Privacy Policy

1. Introduction

WombatLink is a service operated by AguilarTech, based in Victoria, Australia. WombatLink lets tour guides generate pickup links to share with their guests. When a tourist opens a link, they can see the meeting location, photos of the spot, instructions for the pickup, and chat with their guide.

This Privacy Policy explains what information we collect when you use WombatLink, how we use it, who we share it with, and the rights you have over your data. It applies to both tour guides who hold accounts with us and tourists who open links shared by a guide.

2. Information We Collect

Account information

• Your email address and a password (the password is hashed by our authentication provider, Supabase, and never stored in plain text).
• Your name, if you sign in with Google. Signing in with Google is optional.

Pickup data

• The name of the tour and the guest's name.
• The pickup time.
• The pickup location, including latitude and longitude as well as a human-readable address.
• Photos of the pickup spot that the guide uploads.
• Itinerary or instruction text written by the guide.
• A contact phone number, if the guide chooses to share one.

Chat messages

When a guide and tourist chat through a pickup link, we store those messages so the conversation continues to work between sessions and devices.

Automatically collected information

• Your IP address and browser user-agent, which our hosting provider Vercel records for analytics and abuse prevention.
• An approximate location derived from your IP via ipapi.co. We use this only to centre the map on a sensible starting region; it is not a precise location and is not stored long-term.

3. How We Use Your Information

• To provide the service: generating pickup links, rendering maps, delivering chat messages, and translating itinerary text into the tourist's chosen language.
• To improve WombatLink: understanding which features are used and where errors happen.
• To communicate with you: account confirmations, password resets, and important service notices.
• To keep the service safe: spotting abuse and enforcing our Terms.

4. Sharing Your Information

We do not sell your personal information. We share it only with the third-party providers we rely on to run the service:

• Supabase — database, authentication, and file storage. Hosted in US and EU regions.
• Vercel — application hosting and request analytics.
• Google Maps API — rendering maps and providing place autocomplete suggestions.
• Google Cloud Translation API — translating itinerary text into the tourist's chosen language.
• ipapi.co — anonymised IP geolocation for map centering.
• Resend — sending transactional emails such as signup confirmations and password resets.

We may also disclose information if required to do so by law or to protect the rights, property, or safety of AguilarTech, our users, or others.

5. Cookies and Local Storage

WombatLink uses a small number of cookies and browser storage items:

• wombatlink_anonymous_id — a random identifier for users who haven't signed up, so we can keep their work-in-progress link tied to their browser.
• wombatlink_links_created — counts how many free links an anonymous user has created.
• wl-lang — your preferred language for the interface.
• sb-* — set by Supabase to keep you signed in.
• oauth-result — a short-lived value used during Google sign-in.

You can clear these from your browser at any time, but doing so will sign you out and may reset your in-progress work.

6. Data Retention

We keep your account information and the pickup data you've created for as long as your account is active. If you ask us to delete your account, we will remove your personal data and the pickup links tied to it within 30 days. Some information may be retained for a bit longer where required by law or for routine backup rotation.

7. Your Rights

Depending on where you live, you may have the following rights over your personal information:

• Access a copy of the data we hold about you.
• Correct information that is wrong or out of date.
• Delete your account and the data tied to it.
• Receive a portable copy of your data in a common format.
• Object to certain types of processing.
• Withdraw any consent you've previously given.

To make a request, email us at hello@AguilarTech.com. We may need to verify your identity before acting on the request.

8. International Transfers

WombatLink is based in Australia, but some of the providers we use store and process data in the United States and the European Union. By using the service, you understand that your data may be transferred to and processed in those regions. We rely on the safeguards our providers maintain, including standard contractual clauses where applicable.

9. Children's Privacy

WombatLink is not directed to children under the age of 16, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us their information, please contact us so we can delete it.

10. Security

We take reasonable steps to protect the information you trust us with. All traffic to WombatLink is served over HTTPS. Passwords are hashed by Supabase before storage. Access to data in our database is limited by row-level security policies, so users can only read and write records that belong to them. No system is perfectly secure, but we work to keep WombatLink on top of current best practice.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make a material change, we will update the effective date at the top of this page and, where appropriate, let you know by email or in the app.

12. Contact Us

Questions, requests, or concerns about this Privacy Policy? Email us at hello@AguilarTech.com. For administrative matters relating to AguilarTech, you can also reach us at wombat@AguilarTech.com.au.