Legal

Privacy policy

Last updated 30 September 2026

This policy explains what personal data Andio collects when you use this website, why we collect it, and what rights you have over it. We've written it in plain English rather than legal boilerplate.

Who we are

Andio is a London experiences website operated by Andio Ltd, a company registered in England and Wales. Andio Ltd is the data controller for the personal data described in this policy.

Registered name
Andio Ltd

Company number
17459122

Registered in
England and Wales

Registered office
71-75 Shelton Street, Covent Garden,
London, WC2H 9JQ, United Kingdom

ICO registration number
ZC252052

For anything relating to this policy or your data, contact privacy@andio.co.uk.

What we collect

We deliberately collect very little. There are no user accounts on this site, and you don't need to identify yourself to browse it.

Data	When	Why
Your trip details	When you enter a starting postcode, date and interests	To show experiences near you, stored on your own device, not sent to us
Your saved day and plan settings	When you add experiences or change your itinerary	Stored on your own device, not sent to us
Technical log data	Every page request	Security, fault diagnosis, and keeping the site up

Your trip details and saved day stay with you

The postcode, date and interests you enter before browsing are stored in your browser's local storage on your own device, and are cleared automatically at the end of that day. The same applies to experiences you add to your basket and your itinerary settings, such as start and end times. None of it is transmitted to us and we cannot see it. Clearing your browser data removes it, and it does not follow you to another device.

To check that a postcode is valid and find its location, your browser sends it to Postcodes.io (see below). Postcodes on their own identify an area, not a person.

Shared day links

If you use the share button, the stops in your day are encoded into the link itself. We don't store the link or its contents. Anyone you send it to can see the day it contains, so only share it with people you're happy to show your plans to.

Technical log data

Our hosting and infrastructure providers automatically record standard server information for each request, including IP address, browser type, and the pages requested. This is ordinary web server logging, used to keep the site secure and working. We do not use it to build a profile of you.

Cookies and similar technologies

We do not set any advertising or analytics cookies on this site. There is no Google Analytics, no advertising pixel, and no cross-site tracking by us.

Local storage

We use your browser's local storage to remember your trip details, basket and itinerary settings. This is strictly necessary to provide features you have actively chosen to use, so it does not require consent under the Privacy and Electronic Communications Regulations.

Content loaded from other providers

Some parts of this site load resources directly from third parties. When that happens, your browser contacts them and they will see your IP address and basic request information. We have no control over what they do with it. Specifically:

YouTube — experience videos, embedded in privacy-enhanced mode (youtube-nocookie.com). YouTube does not set tracking cookies unless you play a video. Once you interact with one, Google may collect data under Google's privacy policy. Video thumbnails are also served by YouTube.
Google Fonts — typefaces used across the site, served from Google's font servers.
OpenStreetMap and CARTO — the maps on the itinerary and shared day pages. Map tiles are requested from CARTO and based on OpenStreetMap data.
unpkg — the mapping library used to draw those maps.
Postcodes.io — checks the postcode you enter and turns it into a location, so we can show experiences near you. We also use it in our admin tool when building the catalogue.

Directions links

The itinerary page includes links that open Google Maps with your stops pre-filled. Following one takes you to Google, where their own privacy policy applies. We don't send Google anything about you until you choose to click.

Affiliate links

When you follow a booking link, you leave our site and go to a partner such as Viator or Booking.com. That partner may set a cookie recording that you arrived from us, so that we receive a commission if you book. Those cookies are set by the partner under their own privacy policy, not by us. We receive only aggregate commission reporting — we do not learn what you personally booked or paid.

Legal bases for processing

Legitimate interests — for server logs and site security, where our interest in operating a functioning, secure website is not overridden by your rights.

Who we share data with

We do not sell your personal data, and we never will. We use the following service providers, who process data on our behalf:

Google Cloud (Firebase) — our database, which stores the experience catalogue. The database is hosted in Google's europe-west2 region, in London.
Netlify — website hosting and delivery.
Cloudflare — domain name services and email forwarding for our @andio.co.uk addresses.
Google (Gmail) — where email sent to privacy@andio.co.uk is received and stored.

We may also disclose data where we are legally required to do so.

International transfers

Our database is hosted in the United Kingdom. Some providers may process technical data, such as server logs and email, outside the UK. Where that happens, transfers are covered by UK International Data Transfer Agreements, adequacy regulations, or equivalent safeguards.

How long we keep it

Server logs — retained on a short rolling basis by our hosting provider.
Trip details — held on your device and cleared at the end of the day you entered them. We hold no copy.
Basket and plan data — held on your device until you clear it. We hold no copy.

Your rights

Under UK GDPR you have the right to:

Ask what personal data we hold about you and receive a copy
Have inaccurate data corrected
Have your data deleted
Restrict or object to how we use it
Receive your data in a portable format

To exercise any of these, email privacy@andio.co.uk. We'll respond within one month. There's no charge.

Andio Ltd is registered with the Information Commissioner's Office as a data controller, registration number ZC252052.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put things right first.

Children

This site is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has sent us personal data, contact us and we'll remove it.

Changes to this policy

We'll update this page when our practices change, and revise the date at the top.