Willa
Go Anywhere, Learn Everything.
Our cities are filled with history and untold stories.Walk with Willa is a free-roam, open-world walking tour.
As you walk, your narrator, Willa, walks with you.She explains the history, buildings and landmarks you’re actually seeing in real time.Willa knows what you like, what you want to learn about and curates the stories you hear to match your interests.London, Buenos Aires, Barcelona - It doesn’t matter where in the world you are.Press a button, start walking, and let Willa bring the city around you to life.
& let willa do the rest...
Go anywhere, Learn Everything.
How can we help?
Willa Privacy PolicyWalk With Willa Ltd Company Number: 16568820 Registered Address: 20 Birch Grove, Mansfield, NG18 4JH, United KingdomVersion 2.0 | Last Updated: 26 August 20261. IntroductionWalk With Willa Ltd ("we", "us", or "our") operates the Willa mobile application ("Willa" or the "App"). We are committed to protecting your personal data and respecting your privacy rights.This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use the App, and describes your rights under applicable data protection law, including:UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018
EU General Data Protection Regulation (EU GDPR 2016/679)
California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA)By creating an account or using the App, you acknowledge that you have read and understood this Privacy Policy.The App is intended for users aged 18 and over.2. Data Controller and RepresentativesData Controller Walk With Willa Ltd Company Number: 16568820 Registered Address: 20 Birch Grove, Mansfield, NG18 4JH, United KingdomData Protection Lead Daniel Previti, Chief Privacy Officer, is accountable for data protection at Walk With Willa Ltd. Email: [email protected] Post: Data Protection, Walk With Willa Ltd, 20 Birch Grove, Mansfield, NG18 4JH, United KingdomUsers in the European Union If you are in the EU you may contact us at [email protected], or lodge a complaint with the supervisory authority in your member state of residence.3. Data We Collect
3.1 Account and Identity DataWhen you register or sign in via Single Sign-On (SSO) through Google or Apple, we receive:Your name, as provided by the SSO provider
Email address
A unique identifier issued by the SSO providerWe do not receive or store your SSO passwords. Authentication is handled entirely by Google or Apple under their own privacy policies.3.2 Profile DataData you provide or select within the App:Username
Selected language
Selected city
Selected interests
3.3 Location DataThe App's core function is to deliver audio and written content triggered by your proximity to points of interest. To do this we process:Precise device location (latitude and longitude)
Location collected while the App is running in the background, including when the screen is off or the App is not in the foreground
Derived proximity to points of interestBackground location is integral to how the App works: content is triggered as you walk, without requiring you to hold or look at your device. We do not sell location data, and we do not use it for advertising.3.4 Usage and Device Data
Device type, operating system and version
App version
Crash and error logs
Session duration and feature interaction data
Content engagement metrics (items viewed, saved or dismissed)
3.5 Inferred DataBased on your selected interests, location history and in-App behaviour, we infer content preferences in order to personalise what the App shows you. See Section 9.4. Lawful Basis for Processing (UK & EU GDPR)We process personal data only where a valid lawful basis applies.Contract — Article 6(1)(b) Processing necessary to provide the App and perform our agreement with you. This covers account creation and management, authentication, location processing (foreground and background), proximity detection, and delivery of location-triggered content. Because location-triggered content is the App's core purpose, the App cannot function without location processing.Legitimate Interests — Article 6(1)(f) Processing necessary for our legitimate interests in maintaining and improving the App, diagnosing faults, preventing fraud and misuse, and maintaining security — where those interests are not overridden by your rights and freedoms. We have assessed the balance of interests for each such purpose and you may request further information at [email protected].Consent — Article 6(1)(a) Push notifications, and any processing for optional features or communications not necessary to deliver the App. You may withdraw consent at any time, in the App or in your device settings, without affecting the lawfulness of processing before withdrawal.Legal Obligation — Article 6(1)(c) Where processing is required to comply with applicable law.Note on device permissions. Separately from the lawful bases above, your device's operating system requires you to grant location and notification permissions. Granting or refusing those permissions is your choice and is managed in your device settings at any time. Refusing or revoking location permission will prevent the App's core features from operating.5. How We Use Your Data
Creating and managing your account
Authenticating you via Google or Apple SSO
Detecting proximity to points of interest and delivering the associated content
Personalising content and recommendations based on your selected interests, location and engagement
Sending push notifications, where you have enabled them
Diagnosing faults and improving App performance and features
Detecting, investigating and responding to security incidents and misuse
Complying with legal obligations
Contacting you about your account, service changes, and updates to this policy
6. Sharing Your Personal Data
6.1 Service Providers (Processors)We use third-party service providers who process personal data on our behalf, under written contracts that meet the requirements of Article 28 UK/EU GDPR and permit processing only on our documented instructions. Categories are:Cloud infrastructure, database, file storage and hosting — Google Firebase
Authentication — Google, Apple
Crash reporting and analytics — Google Firebase Crashlytics
Push notification delivery — Google Firebase Cloud Messaging
