GDPR Privacy Notice

Effective Date: October 19, 2026

1. Introduction

This GDPR Privacy Notice applies to individuals located in the European Economic Area ("EEA"). It forms part of the Outgoing Privacy Policy. Where this Notice and the Privacy Policy differ, this Notice applies to those individuals.

Outgoing is an online service that helps you discover events, activities and places around you. It includes artificial intelligence ("AI") features: you can submit questions and requests, and the service generates personalized recommendations, content and search results.

2. Who We Are

  • Data controller: Go Playfully Inc., a Delaware corporation doing business as "Outgoing", 5432 Geary Blvd Unit 747, San Francisco, CA 94121, USA.

  • Our EU group company: Outgoing EU SAS, a French société par actions simplifiée registered with the Paris Trade and Companies Register under number 989 265 384, with its registered office at 229 rue Saint-Honoré, 75001 Paris, France. It provides research, development and support services to Go Playfully Inc.

  • EU representative (Article 27 GDPR): Outgoing EU SAS, reachable at [email protected].

  • Data Protection Officer: we have not appointed a Data Protection Officer. Our privacy team handles all data protection requests.

3. How to Contact Us

For any question about your personal data, or to exercise your rights, contact our privacy team at [email protected].

4. Personal Data We Collect

We collect the following categories of personal data:

  • Identity and contact data: name, email address, phone number.

  • Account data from Google or Apple sign-in: if you choose to sign in with a Google or Apple account, we receive your name, email address, language preference and profile picture.

  • Technical and usage data: IP address, device identifiers, browser type, pages viewed, links clicked, searches and interactions with the map and the Services.

  • Content you create: messages, comments, pictures and other content you post or send through the Services.

  • Content sent to the AI features: prompts, questions and other content you submit to the AI features.

  • Preferences: the activities, places and events you save or show interest in, and your answers to optional personalization quizzes.

  • Location data: approximate location derived from your IP address; precise location only with your permission, through your device settings.

  • Commercial data: history of purchases and bookings made through the Services.

  • Payment data: card data is processed directly by Stripe, a PCI DSS certified payment provider. We do not store your full card number.

  • Data you give us: feedback, survey answers and contest entries.

  • Cookies and similar technologies: see section 11.

5. Why We Use Your Data and on What Legal Basis

We use your personal data for the purposes below. Each purpose relies on a legal basis under Article 6 GDPR.

Purpose Legal basis
Provide and maintain the Services, including AI-generated personalized recommendations Performance of our contract with you (Art. 6(1)(b))
Create and manage your account, including Google or Apple sign-in at your request Performance of our contract with you (Art. 6(1)(b))
Send service messages: notices, account and billing information Performance of our contract with you (Art. 6(1)(b))
Keep the Services secure, prevent fraud and abuse Our legitimate interest in keeping the Services safe (Art. 6(1)(f))
Measure audience and understand how the Services are used (PostHog) Your consent (Art. 6(1)(a))
Advertising and ad performance measurement (Google Ads, Meta pixel) Your consent (Art. 6(1)(a))
Send you weekly picks, news and offers by email Your consent (Art. 6(1)(a))
Comply with legal obligations and answer lawful requests from authorities Legal obligation (Art. 6(1)(c))

Where we rely on legitimate interest, you can object at any time (see section 10). Where we rely on consent, you can withdraw it at any time, without affecting processing carried out before.

Providing your data is not a legal requirement. Some data is necessary to create an account and use the Services. Without it, we may not be able to provide the Services or some features.

6. Artificial Intelligence Features

Our Services use AI to generate personalized recommendations, information and content in response to your requests. To provide these features, we process the content you submit, together with your preferences and activity on the Services. This content is processed by multiple AI providers, acting as our processor.

A core part of our offerings are delivering personalized results, so we use data to train and optimize AI models. We use AI to generate the answers you ask for, improve our classification of events and activities, and optimize the user experience.

Personalizing recommendations involves analyzing your preferences and activity. This analysis does not lead to any decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you, within the meaning of Article 22 GDPR.

7. Who Receives Your Data

We share your personal data only with the recipients below:

  • Hosting and infrastructure: Google Cloud (servers located in the EU; Cloudflare, Inc. (content delivery, security, image hosting and cookieless website statistics).

