GuideField
GuideField
GuideField is a professional tool for tour operators and licensed guides. We collect only what the product needs, we never sell personal data and we do not use it for advertising or tracking across other companies’ apps and sites.
The controller of the personal data described here is Agonist Ltd. Şti., Ankara, Turkey (“GuideField”, “we”), contact info@agonistdigital.com. This policy is our notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and Articles 13–14 of the EU General Data Protection Regulation (“GDPR”).
Guest data is different. When an operator enters its own customers (names, phone numbers, notes) into a tour, the operator decides why and how that data is used and is the controller; GuideField only stores and displays it on the operator’s instructions as its processor (see section 5).
The table lists each kind of data, what we use it for and the legal basis. “Contract” means we need it to provide the service you signed up for (KVKK art. 5/2-c, GDPR art. 6(1)(b)); “Legitimate interest” is KVKK art. 5/2-f and GDPR art. 6(1)(f); “Consent” is KVKK art. 5/1 and GDPR art. 6(1)(a); “Legal obligation” is KVKK art. 5/2-a/ç and GDPR art. 6(1)(c).
| Data | Purpose | Basis |
|---|---|---|
| Name, email, password (stored only as a salted hash by our authentication provider), account type, language | Create and secure your account, sign you in, contact you about the service | Contract |
| Profile: photo, bio, languages, specialisations, optional phone, website and contact email, signature colour | Show who you are to the people you work with | Contract |
| Verification: verification code, vouches from other guides, company documents you upload (kept private) | Admit only verified professionals to the community | Contract; legitimate interest (trust and safety) |
| Content you create: pins and messages with their location, photos, voice notes, routes, checkpoints, recorded paths, direct and group messages, reactions, tour plans, field reports, call pins | Deliver location-locked content, routes and communication between professionals | Contract |
| Location while the app is open | Show nearby pins, unlock content when you are in range, place pins where you stand | Consent (device permission) |
| Location in the background (optional, only during a live tour or route recording) | Let the operator of that tour follow progress and record your path | Consent (separate “Always” permission) |
| Place searches you type when adding a stop | Find the place on the map (sent to the OpenStreetMap Nominatim service) | Contract |
| Push notification token and notification preferences | Send notifications you asked for | Contract; consent (device permission) |
| Credit purchases: Apple/Google transaction identifiers and receipt data, credit balance | Add the credits you bought, prevent fraud and double use, keep accounting records | Contract; legal obligation |
| Reports and blocks you make, content that is reported, moderation decisions | Keep the community safe and meet our duties on user content | Legitimate interest; legal obligation |
| Technical data: IP address and request logs held by our infrastructure providers, app version, device type | Run, secure and debug the service | Legitimate interest |
By default your location is read only while the app is open.
If you grant the extra “Always” permission, your location is also read with the screen off or the app in the background, but only after you start a live tour or a route recording, and only until you end it. iOS and Android show a location indicator while this runs; it stops by itself after a time limit and when you sign out. During a live tour your position is shared with the operator of that tour only. There is no other background tracking, no location history is built for advertising and you can use the app without ever granting background access.
You can withdraw location permission at any time in your device settings; withdrawing does not affect earlier lawful processing.
We do not sell personal data. Other people in GuideField see only what the visibility you chose allows: public pins and routes are visible to verified users; organisation and group content only to that team; guest links only to people who hold the secret link. Operators see the guest data they entered themselves.
Service providers (processors and independent providers) that handle data to run GuideField:
| Provider | What for | Data | Location |
|---|---|---|---|
| Supabase Inc. | Database, authentication, file storage, realtime and server functions | All account and content data | Hosting region chosen by us; US-based company |
| Expo (650 Industries, Inc.) and Apple/Google push services | Deliver push notifications | Push token, notification text | United States and global |
| Resend, Inc. | Sends sign-up codes, password-reset codes and security notices by email | Your email address and the text of that email | United States and global |
| Apple Inc. | App distribution, in-app purchase, Apple Maps (iOS), push | Purchase data, map requests, device data | United States and global |
| Google LLC | Distribution and billing on Android, Google Maps (Android), push | Purchase data, map requests, device data | United States and global |
| OpenStreetMap Foundation (Nominatim) | Place search | The text you search for and your IP address | United Kingdom |
Apple, Google and the OpenStreetMap Foundation act as independent controllers under their own privacy policies. Map data and map tiles are provided by Apple Maps on iOS and Google Maps on Android; on Android Google’s Maps Additional Terms and Privacy Policy apply.