Mapping, geocoding and places data — Google Maps Platform
Email and customer supportA current list of our processors, including the countries in which they process data, is available on request from [email protected]. We will provide it within 10 business days.Where we appoint a new processor with access to personal data, we carry out due diligence on their technical and organisational security measures before onboarding.6.2 Business TransfersIf Walk With Willa Ltd is involved in a merger, acquisition, restructuring or sale of assets, personal data may transfer as part of that transaction. We will notify you in the App or by email before your data becomes subject to a different privacy policy.6.3 Legal DisclosureWe may disclose personal data where required by law, court order or a regulatory authority, or where necessary to establish, exercise or defend legal claims, or to protect the rights, property or safety of Walk With Willa Ltd, our users, or the public.6.4 No Sale or Sharing of Personal DataWe do not sell personal data, and we do not share personal data for cross-context behavioural advertising, as those terms are defined under the CCPA/CPRA.7. International Data TransfersPersonal data may be processed outside the United Kingdom and the European Economic Area, including by the service provider categories listed in Section 6.1.Our principal processor is Google (Firebase), which processes data in the United States and other locations. Transfers to Google are governed by the Firebase Data Processing and Security Terms, which incorporate the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, and Google's certification under the UK Extension to the EU–US Data Privacy Framework.More generally, where data is transferred outside the UK or EEA we rely on one of the following:Transfers to a country or scheme covered by UK adequacy regulations or an EU adequacy decision, including the EU–US Data Privacy Framework and its UK Extension
The UK International Data Transfer Agreement (IDTA), or EU Standard Contractual Clauses together with the UK International Data Transfer AddendumYou may request details of the safeguards applied to transfers of your data by contacting [email protected].8. Data RetentionWe retain personal data only for as long as necessary for the purposes set out in this policy, or as required by law.Data category Retention period
Account and profile data Deleted on account deletion (see Section 16)
Location data 12 months from collection, then deleted or irreversibly aggregated
Usage and analytics data 24 months, then deleted or irreversibly aggregated
Crash and error logs 12 months
Records required for legal, tax or fraud-prevention purposes Up to 6 years, in line with UK statutory requirements
Anonymised aggregate statistics Retained indefinitely; cannot be linked to an identifiable personBackups are overwritten on a rolling cycle; data deleted from live systems may persist in backups for a short period before being overwritten, during which it is not used for any purpose.9. Automated Processing and ProfilingThe App uses automated processing to build a profile of your content preferences, based on your selected interests, location history and in-App behaviour.This profiling is used solely to decide which content to show or suggest to you. It is not used to make decisions producing legal effects or similarly significant effects concerning you, and it is not used for advertising, credit, employment or eligibility decisions.We have carried out a Data Protection Impact Assessment under Article 35 UK/EU GDPR covering our location processing and profiling, and we review it at least annually.You may object to this profiling by contacting [email protected]. Objecting will reduce the relevance of content the App shows you.10. Your Rights
10.1 UK & EU GDPRSubject to applicable law, you have the right to:Access — obtain confirmation of, and a copy of, the personal data we hold about you
Rectification — have inaccurate or incomplete data corrected
Erasure — request deletion of your data ("right to be forgotten")
Restriction — limit how we process your data in certain circumstances
Portability — receive data you provided in a structured, commonly used, machine-readable format
Object — object to processing based on legitimate interests, including profiling
Withdraw consent — at any time, without affecting prior processing
Not be subject to solely automated decisions producing legal or similarly significant effectsTo exercise any right, contact [email protected]. We will respond within one month, extendable by up to two further months for complex or numerous requests, in which case we will tell you within the first month and explain why.We do not charge for responding to requests unless a request is manifestly unfounded or excessive.You have the right to lodge a complaint with the UK Information Commissioner's Office at ico.org.uk, or with the supervisory authority in your EU member state of residence.10.2 California Residents — CCPA/CPRAIf you are a California resident, you additionally have the right to:Know what personal information we collect, use and disclose, and for what purposes
Delete personal information we hold about you
Correct inaccurate personal information
Opt out of the sale or sharing of personal information — we do not sell or share personal information, so no opt-out is required
Limit the use and disclosure of sensitive personal information — precise geolocation is sensitive personal information under the CPRA. We use it only to deliver the App's core location-triggered content and for the purposes described in Section 5, which are permitted business purposes; we do not use or disclose it to infer characteristics about you for any other purpose
