Your privacy
on oto-tours.com.
This policy covers oto-tours.com only. It explains what we collect when you visit, take a fan number, buy a fan club tier, apply, or write to us; why; how long we keep it; and the choices you have. We don’t sell your information, we don’t show ads, and we don’t use cookies.
Who is responsible.
oto-tours.com is run by Mobile Entertainment, LLC (“oTo Tours”, “we”), the company behind HumanOnAStick Segway tours in Minneapolis and St. Paul, Minnesota. For anything in this policy, including a request about your information, email support@humanonastick.com.
Our other sites, such as humanonastick.com and oto-play.com, have their own policies.
What a visit records.
A small script on our pages counts visits without cookies. It gives each browser tab a random ID that is forgotten when the tab closes, and while the page is visible it reports every 15 seconds: the page, how long it has been visible and how far you have scrolled. When the page loads it also reports your screen size, language, time zone and the page that linked you here. When you click, it notes which element you clicked and where on the page, for a click heatmap.
Amazon CloudFront, which delivers the site, adds your IP address, an approximate location worked out from it (city, region, country), your internet provider and your browser’s user agent. We use all of this to see how many people visit, from where, on which devices, what they read and click, and to spot abuse and keep the site working.
Only we can see the statistics, on a private dashboard that needs our Google sign-in.
| Record | Kept |
|---|---|
| One visit (one browser tab): last seen, time, scroll, place, provider, device, referrer | 3 days |
| Each report from the page, with your IP address and user agent | 30 days |
| Where clicks landed, without the user agent | 90 days |
| Visit counts per place per day | 400 days |
| CloudFront’s request logs: every request with its full address, your IP address, approximate location and user agent | 3 years |
Your fan number and pass.
When you take a free fan number we save it with a scrambled (hashed) copy of its pass code, which lets us check a code without keeping it, and with the time, your IP address, approximate location, browser, language and the page or campaign that sent you here, so we can keep the line fair (for example, limiting how many numbers one connection takes a day) and recognize returning fans. If you add an email address, we save it with your number. We keep fan numbers for as long as the fan club runs, so your place in line holds.
Your pass stays in your browser. We keep your fan number and pass code in your browser’s local storage so you don’t lose your place. It stays until you choose “Forget this pass on this device” on your pass, or clear your browser’s site data. Bring it back on any device with your pass code or its QR code.
Linking your visits to your fan number. While your pass is in your browser, our site statistics can file your visits under your fan number (never your pass code), so we can see how fans use the site across visits and devices. Those records keep the same details as any visit, plus the pages you viewed. We keep them for 400 days. When a page sends your fan number, it is also part of the request address in CloudFront’s request logs (3 years). Whether this happens depends on where you are:
- European Economic Area (the EU, Iceland, Liechtenstein and Norway): off unless you choose “Yes, link my visits” on your pass.
- United Kingdom, United States and everywhere else: on, unless you choose “Stop linking my visits” on your pass.
- Global Privacy Control: if your browser sends it, your visits are never linked, wherever you are.
You can change your choice at any time on your pass. Either way, your visits are still counted like anyone else’s (section 02).
What you send us.
- Email updates. The “Keep me posted” forms send your email address to Mailchimp, which sends our oTo news. Every email has an unsubscribe link.
- Paid fan club tiers. We save your name, email, phone, city, state and country with your fan number and order, and the IP address you ordered from. Stripe takes the payment on its own checkout page and sends us a confirmation; we never see your card number. The receipt and invoice Stripe emails you show your fan number and pass code, so that email alone can restore your pass, and Stripe keeps a copy with your payment record.
- Gold and Platinum applications. We save your contact details, organization, proposed market, whether you say you are an accredited investor, and your message, with the IP address and approximate location you applied from, to review your application and contact you.
- Careers and contact forms. We save your name, email, your message, how you found us and the IP address you wrote from, to reply and to stop spam.
New orders, applications and messages, with the IP address they came from, are also emailed to our team through Amazon SES. We keep these records while we are in contact with you and for our business records, or until you ask us to delete them where the law allows.
What we keep in your browser.
| Name | Where | What it is for | Until |
|---|---|---|---|
oto_v | Session storage | The random tab ID for site statistics | The tab closes |
oto-source | Session storage | The page or campaign that sent you, sent with a form if you fill one in | The tab closes |
oto-fan-pass | Local storage | Your fan number and pass code | You forget the pass or clear site data |
oto-fan-stats | Local storage | Your choice about linking visits to your fan number | You clear site data |
We set no cookies and use no advertising or third-party analytics trackers.
Who we share it with.
We use these companies to run the site, and they handle your information only to provide their service to us: Amazon Web Services (hosting, storage, request logs and email, in the United States), Stripe (payments), Mailchimp (email updates) and Google (sign-in to our own dashboard; Google gets nothing about visitors). Tour bookings are taken by BookingHound on booking.bookinghound.cloud under its own policy.
We don’t sell your personal information or share it for targeted advertising. We may disclose it if the law requires, to protect our rights or someone’s safety, or as part of a sale or reorganization of our business.
Your choices and rights.
Depending on where you live, including Minnesota, California, other US states, the UK and the EEA, you may have the right to know what we hold about you, get a copy, correct it, delete it, object to or restrict how we use it, and opt out of sale, sharing or profiling. We honor Global Privacy Control as an opt-out. To make a request, email support@humanonastick.com with your fan number or the email you used. We may ask you to confirm it’s you, and we will answer within 45 days. If we turn down a request, you can appeal by replying to our answer, and you can complain to your data protection or consumer protection authority.
Our legal reasons for using your information, where the law asks for one, are: your consent (linking your visits in the EEA, and email updates), carrying out what you asked for (your fan number, orders and applications), and our legitimate interest in understanding how the site is used and keeping it secure (site statistics).
Everything else.
Security. The site is served only over HTTPS. Our storage is private, and our dashboard needs our Google sign-in. No system is perfectly secure, so if you think your pass code is known to someone else, tell us.
Children. This site is not meant for children under 13, and we don’t knowingly collect their information. Paid tiers and applications are for adults. If you think a child has given us information, tell us and we will delete it.
Where it is kept. We are in the United States and our providers store information here. If you visit from elsewhere, your information comes to the United States.
Changes. We will post any change here with a new effective date, and tell fans who gave us an email address about important ones.