Privacy policy

Who is responsible

TripValise is the data controller for the data described here. Write to support@tripvalise.eu about anything on this page.

What we store

• Your account: your name, email address, and password, which is stored only as a one-way hash.
• Your trips: everything you add: titles, dates, places with their addresses and map positions, stays, transport, activities, notes, prices, and the PDFs you upload.
• Sign-in sessions: a session record with the IP address and browser it was opened from, kept until you sign out or it expires.
• Codes and links: confirmation codes and password-reset links are stored only in scrambled form and expire (codes after 10 minutes, reset links after 30 minutes).
• Assistant connections: when you connect an assistant such as ChatGPT, which assistant you allowed, what it may do, and its access tokens, which expire or are revoked when you disconnect.
• Security records: short-lived counters by IP address or email address that limit repeated attempts, and server logs that hold only account and trip IDs, event names, and counts — never your email, notes, places, or files.

We do not sell your data, show ads, or use your trips to train AI models.

Why we use it

• To provide TripValise: your account, your trips, and the assistant connections you approve. The legal basis is our contract with you (GDPR Art. 6(1)(b)).
• To keep the service secure and working: limiting abuse, investigating errors, and counting page views without cookies. The legal basis is our legitimate interest in a safe, reliable service (Art. 6(1)(f)).

Who helps us run it

These providers process data for us, only as needed for their part:

• Vercel hosts the app (servers in Dublin, Ireland) and provides cookie-free page-view and speed statistics.
• MongoDB Atlas stores the database, including PDFs, on Amazon Web Services in Ireland.
• Mailjet sends confirmation and password-reset emails to your address.
• Geoapify receives the place names you search for, from our server, without your account details.
• Mapbox draws the map; your browser loads map images from Mapbox, which sees your IP address.
• Wikimedia supplies free place photos; our server looks up place names, and your browser loads the photos from Wikimedia.
• Frankfurter supplies exchange rates; it receives no personal data.

Vercel and Mapbox are US companies. Transfers outside the European Economic Area rely on the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

ChatGPT: if you connect ChatGPT, it reads and changes your trips only as you ask it to in a chat and only with the permission you gave on the Allow page. What you share in ChatGPT is handled by OpenAI under its own privacy policy. You can disconnect at any time in ChatGPT; changing your password also disconnects every assistant.

Cookies and storage on your device

• One sign-in cookie keeps you signed in. It is strictly necessary, so it needs no consent. There are no advertising or tracking cookies.
• Page-view and speed statistics are collected without cookies and without following you across sites.
• When you keep a trip for offline use, a copy of it and its PDFs is stored in your browser on that device only. Signing out removes it.
• Your browser also remembers a map display preference and stores the app’s public files so it can open offline.

How long we keep it

• Your account and trips stay until you delete them. A deleted trip, stay, activity, or PDF is removed from the database at once.
• To delete your whole account and everything in it, write to support@tripvalise.eu from the address you sign in with. We delete it within 30 days, usually sooner.
• A registration that is never confirmed loses its code and chosen password after 7 days; its name and email address stay until you confirm it or ask us to remove them. Sessions end when you sign out or after a period without use. Security counters last at most a day; server logs are kept for a short time by Vercel.
• Backup copies of the database, if any, are deleted within 30 days.

Your rights

You can ask to see, correct, export, or delete your data, to restrict or object to how we use it, and you can withdraw any permission, such as an assistant connection, at any time. Write to support@tripvalise.eu; we answer within one month. You can also complain to the data protection authority where you live or work.

Children

TripValise is not directed at children under 16.

Changes

If this policy changes, we update this page and its date. For a significant change, we tell account holders by email before it applies. See also the terms of use.