours and their files within 30 days.

Some data stays after your account is deleted:

• Stripe keeps its records of your payments, and we keep access to them for accounting and tax purposes for as long as tax and accounting law requires.
• Messages you sent through the contact form stay on file, no longer linked to your account, for up to 2 years.
• Our admin log keeps a record that the account was deleted, including its email address, so we can show that the request was handled.
• Security records, which include IP addresses, are kept for up to 12 months. Our web server's own request logs are deleted automatically on a rolling basis.
• Alert emails are kept in our team's mailbox for up to 2 years, and Resend keeps its delivery logs for a limited time under its own retention rules.
• Supabase keeps backups and its own sign-in logs for a limited time under its own retention rules.
• Google Analytics keeps detailed visit data for the period set in our Analytics settings, at most 14 months.
• A video already published on YouTube stays there until we remove it.

Your rights

You can see most of your data in your dashboard and profile, and you can delete uploads, scenes and tours yourself.

Where the UK GDPR or the EU GDPR applies, you have the right to:

• access your personal data and get a copy of it;
• have data corrected if it is wrong or incomplete;
• have your data deleted;
• object to our use of your data where we rely on legitimate interests, and ask us to restrict how we use it;
• receive the data you gave us in a portable format;
• withdraw consent at any time, for example for a YouTube feature, without affecting what we did before;
• complain to a data protection authority, such as the Information Commissioner's Office in the UK or the authority where you live in the EU.

Using your rights

To make a request, write to us through walktortoise.com/contact. We may ask you to confirm it from the email address on your account. We aim to reply within one month.

Canadian privacy law gives you the right to see and correct the personal information we hold about you, and to complain to the Office of the Privacy Commissioner of Canada. People in other places, including the United States, Australia, the United Arab Emirates and Lebanon, may have similar rights under their own laws. We will handle requests from anyone in the same way.

Cookies and similar storage

We use the following cookies and browser storage:

• Sign-in cookies from Supabase, with names starting sb-: they keep you signed in, and the site needs them to work. They are set when you sign in and last up to 400 days unless you sign out. A short-lived one is also set when you sign in with Google, sign up or reset your password, so that the link back to our site can finish signing you in.
• Google Analytics cookies, named _ga and _ga_ followed by an ID: they count visits and show how people use the site. By default they last up to two years.
• One item in your browser's local storage, set on our home page and named wv-install-dismissed-at: it remembers for 14 days that you closed the prompt to install our app.
• Stripe's checkout page runs on Stripe's own website and sets its own cookies there, under Stripe's policies.

Google Analytics

Google Analytics loads on every page of our site, including share pages and embedded players. It records pages viewed, device and browser details, approximate location and how you arrived, using the _ga cookies above. Google processes this data for us.

It currently loads without asking you first. You can block it with your browser's privacy settings, an extension, or Google's opt-out browser add-on (tools.google.com/dlpage/gaoptout).

Children

WalkTortoise is not meant for children. You must be at least 18 to create an account, and we do not knowingly collect personal data from children. If you think a child has given us personal data, contact us and we will delete it.

When you film a property, please keep people, and especially children, out of the frame.

International transfers

WalkTortoise serves customers in several countries, and our providers process data in different countries, including the United States. Your data may therefore be stored or processed outside the country where you live, where data protection law may differ.

When personal data leaves the UK or the EU, we rely on safeguards the law accepts, such as the standard contractual clauses in our providers' data processing terms.

If you film homes for clients

If you are an estate agent or another business filming property for clients, you are responsible for having permission to film each property and for any personal data that appears in your footage, such as family photos or documents.

Keeping your data safe

Your data travels over encrypted connections (HTTPS), and our database and file storage at Supabase encrypt it at rest. Database rules keep each account's records private to that account, and admin access is limited to named staff accounts. No online service is completely secure, so we cannot promise that data will never be exposed. If a breach puts your data at risk, we will tell you and the authorities where the law requires it.

Our security system blocks IP addresses automatically when they send known attack patterns or flood the sign-in pages, usually for 24 hours or 30 days. If you think you were blocked by mistake, contact us.

Changes to this policy

We will update this policy when the service or the law changes, and change the last updated date. If a change matters, for example a new provider that receives your uploads, we will tell you before it takes effect, by email or with a notice on your dashboard.

Contact us

For any question or request about your data, use walktortoise.com/contact. If you are signed in, you can also use the chat in the app.

WalkTortoise, Canada.