Privacy Policy

1.1 This Privacy Policy explains how ChatYourTrip ("we", "us", or "our"), the operator of chatyourtrip.com, collects, uses, stores, and protects your personal data when you use our Service.

1.2 ChatYourTrip is the data controller for the personal data processed through the Service. If you have any questions about this Privacy Policy or about how we handle your personal data, please contact us at info@chatyourtrip.com.

1.3 We do not have a designated Data Protection Officer. For all data protection enquiries, please use the contact address above.

2.1 This Privacy Policy applies to all users of the Service, including visitors to chatyourtrip.com and registered Account holders, regardless of their country of residence.

2.2 This Privacy Policy should be read together with our Terms of Service, available at chatyourtrip.com/terms.

3.1 Account registration data. When you create an Account, we collect your name, email address, and a hashed version of your password (we never store your password in plain text). If you register using Google OAuth, we receive your name, email address, and Google account profile information from Google.

3.2 Trip and itinerary data.When you use the Service to generate a trip itinerary, we collect the information you provide, which may include your destinations, travel dates, budget, interests, pacing preferences, accommodation type, number of travellers, traveller type, children's ages, dietary restrictions, departure and return cities, occasion, must-visit places, and any additional wishes you choose to share.

3.3 Usage and technical data. We collect certain technical data in the ordinary course of operating the Service, including your IP address, which is used for in-memory rate limiting on our AI and chat endpoints to protect the Service against abuse. IP addresses are held in server memory only and are not persisted to our database; they are lost when the server process restarts.

3.4 AI response insights. We store aggregated insights derived from AI-generated responses in our database to help us understand and improve the Service. We do not log the prompts you send to the Service on our side. Your trip data and preferences are transmitted to Google Gemini AI for the purpose of generating itineraries; Google may retain this data under its own policies, as described in Section 7.

3.5 Analytics data. We use Google Analytics and Google Search Console to collect information about how users interact with the Service, including pages visited, session duration, and general usage patterns. This data is collected through cookies and similar technologies, as described in Section 9.

3.6 Communications data. If you contact us by email, we retain records of that correspondence.

We process your personal data only where we have a valid legal basis under the GDPR. The table below sets out our processing activities and the legal basis for each.

4.1 Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms and are satisfied that our interests are not overridden. You have the right to object to processing based on legitimate interests; see Section 11.

4.2 Where we rely on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

5.1 We may from time to time send you marketing emails or newsletters about new features, travel inspiration, or updates to the Service. We will only do so if you have given your consent.

5.2 You may withdraw your consent and unsubscribe from marketing communications at any time by clicking the unsubscribe link in any marketing email or by contacting us at info@chatyourtrip.com.

5.3 Withdrawing your consent to marketing communications will not affect your ability to use the Service.

6.1 ChatYourTrip participates in affiliate programmes. Some booking links in the Service - for example hotels, flights, car hire and eSIMs - are affiliate links, and we may earn a commission if you book through them. This never changes the price you pay.

6.2 Our current affiliate partners are Booking.com (via CJ Affiliate), Trip.com, Trivago (via AWIN) and Saily (via Daisycon). When you click one of these links you leave ChatYourTrip and the partner or its affiliate network may set cookies and record the click, in line with their own privacy policies. We pass only a placement label identifying which part of our Service the link was clicked from, so we can see which pages are useful. We do not pass your name, email address or itinerary content.

6.3 These links are marked with rel="sponsored" and open in a new tab. You are never required to use them, and you can book directly with any provider instead.

7.1 We share your personal data with the following third-party processors, who process data on our behalf solely for the purposes described:

7.2 All processors are required to process your data only on our documented instructions and in accordance with applicable data protection law.

7.3 We do not sell your personal data to third parties.

8.1 Some of our third-party processors may be located outside the European Economic Area (EEA), or may process your data on servers located outside the EEA. In particular, Google (Gemini AI, Maps, OAuth, Analytics), Vercel, Resend, and possibly Supabase may process data in the United States or other non-EEA countries.

