Privacy Policy

Travessa plans trips with you. To do that it has to know where you're going, when, and who with. This page says what we keep, why, who else sees it, and how to have it removed. We've written it to the standard of the EU's General Data Protection Regulation (GDPR), and we apply that standard to everyone, wherever they live.

Who we are

Travessa is run by Alejandro Gonzalez, Amsterdam, the Netherlands. We are the "controller" of your personal data: we decide what is collected and why. We haven't appointed a data protection officer, as the law doesn't require one for a service of our size.

For anything about your data, write to hello.travessa@gmail.com. We answer within one month, and usually much sooner.

What we keep

Your account. When you sign in with Google, we receive your name, your email address and an identifier Google gives us. We don't receive your Google password, and we don't see your Google contacts, mail or files. When you sign in with a code sent to your email instead, we receive only your email address. There are no passwords.

Your profile. The name you'd like the assistant to call you, the name you gave the assistant, and how you usually travel: pace, walking, early mornings, daily budget and how much each interest matters to you.

Your trips. For each trip:

• where it goes and where it sets off from
• its dates
• who's travelling: the kind of group (solo, couple, friends, family), how many adults, how many children under 13, and whether you're bringing a pet
• your preferences for that trip
• the itinerary: days, stops, times and journeys between them
• the places you've saved, and any notes you add to them

We don't ask for or keep children's names, ages or birthdays: only how many are on the trip, so the plan suits them.

What you type to the assistant. The text you put into the planning box or the assistant bar is sent to our AI provider (see below) to produce an answer or a change to your trip. The changes you accept become part of your trip. We don't keep a separate record of your conversations.

On your device. Signing in sets cookies that keep you signed in, and one more holds your time zone (for example "Asia/Bangkok"), so "today" in your trip is your today rather than our server's. While you move from the planning box to the first question, your browser briefly holds what you typed there, and forgets it once the page has read it. Both are needed for the app to work, so the law doesn't require your consent for them. We use no advertising, analytics or tracking cookies, so there's no cookie banner to dismiss.

Server logs. Like any website, our host briefly keeps technical records of requests (IP address, browser type, time, the page requested) to keep the service running and secure. We also record how much text each AI request used, but not what it said. When a request fails, the error record can include a short excerpt of it (a stop's name, say, or part of the assistant's reply), so we can find and fix the fault.

What we don't collect. We don't use your device's location. We don't collect payment details. We don't sell your data, share it with advertisers, or build an advertising profile of you.

Please leave out sensitive details

Travessa doesn't need to know about your health, religion, sexuality, politics or anything similar, and there's nowhere in the app that asks. If you choose to mention something like that to the assistant (an accessibility need, say), we use it only to plan the trip you asked for, in the same way as everything else you type, and it's deleted with the trip. If you'd rather it weren't processed at all, leave it out.

Do you have to give us this?

No law requires you to give us anything. But Travessa can't plan a trip without a destination, and can't keep your trips for you without an account. If you'd rather not share something optional (who's travelling, your interests, your budget), skip it: the plan will just be more general.

Why we keep it, and on what legal basis

• Your account, profile, trips and saved places, to plan, show and change your trips: the service you asked for. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
• What you type to the assistant, to answer you and change your trip when you ask. Legal basis: performance of a contract (Art. 6(1)(b)).
• The time-zone cookie and the planning box's temporary copy, to make the app work. Legal basis: performance of a contract (Art. 6(1)(b)); strictly necessary, so no consent is required.
• Server logs and error reports, for security, preventing abuse and fixing faults. Legal basis: our legitimate interest in a working, secure service (Art. 6(1)(f)). Logs are short-lived and never used for anything else.
• Records of requests you make to us (for example to delete your data), to show we handled them. Legal basis: legal obligation (Art. 6(1)(c)).

Who else handles your data

We use a small number of services to run Travessa. Each one handles your data only on our instructions, under a data processing agreement, and may not use it for its own purposes.

