Privacy Policy

This policy explains which personal data Plan Your Trip (planyourtrip.eu, "the app") processes, why, on what legal basis, and what rights you have under the EU General Data Protection Regulation (GDPR).

1. Who is responsible

Controller: Plan Your Trip
Email: info@planyourtrip.eu

2. What we process and why

• Account: name and email address. With a password, we store only a salted hash (PBKDF2), never the password. With Google sign-in, we also receive your profile picture and Google account ID; we request only the basic openid, email and profile permissions and never access Gmail, Drive, contacts or other Google data. Purpose: providing your account. Legal basis: contract, Art. 6(1)(b) GDPR.
• Your content: trips, days, places, notes, flights, lodging, expenses, uploaded photos, and the optional business profile (name, logo, phone, WhatsApp, contact email, website). Contract, Art. 6(1)(b).
• Shared pages and comments: anyone with a trip's secret link can view it. Comments sent from it contain the name the visitor writes (optional), the message, and a one-way hashed, daily-changing fingerprint of the IP address used only against spam; the IP itself is not stored. Contract with the trip owner and our legitimate interest in preventing abuse, Art. 6(1)(b) and (f).
• Emails: we send service emails from info@planyourtrip.eu: email confirmation, password reset, a welcome email, and notifications about your account (client comments, payments, end of the free trial, invited friends). You can turn off notification emails on the Notifications page. We do not send newsletters or advertising without your consent. Contract, Art. 6(1)(b).
• AI assistant: when you use it, your messages and the trip details needed to answer (destination, dates, flight and accommodation times, place names) are processed by Cloudflare Workers AI to generate suggestions. Conversations are stored with the trip and deleted with it. Contract, Art. 6(1)(b).
• Subscription and payments (Pro): plan, status, renewal date, card brand and last 4 digits, and amounts paid, received from our payment provider. We never see or store full card numbers. Payment records are kept as tax law requires. Contract and legal obligation, Art. 6(1)(b) and (c).
• Invite a friend: which account invited which, to grant the reward. Contract, Art. 6(1)(b).
• Technical data: to deliver and protect the website, our host Cloudflare processes IP addresses, browser information and request data. Legitimate interest in a secure, working service, Art. 6(1)(f).

3. Cookies and local storage

We use only technically necessary storage, so no consent banner is needed: sid (keeps you signed in, 30 days), oauth_state and ulang (during Google sign-in, a few minutes), ref (remembers an invite link you opened, 30 days), and the browser's local storage for your language and interface texts. We use no analytics, advertising or tracking cookies. Fonts and icons are served from our own domain.

4. Recipients and service providers

• Cloudflare, Inc.: hosting, database, Workers AI, DNS and email routing (processor).
• Resend (Plus Five Five, Inc.): sending our emails (processor).
• Lemon Squeezy, LLC: our reseller and merchant of record. It processes card, billing and tax data as an independent controller under its own privacy policy.
• Google: only if you choose to sign in with Google.
• Map and place data: map tiles and some photos are loaded by your browser directly from OpenStreetMap and Wikimedia, which therefore see your IP address. Our server sends only search terms, coordinates or text to Nominatim, Photon, Wikipedia, Wikidata, Openverse, Mapillary, MyMemory (translation fallback) and AirLabs (flight lookup), never your account details.

We do not sell personal data, show ads, or use data for profiling.

5. Transfers outside the EU

Some providers (Cloudflare, Resend, Lemon Squeezy, Google) are based in the United States. Transfers rely on the EU–U.S. Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses.

6. How long we keep data

Account data and content: while the account exists; deleting a trip deletes its days, places, flights, lodging, expenses, comments and AI conversations. Sessions: 30 days. Email confirmation links: 3 days; password reset links: 1 hour. After you delete your account, everything is removed immediately, except payment records without your name or email, kept as long as tax law requires.

7. Your rights

You have the right to access, rectify and erase your data, to restrict processing, to data portability, and to object to processing based on legitimate interest (Art. 15–21 GDPR). Write to info@planyourtrip.eu. You can delete your account yourself at any time: see Delete your account. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work.

8. Children

The app is not directed at children under 16. Do not create an account if you are younger.

9. Security

All traffic uses HTTPS. Passwords and session tokens are stored only as hashes. Access to every trip is checked against its owner on each request.

10. Changes

We will update this page when the way we handle data changes. Last updated: 27.10.2026.