EnglishFrançaisEspañol

Privacy policy


Effective as of 13-08-2026

We are the company RYO, a simplified joint-stock company with a capital of 271,753.58 euros, whose registered office is located at 15 Quai Jean Moulin, 69002 Lyon, registered with the Lyon Trade and Companies Register under number 902 055 904 (hereinafter "RYO" or "we"). We are the publisher of the "RYO" application, a travel application allowing users to visit cities independently through immersive routes and audio guides, as well as to plan and personalize road trips and travels (hereinafter the "Application").

As part of the provision of the Application, we are required to collect and process personal data concerning you. We attach great importance to the protection of your personal data and are very attentive to compliance with all applicable regulations in this area, in particular the General Data Protection Regulation (EU) No. 2016/679 of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the "GDPR"), Law No. 78-17 of January 6, 1978, on information technology, data files and civil liberties, known as the revised "French Data Protection Act", the Law for a Digital Republic No. 2016-1321 of October 7, 2016, and the decrees adopted for their application (hereinafter the "Applicable Regulations on personal data protection").

In accordance with the Applicable Regulations on personal data protection, this Policy informs you about the processing of personal data we carry out when you use the Application.

It informs you in particular about:

  • The personal Data we collect
  • The reasons why we use it (purposes and legal bases)
  • The period for which we retain it (retention periods)
  • The recipients of this data and any data transfers carried out
  • Your rights regarding your Data

We may modify this Policy at any time if we change the way we process your data. In this case, we will inform you by the most appropriate means for our relationship with you (sending an email, displaying a notification on the Application).

1. Definitions

  • "Subscriber" means any User who has subscribed to a RyoPlus Subscription.
  • "RyoPlus Subscription" means the annual subscription to which any User can subscribe in order to benefit from additional advantages and services (including access to all Application content).
  • "Application" means our "RYO" application as described in the preamble.
  • "Legal basis": means the basis on which processing is founded. Processing is only lawful if, and to the extent that, it falls under one of the six bases provided for by the GDPR (Art. 6).
  • "Data" means the personal data concerning you that we process, whether this data identifies you directly or indirectly.
  • "Processing purposes" means the different objectives justifying the collection and processing of your Data by RYO, as defined in this Policy.
  • "Privacy Policy" or "Policy" means this document explaining in detail the Data processing we carry out as part of the provision of the Application.
  • "Data Controller" means the entity that determines the purposes and means of personal data processing. RYO acts as a Data Controller in the context of the Data processing explained in this Policy.
  • "RYO" or "we" means our company as identified in the "Who are we?" section below.
  • "Data Processor" means an entity that processes personal data on behalf of a Data Controller, i.e., upon instructions from the latter and within the framework of the purposes determined by the latter. We use data processors who are required to process some of your Data for purposes we explain to you in this Policy.
  • "Processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction, as defined by Regulation (EU) 2016/679 of April 27, 2016, and any other subsequent equivalent regulation.
  • "User" or "you" means any natural person holding an account on the Application and using the services offered by it.

2. Who are we? We are the company RYO, a simplified joint-stock company with a capital of 271,753.58 euros, whose registered office is located at 15 Quai Jean Moulin, 69002 Lyon, registered with the Lyon Trade and Companies Register under number 902 055 904. We operate as a software and application designer and publisher, particularly in the tourism sector. It is within the scope of this activity that we developed the Application. We carry out the Data processing explained in this Policy as a Data Controller within the meaning of the Regulations on personal data protection.

3. How to contact us? For any questions regarding this Policy or to exercise your rights regarding your Data, you can contact us by one of the following means:

  • By email: hi@ryo.co
  • By mail: RYO, 15 Quai Jean Moulin, 69002 Lyon, France

4. What data do we collect about you? We collect the personal Data listed below on or through the Application when you use it.

Regarding all Users This data is collected whether you use the Application in free mode or paid mode (RyoPlus Subscription)

  • Identity: Last name, first name, title.
  • Account: Identifier, email address associated with the account.
  • Relationship tracking: Requests for information on RYO's products and/or services, correspondence, exchanges with the sales department, possible complaints, etc.
  • Geolocation: Location data obtained through your smartphone's geolocation feature (your exact GPS position: latitude, longitude), altitude, horizontal and vertical accuracy. Route history: routes taken, number of steps, km traveled, route duration.
  • Movement and activity data: Number of steps, estimated distance traveled, activity status (stationary, walking, running, vehicle), floors climbed, floors descended, estimated travel speeds, start/end date/time of travel, etc. This data is provided by your phone's operating system. The exact content of the processed data depends on the operating system used (iOS, Android). We access it exclusively to optimize the functioning of the Application and the use of your phone's battery.
  • Connection data / Metadata: Connection IP address, session identifier, page or screen visited, referring page (if applicable), dates and times of connection and events, actions performed on the Application (e.g., features used, clicks, screen views, purchases, registrations, and other configured events).
  • Device configuration information: Operating system, device model, device identifier, time zone, device language, connection type, application version, screen resolution.

Regarding Subscribers This data is collected only if you subscribe to a RyoPlus Subscription

  • Payment and subscription information: Date and time of payment, unique identifier assigned to the subscriber, subscription date, subscription duration, renewal date, termination date, use of a promo code.

