Privacy Policy

1. Data Controller

This website is operated by Prewalk ("we"). We process your personal data as the data controller under the General Data Protection Regulation (GDPR). Contact: our contact form.

2. What Data We Process

• Contact and enquiry forms: your name, email, business name and your message — to respond to your enquiry.
• Visit measurement: only if you consent in the cookie banner, first-party, on our own servers: a session identifier and a pseudonymous visitor identifier that links your visits; the pages viewed and time spent on them; the referral source (referring address) and campaign (UTM) parameters; your browser's user agent and the device type, browser and operating system derived from it; an irreversible digest of your IP address (the IP address itself is not stored); clicks (with their position on the page) and how far you scroll. No third-party analytics or advertising code.
• Visits while signed in: only if you consent to visit measurement, the visits you make while signed in to your Prewalk account are linked to your account, using an internal account reference (not your name or email). Our team can view this visit history — the pages you viewed, how long you stayed and what you clicked — to help you when you contact support and to investigate abuse of the service. Visits made without consent are never linked to your account. When you sign out, the link is removed from your browser.
• Page counts without cookies: for every visitor, without cookies and without storing anything on your device, our server counts page views per page and day, together with the domain of the referring site (not the full address) and the device type (phone, desktop or VR). Clicks on a few marked buttons, such as “Start free”, are counted the same way, as daily totals per button and page. In the same way we count which of our own pages a visit came from and how long a page stayed open, rounded to a range (for example 10 to 30 seconds). To estimate how many people visit each day, our server computes a one-way digest of your IP address and browser with a key that changes every day; at the end of the day the digests are deleted and only the total is kept, so they cannot be linked across days or to you. During the same day the digest also keeps the first page of the visit and how it reached us (a campaign name or the referring site’s domain): if you sign up that day, these are kept with your sign-up (see “Sign-up”); otherwise they are deleted with the digests. Your IP address is not stored for this. Legal basis: our legitimate interest in understanding how our site is used (Art. 6(1)(f) GDPR).
• Short links: some links we share, for example in our social media posts, have the form prewalk.co/r/… and forward you to a page on this website. When you open one, our server counts the click, without cookies and without storing anything on your device: per link and day, together with the domain of the referring site (not the full address) and your country, estimated from your IP address using the same database on our own server (IP Geolocation by DB-IP). Previews that apps and services generate for a link are counted separately. So that a repeated click is counted only once, our server keeps a one-way digest of your IP address, browser and the link in memory for 30 seconds; it is never written to disk. Your IP address is not stored for this; only the daily totals are kept, and they contain no personal data. Legal basis: our legitimate interest in knowing which of our posts and links are used (Art. 6(1)(f) GDPR).
• Ad click identifiers: only if you also consent to marketing cookies and arrive through a link that carries one — the Meta (fbclid) or Google (gclid, gbraid, wbraid) click identifier, stored first-party for 90 days to see which ad or post brought you.
• Your cookie choice at sign-up: when you sign up, either with the form or with Google, your cookie choice — including a refusal — goes with it, so the app can respect it. Only if you consented to visit measurement does it also carry your pseudonymous visitor identifier, and only if you consented to marketing cookies, your ad click identifier. These are kept with your account for 90 days. This lets us see which page, ad or post led to a sign-up. If you have not made a choice, nothing is added.
• Country at sign-up: only if you consented to visit measurement, when you create a Prewalk account we estimate your country from your IP address, using a database kept on our own server, to see which markets our sign-ups come from. No third party is involved in this estimate and the IP address is not stored for it; we keep only the two-letter country code, with the sign-up measurement record, for 90 days — not on your account or profile. IP Geolocation by DB-IP.
• Prices for your country: when you look at our prices, our server estimates your country from your IP address, using the same database on our own server, to show the prices, currency and tax note that apply where you are. This happens for every visitor, without cookies; neither the IP address nor the country is stored for it. The checkout asks for your country itself, so the estimate never decides what you pay. Legal basis: our legitimate interest in showing correct prices (Art. 6(1)(f) GDPR).
• Purchases: when you buy a plan, we record the sale in our own measurement system — plan, amount, currency, time and the billing country from Paddle — to count our sales and see which markets they come from. An identifier is added only if you consented: with visit measurement, your pseudonymous visitor identifier; with marketing cookies, your ad click identifier and your account reference. The measurement record is deleted after 90 days; the sales record (plan, amount, currency, billing country and, if you consented to marketing cookies, your account reference) is kept for as long as we keep our sales records.
• Sign-up: when you sign up, we keep your name, email address, chosen username, a one-way hash of your password, the versions of the terms you accepted, your cookie and newsletter choices and a shortened IP address (the last part removed) only until you confirm your email address. Your account is created when you confirm. If you do not confirm within 48 hours, this pending sign-up is deleted. If you sign up with Google, there is no pending sign-up: your account is created when you finish the short sign-up form (see “Sign in with Google”). When you sign up, we also keep how you reached us that day: the first page opened that day from your internet connection and browser, and the campaign name or the referring site’s domain (see “Page counts without cookies”), not your browsing. Until you confirm, they are kept with the rest of your sign-up; then they are kept with your account and deleted with it.
• Sign in with Google: if you choose “Continue with Google”, Google tells us your name, your email address, whether Google has verified that address, and the identifier of your Google Account. We ask Google for nothing else: no contacts, no files and no access to your Google services, and we discard the access Google grants us right away. We keep your Google Account identifier and that email address with your Prewalk account, so that we recognise you the next time you sign in with Google; your name only fills in the sign-up form, where you can change it. An account you open with Google counts as confirmed, so we send no confirmation link, and it has no password until you set one. If a Prewalk account already uses the email address, we connect your Google Account to it: straight away when the address is a Gmail address or belongs to an organisation’s Google Workspace, because Google then confirms that the address is yours; otherwise only after you enter that account’s password. While you sign in, two short-lived, encrypted cookies hold the details of the sign-in (section 4). Once your account has a password, you can disconnect Google in your account settings; you can also remove Prewalk’s access in your Google Account at any time. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR). Google processes your data for its sign-in service under its own privacy policy.
• Account activity days: while you use your Prewalk account, we record the dates on which you were active — only the date, not the time or what you did — and keep them for 90 days. We use them to see how regularly Prewalk is used, for example when deciding whom to offer a trial plan. Legal basis: our legitimate interest in running and improving the service (Art. 6(1)(f) GDPR).
• Feedback: when you send feedback from the studio, we keep your message, its type, the studio page you sent it from, a short description of your browser and device (for example “Chrome · Windows”), your account and whether we may email you about it — to fix problems and improve Prewalk.
• Badges: your public profile can show badges. Most are calculated automatically — from your public activity (for example the number of your public tours, the views they received or an embed on another website) or from things you did in your account (sending feedback, or inviting someone who joined your team); “Beta member” shows that you signed up during the beta. Our team can also award special badges.
• Trial plans: if we give your workspace a plan for a limited time, we keep its start and end dates and which tours and projects you chose to keep open. When the trial ends, content that does not fit your plan is closed — no longer visible to anyone — and deleted 30 days later, unless you choose it instead of other content or your workspace moves to a bigger plan.
• Links in our emails: in some emails we send you — such as the welcome email, trial reminders and the weekly digest — links go through our own address (email.prewalk.co) first, so we can count which links are clicked. For each click we record the email it came from, the link and the time; we use this to see which emails are useful. We do not track whether you open an email. Security emails, such as verification, password reset and account recovery links, are never tracked. Legal basis: our legitimate interest in improving the emails we send (Art. 6(1)(f) GDPR).
• Our social media publishing log: our team plans and publishes Prewalk’s own social media posts, partly through an AI assistant connected to our tools. Each change made this way — for example scheduling, moving or cancelling a post, or uploading a video — is recorded in a security log: who made it (an internal account reference and, if given, a display name), when, the operation, the record it affected and its result. Post texts and files are not recorded. If a request is refused because its access key is wrong, the time, the address requested and the network (IP) address it came from are recorded. The log is deleted after 90 days. Legal basis: our legitimate interest in keeping our social media accounts secure and being able to trace every change (Art. 6(1)(f) GDPR).

