Hidden Worlds Terms of Service
Effective Date: May 28, 2026
1. Who We Are
These Terms of Service ("Terms") govern your use of Hidden Worlds ("Service"), an AI-powered travel guide accessible through WhatsApp. The Service is operated by:
Mindsmiths d.o.o.
Zavrtnica 17, HR-10000 Zagreb, Croatia
Contact: hello@mindsmiths.com
Throughout these Terms, "we," "us," and "our" refer to Mindsmiths d.o.o. "You" and "your" refer to you, the user of the Service.
2. Accepting These Terms
By scanning a Hidden Worlds QR code and initiating a conversation with our travel guide on WhatsApp, you agree to these Terms and our Privacy Policy (Part 2 of this document). If you do not agree, please do not use the Service.
Your continued use of the Service after any changes to these Terms constitutes your acceptance of the updated Terms. We will notify you of material changes through our WhatsApp channel.
3. What the Service Is
Hidden Worlds provides an AI-powered travel guide through WhatsApp. The Service includes:
- Conversational travel guidance — destination-specific stories, recommendations, and practical information delivered through WhatsApp chat.
- Lessons and briefings — structured, interactive learning moments about the destination you are visiting.
- Story Cards — physical collectible cards available for purchase at partner retail locations. Story Cards are sold exclusively in physical stores (e.g., airport shops, city retail partners) and are not sold through the Service itself.
The Service is currently available for Dubrovnik, Croatia, and may expand to additional destinations over time.
4. Eligibility
The Service is delivered through WhatsApp. By using the Service, you confirm that you meet WhatsApp's minimum age requirements, which are 16 years of age in the European Union and the European Economic Area, and 13 years of age (or the minimum age in your country) elsewhere. You also confirm that you have the legal capacity to accept these Terms.
If you are a parent or guardian and you become aware that your child has used the Service without meeting the applicable age requirements, please contact us at hello@mindsmiths.com.
5. How to Use the Service
Access. You access the Service by scanning a QR code at a participating airport, retail location, or other touchpoint. This opens a WhatsApp conversation with your travel guide. No app download or account registration is required.
No guarantees of availability. The Service depends on WhatsApp's platform and your internet connection. We do not guarantee uninterrupted or error-free availability.
Your responsibilities. You agree to:
- Use the Service only for personal, non-commercial purposes.
- Not attempt to reverse-engineer, copy, or extract the Service's underlying technology, content, or data.
- Not use the Service to send spam, abusive, threatening, or unlawful messages.
- Not misrepresent your identity or impersonate another person.
- Not use the Service in any way that violates applicable laws or WhatsApp's terms of service.
6. AI-Generated Content
The travel guide is powered by artificial intelligence. This means:
- Responses are generated, not guaranteed. The travel guide provides information, stories, and recommendations based on its knowledge base and AI processing. While we strive for accuracy, AI-generated content may occasionally contain errors, outdated information, or inaccuracies.
- Not professional advice. The Service does not provide professional travel, legal, medical, financial, or safety advice. Always verify critical information (e.g., visa requirements, health advisories, transport schedules) through official sources.
- Recommendations are not endorsements. When the travel guide suggests places to visit, eat, or shop, these are informational suggestions. We are not responsible for the quality, safety, or availability of any third-party venue, product, or service mentioned.
7. Intellectual Property
Our content. All content within the Service — including but not limited to stories, text, artwork, Story Card designs, the "Hidden Worlds" and "Storyhunter" branding, lesson content, and briefing materials — is the intellectual property of Mindsmiths d.o.o. or its licensors and is protected by copyright and other intellectual property laws. You may not reproduce, distribute, or create derivative works from this content without our prior written consent.
Your messages. You retain ownership of the messages you send to the Service. By using the Service, you grant us a limited license to process your messages for the purpose of providing and improving the Service. See the Privacy Policy (Part 2) for details on how we handle your data.
8. Story Cards
Story Cards are physical products sold exclusively at participating retail locations. The purchase of Story Cards is governed by the terms of sale of the respective retail partner. We are not a party to those retail transactions and are not responsible for refunds, exchanges, or disputes arising from in-store purchases.