  • Maps: Mapbox, Inc. (map display and location search).

  • Audience measurement: PostHog, Inc. (US cloud), only with your consent.

  • Advertising: Google (Google Ads) and Meta Platforms Ireland Ltd (Meta pixel), only with your consent. For the collection and transmission of data through the Meta pixel, we and Meta act as joint controllers; Meta is solely responsible for its own further processing.

  • Sign-in providers: Google and Apple, when you choose to sign in with them.

  • Payment: Stripe

  • Our group company: Outgoing EU SAS, which provides research, development and support services to Go Playfully Inc.

  • Public authorities: when the law requires it, upon a legally valid request.

  • Professional advisors: lawyers, accountants and auditors, within their engagements.

  • Corporate transactions: in case of merger, acquisition or sale of assets, your data may be transferred to the buyer or its advisors.

8. International Data Transfers

Go Playfully Inc. and several of our providers are based in the United States. Your personal data may therefore be transferred to, stored and processed in the United States and other countries outside the EEA.

For these transfers we rely on the safeguards of Chapter V GDPR: the EU-U.S. Data Privacy Framework where the recipient is certified, and otherwise the European Commission's Standard Contractual Clauses, with additional measures where needed. You can request a copy of these safeguards at [email protected].

9. How Long We Keep Your Data

We keep your data only as long as needed for the purposes described in this Notice, then we delete or anonymize it:

Data category Retention period
Account and profile data Life of the account, then deleted or anonymized at the latest 3 years after your last activity
Messages and content you create Life of the account; deleted when you close it
Content sent to the AI features Life of the account; deleted when you close it
Audience measurement data 14 days
Billing and payment records 10 years
Technical and security logs 12 months
Cookies and similar technologies 13 months maximum; data collected through them 25 months maximum
Your cookie choices 12 months, after which we ask you again

10. Your Rights

Under the GDPR, you have the following rights over your personal data:

  • Access: obtain a copy of the data we hold about you.

  • Rectification: have inaccurate or incomplete data corrected.

  • Erasure: ask us to delete your data, under the conditions of Article 17 GDPR.

  • Restriction: ask us to limit the use of your data.

  • Portability: receive the data you provided to us in a structured, machine-readable format.

  • Objection: object to processing based on legitimate interest, and at any time to direct marketing.

  • Withdrawal of consent: withdraw your consent at any time, without affecting processing carried out before.

  • Instructions after death: if you live in France, set instructions on what happens to your data after your death.

To exercise these rights, write to [email protected]. We answer within one month. This period may be extended by two further months for complex or numerous requests; we will tell you if so. We may ask you to confirm your identity.

You can also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or with the supervisory authority of the country where you live or work.

11. Cookies and Similar Technologies

We and our partners use cookies, pixels, local storage and similar technologies ("Cookies") in the categories below.

  • Strictly necessary: needed for the Services to work: security, sign-in, and storing your cookie choices. They do not require consent.

  • Audience measurement: help us understand how the Services are used and improve them. Set only with your consent.

  • Marketing: used to show you relevant ads on other platforms and measure their performance. Set only with your consent.

When you first visit the website, a banner lets you accept all, reject all, or choose by category. Before you make a choice, and after you refuse, the only cookie we set is a first-party cookie containing a random identifier that lets us count visits anonymously; it isn't shared with anyone, and stops being used if you clear your cookies. No audience-measurement cookie from a third party and no marketing cookie is set before you make a choice, or after you refuse.

You can change your choices at any time through the "Cookie settings" link at the bottom of every page.

When you use Google sign-in, Google may also set its own cookies on google.com, under its own privacy policy.

12. Minors

The Services are intended for individuals aged 18 and over. We do not knowingly collect personal data from minors. If you believe we hold data about a minor, contact us at [email protected] and we will delete it.

13. Security

We use technical and organizational measures to protect your personal data against unauthorized access, use, alteration or disclosure (Article 32 GDPR), including encryption of data in transit. For any security question, contact [email protected].

14. Changes to This Notice

We may update this Notice. For material changes, we will inform you by email or by a notice on our website before the changes take effect. Where processing relies on your consent, we will ask for your consent again before any material change to that processing.