• Neon (Neon, LLC, part of Databricks, Inc.), our database and sign-in provider. It holds everything listed under "What we keep", in Frankfurt, Germany (EU), and sends the sign-in codes to your email address.
• Anthropic, PBC, the AI that plans and changes trips, in the United States. It receives your trip and the places you've saved for it, your profile names and preferences, and what you type into the planning box and the assistant. Anthropic doesn't use what we send it to train its models. It deletes it within 30 days, unless its automated safety systems flag a request as breaking its usage policy, in which case it may keep that request for up to 2 years.
• Vercel Inc., which runs the website. The app itself runs in Frankfurt, Germany (EU); pages and images are delivered through Vercel's worldwide network. It handles every request, including server logs.
• Sentry (Functional Software, Inc.), which collects reports of errors in the app so we can fix them, stored in Frankfurt, Germany (EU). A report holds what went wrong, the page it happened on, the kind of browser and device, and your account's ID number. Never your name, your email address or your IP address.

Google plays two parts. Sign-in uses your Google account, so Google knows you used it to sign in to Travessa. And Travessa uses Google Maps features and content: maps, places, photos and travel times. To provide those, the names of places and the stops on a day's route are sent to Google. When a map or a photo is shown, your browser connects to Google directly, which gives Google your IP address. Google handles that data under its own Privacy Policy.

We may also disclose data if the law requires it, for example under a court order.

Data sent outside the EU

Your trips are stored in the EU. Anthropic, Google and Vercel are based in the United States, so what they receive may leave the EU. Neon and Sentry belong to US companies too, though they keep our data in the EU. Those transfers are protected by the EU–US Data Privacy Framework, where the company is certified, and otherwise by the European Commission's Standard Contractual Clauses. Data from the UK and Switzerland is protected by those countries' equivalents. You can ask us for a copy of the relevant safeguards.

How long we keep it

• Trips and saved places: until you delete them, or your account.
• Account and profile: until you delete your account.
• After deletion: removed from the live database at once, and gone from our database provider's backups within 7 days.
• Server logs: no more than a day, at our host.
• Error reports: 30 days, in Sentry.
• Place details from Google: coordinates are refreshed or deleted after 30 days, as Google's terms require.
• Inactive accounts: if you haven't signed in for 3 years, we'll email you, and delete the account if you don't reply within 30 days.

Your rights

Wherever you live, you can:

• see the data we hold about you, and get a copy (access)
• take it with you in a machine-readable file (portability)
• correct anything that's wrong (most of it you can edit in the app yourself)
• delete a trip at any time in the app, or your whole account by writing to us (erasure)
• object to, or ask us to restrict, how we use your data
• complain to a data protection authority: in the EU, the one where you live or work, or ours, the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). In the UK, the Information Commissioner's Office (ico.org.uk).

Write to hello.travessa@gmail.com. We may ask you to confirm the request comes from your account. It's free.

The assistant is an AI

The assistant in Travessa is an AI, not a person. It suggests plans; you decide what goes into your trip. We don't make decisions about you that have legal or similarly significant effects by automated means.

If you live in California or another US state with a privacy law

These laws may not apply to a service our size, but we follow them anyway.

In the last 12 months we have collected the kinds of information listed under "What we keep": identifiers (name, email), and the travel plans and preferences you give us. They come from you, and from Google when you sign in. We collect them for the purposes listed above and keep them for as long as described above.

We do not sell your personal information, and we do not "share" it for cross-context behavioural advertising, as California law defines those terms. We don't use sensitive personal information to infer characteristics about you.

You have the right to know what we collect, to have it deleted or corrected, and not to be treated differently for using these rights. Make a request at hello.travessa@gmail.com. An authorised agent may also make one on your behalf.

Children

Travessa is for adults. You must be 18 or older to create an account. Parents and guardians can include children in a trip, as a number only. If you believe a child has created an account, tell us and we'll delete it.

Security

Your data is encrypted between your device and us, and stored encrypted in our database. Access to it is limited to the people who run Travessa. If a breach puts your data at risk, we'll tell you, and the relevant authority, as the law requires.

Changes to this policy

If we change what we collect or who we share it with, we'll update this page and tell you in the app, or by email, before the change takes effect. The date at the top shows the latest version.