The digital content associated with Story Cards (e.g., QR code links, passport entries) is part of the Service and subject to these Terms.
9. Third-Party Services
The Service relies on third-party platforms and services, including but not limited to:
- WhatsApp (Meta Platforms, Inc.) — the messaging platform through which the Service is delivered. Your use of WhatsApp is subject to WhatsApp's own Terms of Service and Privacy Policy.
- AI service providers — we use third-party AI providers to process and generate responses. See the Privacy Policy (Part 2) for details.
We are not responsible for the actions, policies, or practices of any third-party service. Any links or references to third-party websites, products, or services within the Service are provided for convenience and do not imply endorsement.
10. Limitation of Liability
To the maximum extent permitted by applicable law:
- The Service is provided on an "as is" and "as available" basis, without warranties of any kind, whether express or implied, including but not limited to warranties of merchantability, fitness for a particular purpose, and non-infringement.
- We shall not be liable for any indirect, incidental, special, consequential, or punitive damages arising from your use of or inability to use the Service.
- Our total liability for any claim arising from or related to the Service shall not exceed EUR 100.
- We are not liable for any loss, injury, or damage resulting from reliance on information provided by the Service, including but not limited to travel recommendations, navigation guidance, or venue suggestions.
Nothing in these Terms excludes or limits our liability for death or personal injury caused by our negligence, fraud or fraudulent misrepresentation, or any other liability that cannot be excluded or limited under applicable law.
11. Termination
By you. You may stop using the Service at any time by ceasing to interact with the travel guide on WhatsApp. You may also request deletion of your data by contacting us at privacy@mindsmiths.com.
By us. We may suspend or terminate your access to the Service at any time, without prior notice, if we reasonably believe you have violated these Terms, or for any other legitimate reason, including discontinuation of the Service.
Effect of termination. Upon termination, your right to use the Service ceases. Provisions of these Terms that by their nature should survive termination (including but not limited to intellectual property, limitation of liability, and governing law) shall survive.
12. Changes to These Terms
We may update these Terms from time to time. When we make material changes, we will notify you through the Service (via WhatsApp message) or by other reasonable means. The "Effective Date" at the top will be updated. Your continued use of the Service after the updated Terms become effective constitutes your acceptance.
13. Governing Law and Dispute Resolution
These Terms are governed by and construed in accordance with the laws of the Republic of Croatia, without regard to its conflict of law provisions.
Informal resolution. Before initiating any formal proceedings, you agree to contact us at hello@mindsmiths.com and attempt to resolve the dispute informally within 30 days.
Arbitration. If the dispute is not resolved informally, either party may submit it to binding arbitration administered by the Permanent Arbitration Court at the Croatian Chamber of Economy (Stalni izbrani sud pri Hrvatskoj gospodarskoj komori) in Zagreb, Croatia. The arbitration shall be conducted in English, by a sole arbitrator, in accordance with the rules of the said court. The arbitrator's award shall be final and binding and may be enforced in any court of competent jurisdiction.
Exceptions to arbitration. Either party may bring a claim in the competent courts of Zagreb, Croatia for injunctive or other equitable relief to protect intellectual property rights, or where arbitration is not permitted by applicable law. Nothing in this clause limits your rights as a consumer under mandatory provisions of the law of your country of residence.
If you are a consumer in the European Union, you also have the right to submit a complaint through the European Commission's Online Dispute Resolution (ODR) platform at https://ec.europa.eu/consumers/odr.
14. General Provisions
- Entire agreement. These Terms, together with the Privacy Policy, constitute the entire agreement between you and Mindsmiths d.o.o. regarding the Service.
- Severability. If any provision of these Terms is found to be unenforceable, the remaining provisions shall remain in full force and effect.
- No waiver. Our failure to enforce any right or provision of these Terms shall not be considered a waiver of that right or provision.
- Assignment. We may assign our rights and obligations under these Terms without your consent. You may not assign your rights or obligations without our prior written consent.
- Language. These Terms are drafted in English. If translated into another language, the English version shall prevail in case of any discrepancy.