Information regarding Data processed by download platforms (App Store and Google Play): The Application is distributed via the Apple App Store and the Google Play Store. When you download the Application, subscribe, renew, or cancel a subscription, or make an in-app purchase via one of these platforms, certain personal data is processed directly by Apple or Google in accordance with their own privacy policies. This data may include information relating to your platform user account, purchase and subscription data, billing information, transaction history, technical identifiers of your device, your IP address, as well as the data necessary to secure payments and prevent fraud. Apple and Google act, for these processing operations, as independent data controllers and independently determine the purposes and methods of the processing they implement. We do not have access to your full payment information, such as credit card numbers or authentication data associated with payment methods. We only receive the information strictly necessary for managing access to the service and subscriptions taken out via the relevant platforms, such as the subscription status, transaction identifiers, or information allowing us to verify the validity of a subscription.

5. Why do we use your data and for how long? We process your personal Data only for the purposes described in the list below. We may process them on the basis of different grounds that authorize us to do so (legal bases):

  • to perform a contractual obligation (Legal basis: performance of a contract)
  • to comply with a legal obligation (Legal basis: legal obligation)
  • because we have a legitimate interest in processing them (Legal basis: legitimate interest)
  • because you have given us your consent (Legal basis: consent).

Data is kept for the time necessary to achieve the purposes pursued, in accordance with the retention periods specified below. They are defined in accordance with the recommendations of the French Data Protection Authority (CNIL).

Regarding all Users These processing operations are carried out whether you use the Application in free mode or paid mode (RyoPlus Subscription)

  • Management of the Application and provision of associated services Registration of Users, account management, support and maintenance management, complaint management. Legal basis: Performance of a contract Retention period: For the entire duration of the contractual relationship
  • Geolocation of Users Proposing relevant routes/tours according to the User's position, locating and guiding the User in real time on the routes, automatically triggering contextualized content (audio guides, information, points of interest, etc.) based on the User's position. Legal basis: Performance of a contract Retention period: For the duration strictly necessary for the execution of the relevant service (proposing a nearby route, executing the journey, route, etc.)
  • Route history Allowing users to keep a memory of their routes. Legal basis: Performance of a contract Retention period: For the entire duration of the contractual relationship
  • Application security management / log recording Legal basis: RYO's legitimate interest in ensuring traceability of access and actions performed on the Application, in particular to detect malicious behavior and preserve the security of the Application and Data. Retention period: 1 year
  • Consumer prospecting Prospecting related to products or services similar to those already provided. Legal basis: RYO's legitimate interest in offering Users deals related to the Application. Retention period: Up to 3 years from the last contact with the Data Subject. You have the right to object to receiving our commercial prospecting.
  • Management of the prospecting opt-out list Legal basis: RYO's legitimate interest in knowing which individuals it is no longer authorized to prospect. Retention period: For 3 years following the exercise of the right to object.
  • Sending the newsletter (news and guides) Legal basis: Consent Retention period: Up to 3 years from the last contact with the Data Subject or until consent is withdrawn. You may withdraw your consent at any time.
  • Management of the newsletter opt-out list Legal basis: RYO's legitimate interest in knowing which individuals it is no longer authorized to send the newsletter to. Retention period: For 3 years following the exercise of the right to object.
  • Production of anonymized statistics Legal basis: RYO's legitimate interest in having statistics on its clientele as part of the management of its activities. Retention period: Unlimited duration in the form of aggregated (anonymized) data.
  • Management of GDPR rights requests Legal basis: Legal obligation Retention period: For 5 years following the rights exercise request.
  • Management of complaints and litigation Legal basis: RYO's legitimate interest in establishing proof of a right or the proper performance of its contractual obligations where applicable. Retention period: For the entire duration of the limitation period applicable to the relationship (e.g., up to 5 years for civil limitation).

Regarding Subscribers This data is collected only if you subscribe to a RyoPlus Subscription

  • Subscription management and provision of associated services Legal basis: Performance of a contract Retention period: For the entire duration of the contractual relationship
  • Management of legal, accounting, and tax obligations in connection with the contractual relationship with Subscribers Legal basis: Compliance with legal obligations Retention period: Kept as intermediate archives for the legal retention period to which RYO is bound (e.g., up to 10 years for our accounting obligations).

When "Consent" is written in the "legal basis" field, this means that we may carry out processing for the relevant purpose only if you consent to it, in particular by checking a box inviting you to do so on the Application, and that you may withdraw your consent at any time by contacting us.

6. Who can your data be transmitted to? As part of the processing operations we carry out on or through the Application, and in order to provide you with our services, we are required to transmit some of your Data to various recipients.

To our teams Your Data may be communicated to all our teams who need it to carry out their missions as part of the management and provision of the Application. Example: our technical team to improve our tool and ensure its maintenance, our support team to handle your questions, etc.

To our technical processors We use various technical service providers for different reasons:

  • AMAZON WEB SERVICES (AWS): Application hosting
  • ZOL: Application development and maintenance
  • ALGOLIA: Search and suggestion of routes near the user
  • ADJUST: Audience measurement, marketing analytics and reporting; fraud detection
  • ONESIGNAL: Mailing and marketing campaign management
  • GOOGLE (Google Workspace): Use of office tools and messaging
  • ZENDESK: Support request management
  • REVENUECAT: Management of subscription purchases via the stores

To administrative or judicial authorities We may be required to communicate some of your Information to administrative or judicial authorities when we receive a judicial requisition.

7. Where do we store your Data? We strive to store your data on servers located in the European Union whenever possible and consistent with the level of service we intend to provide you. However, some of our technical processors may process certain Data outside the European Union. When this is the case, we first ensure that the processors in question implement appropriate safeguards in compliance with the GDPR.