Privacy policy

1. Who is responsible

• Controller: to be completed
• Tax ID: to be completed
• Address: to be completed
• Email for any privacy matter: [email protected]

2. What data we handle

• Your account: name, email, password (stored hashed, never in plain text), language, time zone, country of residence, currency and, if you upload one, your photo.
• Your trips and bookings: flights, stays, transport, activities and restaurants, with their dates, places, booking codes, prices, notes and expenses, and the people you invite to each trip.
• Documents you upload (tickets, vouchers, passes) and any personal documents you choose to keep, stored separately and optionally protected with a PIN. We never ask you to upload your passport.
• Of your passports and visas, only the nationality (or the visa's country) and the expiry date you add in Settings, to warn you about entry requirements and expiry. We don't ask for or keep the passport number or any image of it.
• Booking emails you forward to your Tripviator address, to turn them into events in your trip.
• Technical data: IP address, device and browser type, open sessions and, if you turn on alerts, your phone's or browser's notification subscription. The approximate country you connect from (worked out from the IP) is only used to show the site in your language; we don't store it.
• We don't access your device's GPS location: the places and coordinates you see are those of your bookings.

3. Why we use it and on what legal basis

• To provide the service you ask for: keeping and showing your trips, reading the bookings you forward, tracking your flights, giving you each day's weather, alerting you to changes, check-in and your documents, and sharing what you choose. Basis: performance of the contract you accept when signing up (Art. 6.1.b GDPR).
• To keep Tripviator secure: preventing unauthorised access and abuse, and fixing problems. Basis: our legitimate interest in protecting the service and its users (Art. 6.1.f GDPR).
• To answer you when you write to us. Basis: your request and our legitimate interest in replying.
• To meet legal obligations where they apply (for instance, requests from authorities). Basis: legal obligation (Art. 6.1.c GDPR).
• To load third-party services in your browser that may use their own cookies (Google Maps). Basis: your consent, which you can withdraw in "Cookie settings".
• We don't use your data for advertising, don't sell it, don't build commercial profiles and don't make automated decisions with legal effects on you.

4. Who we share it with

Only with providers we need for Tripviator to work, acting on our behalf (processors) and receiving only what's essential:

• Hosting and storage for the app, its database and your files.
• AeroDataBox (via RapidAPI): flight number and date, to track the flight's status.
• Open-Meteo: coordinates of your trip's places, for the weather forecast.
• Google Maps Platform: place search, addresses and travel times. In your browser it only loads if you accept it in the cookie settings.
• MapTiler and Stadia Maps: the maps you see (they receive your IP address when loading them).
• Notification services: Expo for the phone app and your browser's push service (Google, Mozilla or Apple), only if you turn alerts on.
• Cloudflare and our inbound email provider: to receive the emails you forward.
• An artificial intelligence provider (Anthropic), to read the bookings in the emails and documents you send us. It doesn't use them to train its models.
• People you share a trip with see what that trip contains. Public links never include prices, booking codes or attachments.

5. Transfers outside the European Economic Area

Some of these providers are in the United States or other countries. Where that's the case, the transfer relies on the EU-US Data Privacy Framework or on the Standard Contractual Clauses approved by the European Commission.

6. How long we keep it

• As long as your account is open.
• The content of emails you forward is deleted 30 days after we receive it; what we extracted stays in your trip until you delete it.
• If you delete your account from Settings, your data is removed right away (backups roll over within 30 days at most), except what we must keep by law, which is blocked for the period the law requires.
• Technical and security logs, only as long as their purpose needs.

7. Your rights

You can ask us at any time to access, correct or delete your data, to object to or restrict its use, or to receive it in a portable format, and you can withdraw any consent you've given. You can download your data or delete your account yourself in Settings → Your data and account; for anything else, write to [email protected] from your account's email address; we'll reply within one month at the latest.

If you think we haven't handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es) or the authority in your country.

8. How we protect it

• Encrypted connections (HTTPS) and hashed passwords.
• Two-step verification available for your account.
• Personal documents kept separately and protected by your PIN.
• Support staff access is limited and logged, and when they view your account to help you, it's read-only.

9. Children

Tripviator is meant for people aged 14 and over. If you're younger, you need your parents' or guardians' consent to use it.

10. Changes to this policy

If we change anything important, we'll tell you in the app or by email before it applies. The date of the last update is at the top of this page.