15. Contact Us
If you have any questions about these Terms, please contact us at:
Mindsmiths d.o.o.
Zavrtnica 17, HR-10000 Zagreb, Croatia
Email: hello@mindsmiths.com
Hidden Worlds Privacy Policy
Effective Date: May 28, 2026
1. Introduction
This Privacy Policy explains how Mindsmiths d.o.o. ("we," "us," "our") collects, uses, stores, and shares your personal data when you use the Hidden Worlds travel guide on WhatsApp ("Service").
We are committed to protecting your privacy in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and other applicable data protection laws.
Data Controller:
Mindsmiths d.o.o.
Zavrtnica 17, HR-10000 Zagreb, Croatia
Email: privacy@mindsmiths.com
2. What Data We Collect
When you use the Service, we may collect and process the following categories of personal data:
2.1 Data You Provide Directly
- WhatsApp profile information — your phone number, display name, and profile photo (as made available through the WhatsApp Business API).
- Messages and interactions — the content of messages you send to the travel guide, including text, images, voice messages, or other media you choose to share.
- Preferences and interests — information you share about your travel preferences, dietary requirements, interests, length of stay, and similar details during conversation.
2.2 Data Generated Through Use
- Conversation history — a log of your interactions with the travel guide, including AI-generated responses.
- Travel profile — preferences, discovered stories, completed lessons, and other engagement data that the Service uses to personalize your experience across trips and destinations.
- Technical metadata — timestamps of messages, session identifiers, and interaction patterns.
2.3 Data We Do NOT Collect
- We do not collect your precise GPS location unless you explicitly share it with us through WhatsApp.
- We do not access your WhatsApp contacts, call history, or messages with other people.
- We do not collect payment or financial information (Story Cards are sold through independent retail partners).
3. How and Why We Use Your Data
We process your personal data for the following purposes and legal bases under Article 6 of the GDPR:
| Purpose | Legal Basis (GDPR Art. 6) |
|---|---|
| Delivering the Service — processing your messages, generating travel guide responses, providing personalized recommendations | Performance of a contract (Art. 6(1)(b)) — necessary to deliver the Service you have requested |
| Personalization across trips — remembering your preferences, past discoveries, and travel style to improve future interactions | Legitimate interest (Art. 6(1)(f)) — providing a better, more relevant experience |
| Service improvement — analyzing aggregated and anonymized usage patterns to improve the travel guide's quality and content | Legitimate interest (Art. 6(1)(f)) — improving the Service |
| Communication — sending you service-related messages (e.g., updates to these Terms, daily briefings you have opted into) | Performance of a contract (Art. 6(1)(b)) |
| Legal compliance — responding to legal requests, enforcing our Terms, protecting our rights | Legal obligation (Art. 6(1)(c)) or Legitimate interest (Art. 6(1)(f)) |
The Service does not send marketing or promotional messages. All communications through the travel guide are informational and service-related.
4. AI Processing Disclosure
Your messages are processed using artificial intelligence to generate travel guide responses. This involves:
- How it works. When you send a message, it is transmitted to our servers and processed by third-party AI language model providers (see Section 6 below) to generate a relevant response. Your message content is sent to these providers as part of the processing.
- No automated decision-making with legal effects. The Service does not make automated decisions that produce legal effects or similarly significantly affect you within the meaning of GDPR Article 22. The AI generates informational and conversational responses only.
- AI training. Your messages are not used to train or improve AI models — neither by us nor by our AI service providers. Message content is processed solely to generate your travel guide response and is not retained by AI providers for model training purposes.
5. Data Retention
We retain your personal data as follows:
| Data Category | Retention Period |
|---|---|
| WhatsApp profile information | As long as you use the Service, plus 24 months after your last interaction |
| Conversation history | 24 months after your last interaction |
| Travel profile (preferences, discoveries) | As long as you use the Service, plus 24 months after your last interaction |
| Aggregated/anonymized analytics | Indefinitely (no longer personal data) |
After the retention period, your personal data is deleted or irreversibly anonymized.
You may request deletion of your data at any time (see Section 8 — Your Rights).
