Privacy policy

The data controller for your data is the entity that operates this service. Its details are listed in the legal notice of this site and you can consult them at any time; that record is the valid reference, not this summary.

For anything related to your data you can write to us. If your request concerns a right (access, rectification, erasure, portability or objection) we handle it within thirty days of receiving it, and we verify that you are who you say you are before we touch anything.

This product operates in the European Union, so Regulation (EU) 2016/679 (GDPR) applies. The structure of this policy follows its three blocks: what data, on what legal basis and for how long.

The table below is the complete inventory of what the service stores. There is no data outside this table: if the product starts storing something new, this table changes before the code does.

The legal basis column says why we are allowed to process each item. The retention column says how long we keep it before deleting it, and it is the same rule that the nightly purge job applies.

Most of the data is processed because it is needed to deliver the service you asked for: without your email there is no account, and without the trip content there is no itinerary. That is performance of the contract.

The price history, the anonymous visitor cookie and the error logs are processed on the basis of legitimate interests: they let us run the product, improve it and detect failures without asking for a consent that would not improve your experience.

The cookie categories that require consent (analytics and marketing) are switched off today and are not switched on without your express agreement. If they are ever switched on, consent will be prior, explicit and revocable, and it will be the only basis for that category.

This is the most concrete section of the whole policy, because it is the one least explained by the products in this sector. When you plan a trip, information leaves your device towards third parties who act as our subprocessors.

The artificial intelligence provider receives the context of the trip: the destinations, the dates, the number and profile of the travellers, your preferences and the text of your conversation, plus the system instructions and, if you attached something, the name and type of the file. That information is used to write the answer and is removed from the provider's infrastructure according to its own retention policy.

The inventory providers (flights, hotels, experiences and transfers) receive a search query: origin and destination city, dates, number of people and sometimes filters such as price range or accommodation category. They do not receive your email, your name or anything that identifies you; they receive what they need to return prices and availability.

There is no human advisor behind your trip. There is no team reviewing the itinerary, no one booking on your behalf and no ticket queue where somebody reads your conversation. If that ever changes, this page will say so on the same day.

And when that day comes, it is worth knowing what it means: a human advisor who reviews your trip sees the whole trip — the days, the activities, your private notes and the conversation — because a trip cannot be reviewed without looking at it. That person would then be another subprocessor and would be added to the subprocessors list. That list is empty today because that advisor does not exist today.

The full list of providers that process data on our behalf is published and versioned in the project repository, in the subprocessors document. Each entry states what the provider does, what data it receives, which country it processes it in and where its privacy policy lives.

If we add a new subprocessor we update that list before we start sending it data. If a subprocessor is no longer needed we stop sending it data and remove it from the list.

Some of the providers we work with are outside the European Economic Area. When that is the case, the transfer relies on the European Commission's Standard Contractual Clauses, in the GDPR module, and on an assessment of the level of protection in the destination country.

When a provider offers its own compliance mechanism (for example an EU company agreement or an equivalent level of protection), we use it as a complementary basis.

If a specific provider is in a country without an adequate level of protection, we say so in the subprocessors document and we apply additional measures, such as minimising the data sent or pseudonymising it.

You can exercise the following rights over your data: access (knowing what we hold and getting a copy), rectification (correcting anything inaccurate), erasure (deleting your account and everything in it), restriction (asking us to suspend processing in a specific case), objection (objecting to processing based on legitimate interests), portability (taking your data in a machine-readable format) and withdrawal of consent (revoking any consent you gave for cookies that require it).

We do not charge for exercising them and we do not make your account conditional on using them. The quickest route is the privacy page of your account: you can export your data, delete your account or delete a single trip with one click, without writing to anyone.

If you have lost access to your account, you can request deletion by email. We verify the identity of whoever writes before deleting anything: we send you a single-use link that expires in fifteen minutes. We reply within thirty days at the most, and we tell you if we need anything else to handle the request.

We keep an internal record of rights requests with their resolution date. That is how we can demonstrate compliance if an authority ever asks.

The retention table is the same one that the purge job applies every night. If a rule in this policy and the code disagree, that is a bug and we fix it. The full table, including the technical side, is in the retention document in the project repository.

One important note: when you delete a trip, its content (days, activities, messages, notes and revisions) is deleted immediately. The only thing that remains is an empty marker, with no title, no dates and no trip data, for twelve months; when that period ends, the purge job deletes it too. That marker exists so we can demonstrate to an authority that the erasure was honoured, and it contains nothing of yours.

We only use technical cookies, the ones needed for the site to work: keeping the session, remembering your language, remembering the identifier of a visitor who has not registered and storing your consent when there is consent to store. The cookie policy describes one by one the ones that exist today, with their name, their duration and their purpose.

No analytics or marketing cookies are active. If there ever are, they will be asked for in a prior and explicit way and will stay switched off until you accept them.

The service is meant for people over sixteen. It is not a product for minors and we do not adapt it to their use: if we detect an account with data suggesting it belongs to a minor, we close it and delete its data.

If a minor has created an account, tell us through the legal notice and we will delete it together with all its content, without you having to argue about it.

If the product changes in a way that affects how data is processed, we update this policy and the date at the top. Changes that substantially affect your rights are announced in the app before they apply.

For any privacy question you can write to the support address listed in the legal notice. To exercise a right, use the privacy page of your account or the no-account request procedure described there.