We also disclose data where the law requires it (for example a court order), to protect users from imminent harm, or to a successor if GuideField is transferred, with the same protection.
Operators may record guests’ names, phone numbers and notes such as dietary or access needs. Such notes can reveal health or religious belief, which are special categories of data (KVKK art. 6, GDPR art. 9). By entering them the operator confirms that it has informed the guest and has the guest’s explicit consent or another valid legal basis, that it records only what is necessary for the tour, and that it deletes the data when it is no longer needed. Guests can exercise their rights against the operator; GuideField will help the operator respond.
Guests who open a tour link can leave a rating and an optional comment without an account. We store the rating, the comment and the time with the tour, and show them to the operator and the guide of that tour.
Our providers are located in, or may access data from, countries including the United States and the United Kingdom. Where Turkish or EU law requires it we rely on an adequacy decision, standard contractual clauses or the other safeguards allowed by KVKK art. 9 and GDPR Chapter V, and, where required, on your explicit consent. Ask us for a copy of the safeguards used.
| Data | Kept for |
|---|---|
| Account, profile and everything you created | Until you delete your account |
| Messages and pins with an expiry date, and messages you delete | Removed from the live service at expiry or deletion, and permanently erased 30 days later |
| Call pins (emergency or assistance pins) | Until they expire, then permanently erased 30 days later |
| Live-tour position points | Permanently erased 7 days after they were recorded |
| Operator alerts | 12 months |
| Purchase records | As long as accounting and tax law require (up to 10 years); not linked to your profile after account deletion where the law allows |
| Backups | Encrypted backups kept by our database provider are overwritten on a rolling cycle; deleted data is not restored into the live service |
Under KVKK art. 11 and GDPR arts. 15–22 you may: learn whether your data is processed and get a copy; ask for the purposes and recipients; have incorrect data corrected; have data erased or anonymised; object to processing based on legitimate interest; withdraw consent; ask for a portable copy; and ask that corrections and erasures be notified to recipients. You may also claim compensation for damage caused by unlawful processing.
Most of this you can do yourself in the app: edit your profile, block or report users, and withdraw permissions in your device settings. For anything else write to info@agonistdigital.com; we answer within 30 days (KVKK art. 13). We may ask you to prove your identity first.
You may complain to the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu, kvkk.gov.tr) or, if you are in the EEA or UK, to your local supervisory authority.
Open Profile, then My Profile, and choose Delete My Account. This permanently deletes your profile, sign-in, uploaded files (photos, voice notes, documents, avatar), messages, pins, personal routes, guest lists, credit balance and push tokens, and cannot be undone. Routes that belong to an operator organisation stay with that organisation without your name. Messages other people sent to you are deleted with your account.
If you cannot use the app, email info@agonistdigital.com from your account address with the subject “Delete my account”; we will verify it is you and complete the deletion within 30 days. Any credits you still hold are lost when the account is deleted.
Traffic is encrypted in transit. Access to data is controlled by database row-level security so that messages and routes are visible only to the people allowed to see them, privileged keys are kept off devices, and verification documents are stored in a private bucket. No system is perfectly secure; if a breach affecting you occurs we will notify you and the competent authority as the law requires (KVKK art. 12/5; GDPR arts. 33–34).
GuideField is for professionals and is not directed at anyone under 18; we do not knowingly collect children’s data and will delete it if we learn we have. Operators remain responsible for any data about minors that they choose to enter for their own tours.
If we change this policy in a way that matters we will tell you in the app before it applies; the date above shows the current version. Controller: Agonist Ltd. Şti., Ankara, Turkey. Contact for privacy requests: info@agonistdigital.com.