6. Who We Share Your Data With
We do not sell your personal data. We share your data only with the following categories of recipients, and only to the extent necessary:
6.1 Sub-Processors
| Provider | Role | Location |
|---|---|---|
| Microsoft Deutschland GmbH | Cloud infrastructure hosting (Azure Kubernetes Service) | EU (Germany) / US |
| OpenAI, L.L.C. | AI language model services — processing message content to generate responses | US |
| Anthropic, PBC | AI language model services — processing message content to generate responses | US |
| Google Ireland Limited | AI language model services — processing message content to generate responses | EU (Ireland) |
| Meta Platforms, Inc. (WhatsApp) | Messaging platform through which the Service is delivered | EU / US |
6.2 Other Disclosures
We may also share your data:
- When required by law, regulation, or legal process.
- To protect the rights, property, or safety of Mindsmiths d.o.o., our users, or the public.
- In connection with a merger, acquisition, or sale of assets, in which case you will be notified.
7. International Data Transfers
Your data is processed in the European Union and the United States. When your data is transferred outside the EU/EEA, we ensure appropriate safeguards are in place, including:
- EU-US Data Privacy Framework — for transfers to US providers certified under the framework.
- Standard Contractual Clauses (SCCs) — approved by the European Commission, used where the Data Privacy Framework does not apply.
You may request a copy of the applicable transfer safeguards by contacting us at privacy@mindsmiths.com.
8. Your Rights
Under the GDPR, you have the following rights regarding your personal data:
- Right of access — you may request a copy of the personal data we hold about you.
- Right to rectification — you may request correction of inaccurate or incomplete data.
- Right to erasure ("right to be forgotten") — you may request deletion of your personal data.
- Right to restriction of processing — you may request that we restrict the processing of your data in certain circumstances.
- Right to data portability — you may request to receive your data in a structured, commonly used, machine-readable format.
- Right to object — you may object to processing based on legitimate interest at any time.
- Right to withdraw consent — where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
How to exercise your rights. Send a message to the travel guide on WhatsApp saying "I want to exercise my data rights," or email us at privacy@mindsmiths.com. We will respond within 30 days, as required by the GDPR.
Right to lodge a complaint. If you believe your data protection rights have been violated, you have the right to lodge a complaint with:
Croatian Personal Data Protection Agency (AZOP)
Selska cesta 136, HR-10000 Zagreb, Croatia
Website: https://azop.hr
Email: azop@azop.hr
Or with the supervisory authority in your country of residence, if you are located in another EU/EEA member state.
9. Data Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include, but are not limited to:
- Encryption of data in transit (TLS/SSL) and at rest.
- Access controls limiting data access to authorized personnel and systems.
- Regular security assessments and monitoring.
While we take reasonable steps to protect your data, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.
10. Children's Privacy
The Service is delivered through WhatsApp, which requires users to be at least 16 years of age in the EU/EEA, or the applicable minimum age in other jurisdictions. We do not knowingly collect personal data from children below the age required by WhatsApp and applicable law.
If we become aware that we have collected personal data from a child below the applicable minimum age, we will take steps to delete that data promptly. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at privacy@mindsmiths.com.
11. WhatsApp-Specific Provisions
The Service is delivered through the WhatsApp Business API. By using the Service, you acknowledge the following:
- WhatsApp's role. WhatsApp (Meta Platforms, Inc.) acts as an independent data controller for certain data it processes in connection with its platform. For details, see WhatsApp's Privacy Policy at https://www.whatsapp.com/legal/privacy-policy.
- Opt-in. By scanning a Hidden Worlds QR code and sending your first message, you consent to receiving messages from the Service through WhatsApp. You may stop receiving messages at any time by sending "STOP" or by blocking the travel guide's number.
- Message storage by WhatsApp. Messages exchanged between you and the Service may also be stored by WhatsApp in accordance with their own data retention policies, which are outside our control.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the Service (via WhatsApp message) or by other reasonable means. The "Effective Date" at the top will be updated.
13. Contact Us
If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at:
Mindsmiths d.o.o.
Zavrtnica 17, HR-10000 Zagreb, Croatia
Email: privacy@mindsmiths.com