Not be discriminated against for exercising your privacy rightsNotice at collection. The categories of personal information we collect, the purposes for which we use them, and our retention periods are set out in Sections 3, 5 and 8 of this policy. We collect one category of sensitive personal information: precise geolocation. We use it only to deliver the App's location-triggered content and for the purposes in Section 5, all of which are business purposes permitted under CPRA section 1798.121(a). We do not use or disclose it to infer characteristics about you, and we do not sell or share it. Because our use is limited to permitted business purposes, we are not required to offer a "Limit the Use of My Sensitive Personal Information" option — you can nonetheless stop all collection at any time by revoking location permission in your device settings or deleting your account.Categories disclosed for a business purpose in the preceding 12 months: identifiers, internet and app activity, precise geolocation, and inferences — disclosed only to the service providers listed in Section 6.1.To make a request, contact [email protected]. We will verify your identity using the email address associated with your account. We respond within 45 days, extendable by a further 45 days where reasonably necessary, and will tell you if an extension applies.You may use an authorised agent to make a request on your behalf, subject to verification.11. Data SecurityWe apply technical and organisational measures appropriate to the risk, in line with Article 32 UK/EU GDPR.Infrastructure. The App is built on Google Firebase. Google's Firebase services hold ISO/IEC 27001 certification and are covered by SOC 1, SOC 2 and SOC 3 evaluations, and several also hold ISO/IEC 27017 and ISO/IEC 27018. Firebase encrypts customer data at rest, and encrypts data in transit using HTTPS. Google's certifications are published at firebase.google.com/support/privacy.Our measures.Encryption of all data in transit using TLS/HTTPS
Encryption of data at rest, provided by Google Firebase
Authentication delegated to Google and Apple — Walk With Willa Ltd does not store user passwords
Access to production data restricted to the two members of our team who require it, managed through Google Cloud identity and access management
Multi-factor authentication enforced on all administrative, cloud infrastructure and developer accounts
Firebase Security Rules controlling read and write access to user records
Managed, patched infrastructure maintained by Google
Application error and crash monitoring
Documented internal procedures for personal data breach response, processor due diligence, and handling data subject rights requests, reviewed at least annually
A completed Data Protection Impact Assessment covering our location processing and profiling, reviewed at least annuallyNo method of transmission over the internet or method of electronic storage is completely secure. While we apply appropriate safeguards, we cannot guarantee absolute security.Breach notification. Where a personal data breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the ICO (and, where relevant, the competent EU supervisory authority) without undue delay and within 72 hours of becoming aware of it. Where the breach is likely to result in a high risk, we will notify affected users without undue delay. Where we process data on behalf of a business customer, we will notify that customer without undue delay after becoming aware of a breach affecting their data.12. Device PermissionsThe App uses the following device permissions:Location (foreground and background) — required. Used to detect proximity to points of interest and deliver location-triggered content. The App's core features do not function without it.
Push notifications — optional. Used to deliver content alerts and service updates.You can grant or revoke these permissions at any time in your device settings.13. Single Sign-OnWhen you sign in using Google or Apple, you authenticate through that provider's platform. Their handling of your data is governed by their own policies:Google Privacy Policy: https://policies.google.com/privacy
Apple Privacy Policy: https://www.apple.com/legal/privacy/We receive only the data fields you authorise during sign-in. You can revoke our access through your Google or Apple account settings at any time; doing so will prevent you signing in to the App by that method.
14. Age RestrictionThe App is intended for users aged 18 and over. By using the App you confirm you are at least 18.We do not knowingly collect personal data from anyone under 18. If we become aware that we hold data relating to someone under 18, we will delete it without undue delay. If you believe we may hold data about a person under 18, contact [email protected].15. Changes to This PolicyWe may update this Privacy Policy from time to time. Where changes are material, we will notify you in the App or by email at least 14 days before they take effect. The current version is always available within the App and includes a version number and date.Where a change affects processing that relies on your consent, we will seek fresh consent rather than relying on continued use. For all other changes, if you do not agree with the updated policy you should stop using the App and may request deletion of your account as set out in Section 16.16. Account and Data Deletion
Deleting your account in the App
Open the Willa app and sign in.
Go to the Profile screen.
Tap Delete account.
Confirm by tapping Delete Account in the dialog.Deletion takes effect immediately and cannot be undone.If you cannot access the AppIf you can no longer sign in, or have uninstalled the App, email [email protected] from the email address linked to your account so we can verify the request. We will complete the deletion within 30 days.What is deleted
Your authentication identity (email / Google / Apple sign-in)
Your profile — username, selected language, city and interests
Your location history and engagement data associated with your account
Preferences stored on your device
What may be retained
Anonymised aggregate usage statistics that are not linked to you and cannot be used to identify you
Records we are required to keep for legal, tax, security or fraud-prevention purposes, for the minimum period required
17. Contact UsFor any question, concern or request relating to this Privacy Policy or your personal data:Email: [email protected] Post: Data Protection, Walk With Willa Ltd, 20 Birch Grove, Mansfield, NG18 4JH, United KingdomWe aim to acknowledge privacy enquiries within 5 business days and to respond substantively within the statutory timeframes set out in Section 10.Walk With Willa Ltd · Company Number 16568820 · Version 2.0 · 26 August 2026