3. Purposes and Legal Basis

We process your data to respond to your requests, provide our services, meet legal obligations and — where you consent — improve our site. Legal bases: contract performance (Art. 6(1)(b) GDPR), legal obligation (Art. 6(1)(c)), legitimate interests (Art. 6(1)(f)) and consent for visit measurement and marketing cookies (Art. 6(1)(a)).

4. Cookies and Local Storage

We do not use third-party analytics or advertising code. Visit measurement runs on our own servers and starts only if you consent via our cookie banner; if you decline, no measurement cookies are set. The data collected is listed in section 2. Marketing cookies are offered as a separate category in the cookie banner only if the site owner has configured a marketing integration (e.g. a Google tag). You can change your preferences at any time via the Cookie settings link at the bottom of the page.

5. Data Sharing and Processors

We do not sell your data for marketing. It is shared with the following processors strictly as needed to deliver the service:

• Hetzner Online — hosts this website, our contact forms, the Prewalk app, accounts, tours, visit measurement and our e-mail service on servers in Falkenstein, Germany (EU).
• Migadu (Switzerland) — hosts our mailbox: e-mails you send us and our replies are stored there.
• Cloudflare R2 — storage of uploaded images and media files, in the EU.
• Bunny CDN (BunnyWay d.o.o., Ljubljana, Slovenia) — delivers images and media files from servers around the world; to do so it processes your IP address and request details. It sets no cookies.
• Resend — transactional e-mail (form replies, sign-up confirmation and verification, welcome and trial reminders, newsletter), sent from its EU region.
• Paddle — our reseller and Merchant of Record for payments in the Prewalk app; it processes payment and billing details.

If you choose to sign in with Google, Google (Google Ireland Limited for users in the EEA and Switzerland) confirms your identity to us. Google acts as an independent controller for its sign-in service; we send Google no data about you.

This website and the Prewalk app are hosted in the EU. Bunny's edge servers and Resend, a US company, may process data outside the EU; any international transfer is carried out with the safeguards required by law.

6. Retention

Enquiry and contact records are kept for up to 2 years, visit measurement data for 90 days, the sales record of a purchase as described in section 2, daily page counts and visitor estimates (which contain no personal data) for 2 years — the daily visitor digests themselves are deleted at the end of each day — cookie preference records for 2 years and contract records for the statutory retention period; after that they are deleted or anonymised. For each e-mail we send you, we keep a record of the address, time, template and delivery status; the address is removed from that record after 90 days. Click records from email links are anonymised after 90 days as well.

Pending sign-ups that are not confirmed are deleted after 48 hours, account activity days and our social media publishing log after 90 days, and feedback after 2 years. Content closed at the end of a trial plan is deleted 30 days after it was closed. The identifier of your Google Account and its email address are kept for as long as your account exists, and deleted when you disconnect Google or when your account is deleted.

7. Your Rights

You have the right to access, rectify, erase, restrict or object to the processing of your data, and to data portability. You may also lodge a complaint with your supervisory authority. To exercise your rights, contact us via our contact form — we respond within one month.

8. Contact

For privacy questions: our contact form.