8.2 Where personal data is transferred outside the EEA, we ensure that appropriate safeguards are in place in accordance with Chapter V of the GDPR. We rely on the EU Standard Contractual Clauses (SCCs) adopted by the European Commission, which are incorporated by reference into the data processing terms of our processors. You may request further information about the specific safeguards applicable to any transfer by contacting us at info@chatyourtrip.com.

8.3 The European Commission has published the current SCCs at ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en.

9.1 We use cookies and similar tracking technologies on the Service. A cookie is a small text file stored on your device by your browser.

9.2 We use the following categories of cookies:

9.3 When you first visit the Service, we will ask for your consent before placing any non-essential cookies. You can update your cookie preferences at any time through the cookie settings on the Service or through your browser settings.

9.4 For information about how Google uses data collected through its cookies and services, please refer to Google's Privacy Policy at policies.google.com/privacy.

10.1 Active accounts. We retain your personal data for as long as your Account is active.

10.2 Account closure. Upon closure of your Account, we will delete your personal data within thirty (30) days, subject to the exceptions in Section 10.5.

10.3 Inactive accounts. If your Account has been inactive for twenty-two (22) months, we will send you an email warning that your Account will be deleted if you do not log in within the following two (2) months. If no login activity is recorded within twenty-four (24) months of your last login, your Account and associated personal data will be deleted in accordance with this Policy.

10.4 Specific data types:

• IP addresses: held in server memory only for the duration of the current server session; not persisted to our database.
• Transactional email logs: retained by Resend for approximately thirty (30) days in accordance with Resend's default data retention policy.
• Analytics data: retained in accordance with Google Analytics' data retention settings, which we have configured to the minimum available period.

10.5 Exceptions. We may retain certain data beyond the periods above where required or permitted by applicable law, including for the establishment, exercise, or defence of legal claims, or compliance with a legal obligation under EU or Dutch law.

10.6 Anonymised data. We may retain anonymised and aggregated data derived from your use of the Service indefinitely, provided it cannot be used to identify you directly or indirectly.

11.1 As a data subject under the GDPR, you have the following rights:

• Right of access (Art. 15): You may request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): You may request that we correct inaccurate or incomplete personal data.
• Right to erasure (Art. 17): You may request that we delete your personal data, subject to applicable legal exceptions.
• Right to restriction (Art. 18): You may request that we restrict processing of your personal data in certain circumstances.
• Right to data portability (Art. 20): You may request a copy of your personal data in a structured, commonly used, machine-readable format. Portability requests should be submitted before closing your Account, as we cannot retrieve data after deletion.
• Right to object (Art. 21): You may object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

11.2 To exercise any of these rights, please contact us at info@chatyourtrip.com. We may ask you to verify your identity before processing your request, in order to protect your data. We will respond within thirty (30) days of receiving your request.

11.3 You also have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens (AP), at www.autoriteitpersoonsgegevens.nl, or with the supervisory authority in your country of residence within the EU.

11.4 Account deletion. You may delete your Account at any time through the account settings in the Service, or by contacting us at info@chatyourtrip.com.

12.1 The Service is not directed at children under the age of sixteen (16). We do not knowingly collect personal data from anyone under 16 years of age.

12.2 If we become aware that we have collected personal data from a user under 16 without verifiable parental or guardian consent, we will take steps to delete that data promptly. If you believe we may have collected data from a child under 16, please contact us at info@chatyourtrip.com.

13.1 We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These measures include:

• passwords hashed using bcrypt with a high security cost factor;
• all data transmitted over HTTPS (enforced by our hosting provider);
• session tokens stored in HTTP-only cookies, inaccessible to client-side scripts;
• email verification required before Account activation;
• rate limiting on AI and chat endpoints to prevent abuse.

13.2 No method of transmission or storage is completely secure. While we strive to protect your personal data, we cannot guarantee absolute security.

14.1 The Service may contain links to third-party websites or services, including Google Maps. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party services you access through the Service.

15.1 We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated Policy on the Service, updating the "Last updated" date at the top, and where required by applicable law, sending you an email notification before changes take effect.

15.2 Your continued use of the Service after the effective date of any update constitutes your acceptance of the revised Privacy Policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact us at:

ChatYourTrip - Email: info@chatyourtrip.com