LocalX Privacy Policy
This policy explains what personal data the LocalX mobile app (the "App") collects, why, where it is stored, and how you can manage it. This policy has been prepared in accordance with the Law of the Republic of Kazakhstan "On Personal Data and Their Protection."
1. Who processes your data
Personal data operator: LocalX (to be provided), BIN to be provided, address: to be provided. For questions about personal data, contact us at to be provided.
2. What data we collect
- Phone number — to sign in with a one-time code and to contact you about bookings.
- Profile data that you provide yourself: first and last name, date of birth, gender, city, field of work, bio, social media links, and profile photo. For tour organizers, also company name, experience, languages, WhatsApp, and website; for bloggers, topics, follower count, and social media.
- Booking data: tour, date, package, number of participants, contact name, and phone number.
- Your content: messages in tour chats, reviews and their photos, and reports.
- Verification documents — only if you are an organizer or blogger and choose to go through verification.
- Technical data: a random App installation identifier and usage events (opened the home screen, opened a tour, started a booking) for anonymized statistics; a push notification token; App crash reports (without phone number or IP address).
We do not collect your location, phone contacts, or payment card details. The camera and photo library are used only when you choose a photo yourself or scan a ticket QR code (for organizers).
3. Why we use your data
- to sign you in to your account and protect it;
- to process bookings and share with the tour organizer the data needed for the trip;
- for group chats of participants on a tour date and for notifications (about bookings, available spots, organizer messages, and replies to reviews);
- for your public profile: what you have chosen to show;
- to moderate content, review reports, and protect against fraud;
- for anonymized statistics to improve the App, and to fix bugs.
We do not sell personal data or use it for targeted advertising.
4. Who else can see your data
- The organizer of the tour you booked: contact name, phone number, group members, and check-in status at the meeting point.
- Participants in the tour date chat: your name, profile photo, and messages.
- Other users: your public profile, reviews, and past trips, unless you have hidden them in your profile settings.
- Infrastructure providers that store and process data on our behalf: MongoDB Atlas on Amazon Web Services servers (Germany) — database, including organizers' verification documents; Railway (Netherlands) — App server; Cloudflare (USA, worldwide network) — the localx.asia website and photo storage; Resend (Ireland) — emails with sign-in codes and booking notices; Telegram — phone number confirmation when signing in through the bot; Google Firebase — push notifications; Sentry — crash reports (phone numbers, email addresses and tokens are masked in them).
- Government authorities — only in cases expressly provided for by law.
5. Cross-border transfer
The servers that store and process data and the services listed above are located outside the Republic of Kazakhstan. When you sign up, you separately confirm your consent to the processing of your personal data, including its cross-border transfer to these providers; the date and version of the consent are recorded. We choose providers that protect data at a level comparable to the requirements of the laws of the Republic of Kazakhstan and give them only the data their task requires.
6. How long we keep data
- Account data — for as long as the account exists.
- After a deletion request, the account can be restored within 30 days, after which it is deleted. Bookings are kept in anonymized form (without name or phone number) for the organizer's records, and reviews are kept anonymously.
- Statistics events are kept for 180 days.
- One-time sign-in codes are valid for 5 minutes.
7. Your rights
At any time, you can:
- view and edit your profile data in the App;
- hide reviews and past trips from your public profile;
- delete your account: "Profile → Account → Delete account";
- block another user or report content;
- withdraw your consent to processing and request information about your data by writing to to be provided.
8. Data protection
Data is transmitted over a secure connection (HTTPS), access to the database is restricted, sign-in is possible only with a one-time code, and the number of attempts is limited.
9. Children
The App is intended for users aged 16 and older. If you learn that a child under 16 has created an account, let us know and we will delete it.
10. Changes to this policy
We may update this policy. We will notify you of material changes in the App. The current version is always available at this link.