Privacy Policy

1. Who is responsible

Spunova · Oscar A. Carrasquero Z., Prager Str. 8, 60437 Frankfurt am Main, Germany. Contact for anything about your data: hello@spunova.com.

2. What we process

• Your account: email address and name, from your Google account or the email you enter.
• Your trip: destination, dates, names and drawn avatars of the travellers, your answers and your own ideas, the plan and any changes you ask for.
• Your group: who is a member, the notes and comments they write, and the photos they add. Photos are shrunk in your browser before upload, which removes location data stored in the file.
• Notifications in the Android app: if you turn them on, a notification token for your phone, so the app can tell you about new notes, photos and finished trips. It is deleted when you sign out, delete your account or the token stops working.
• Technical data: Google’s servers record IP addresses and requests in logs when pages load. We also keep counts of page visits, with no cookie and no identifier. Only if you tick it, Google Analytics also measures your visits (section 5).

3. Why, and on what legal basis

• To provide the service you asked for: Art. 6(1)(b) GDPR.
• To keep it secure, prevent abuse and understand how it is used, through counts and anonymous statistics: our legitimate interest, Art. 6(1)(f) GDPR.
• Google Analytics, only if you tick it: your consent, Art. 6(1)(a) GDPR, which also covers its cookies on your device.
• Optional answers that can reveal health or beliefs, such as reduced mobility or dietary needs: only to plan your trip, with your consent when you choose them, Art. 6(1)(a) and 9(2)(a) GDPR. You can withdraw it at any time, which doesn’t affect what was done before. Please don’t put other sensitive details in your ideas or notes.

4. Where your data is, and how it is protected

Your trips, accounts’ records and photos are stored in Europe, on Google Cloud: the database in its European multi-region, and photos and our server functions in Belgium.

All connections use HTTPS encryption, and Google encrypts stored data. Encryption is not end-to-end: the service has to read your trip to work, and we can access it when needed to run or fix the service.

Some processing can happen outside Europe. See section 5. We take reasonable steps to protect your data, on a best-effort basis, but no system is completely safe and we can’t guarantee that nothing will ever go wrong.

5. Who else receives data

• Google (Google Cloud and Firebase) hosts and runs the service as our processor, including sign-in, delivering the site and the Android app’s notifications, which can involve servers outside Europe.
• Google’s Gemini AI on Vertex AI receives your trip answers and restated ideas to write the plan and texts. This uses Google’s global service, so it can be processed outside Europe. We ask Google not to keep these requests after the call.
• Place data services receive the names and towns of the places in your plan, not who you are: Google Places, Wikidata, OpenStreetMap, Wikimedia Commons, and the official sites of those places. Open-Meteo receives town coordinates for the forecast.
• Photos, forecast, map and music on trip pages: only after you allow outside services, or tap to open one section. Then your browser connects directly to Wikimedia Commons, Unsplash, Open-Meteo, Google Maps or Spotify, which receive your IP address, and some may set their own cookies. Fonts come from our own site.
• Google Analytics, only if you tick it under Privacy choices at the bottom of the page: Google receives your IP address, the pages you open, your browser and device type, and sets cookies (_ga) that recognise your browser for up to two years. For trips and invitations it gets only the page type, not the link, the trip’s name or who is in it. We turned off Google signals and advertising features. Google can process this outside Europe.

Transfers outside the EU rely on the safeguards Google provides, such as EU Standard Contractual Clauses.

6. Anonymous statistics, partners and advertisers

We may share or publish anonymous, grouped statistics with third parties, including partners and advertisers. For example: how many trips go to a destination, how long they usually last, or which interests are popular.

These can’t identify you or your trip. We don’t give advertisers your name, email, trips, notes or photos, and the site has no advertising cookies today. If that changes, we will update this page first and ask for your consent where the law requires it.

7. Cookies and browser storage

We use no advertising cookies. Your browser stores what the app needs to work: your sign-in, your language, your privacy choices and your unfinished answers. Analytics cookies are set only if you tick Google Analytics. Unticking it under Privacy choices at the bottom of the page stops it and removes those cookies. Google Maps and Spotify may set their own cookies, as section 5 explains.

8. How long we keep data

Accounts and trips stay until you ask us to delete them, or until we close the service. Server logs are normally kept for about 30 days, and Google Analytics keeps its detailed data for 14 months. Anonymous statistics can be kept, as they no longer relate to anyone.

9. Your rights

• To delete your data: use “Delete my account” on My trips, in the app or on the website. It deletes your account and the trips you created at once, including the group’s photos and notes in them, and what you added to other people’s trips. Please tell your group first, as they lose access too. You can also write to hello@spunova.com from your account’s email address, and we do it without delay, within one month at the latest. Files you exported yourself stay with you.
• To get a copy of your data, correct it, limit or object to its processing, and to take it with you: Art. 15 to 21 GDPR.
• To withdraw any consent, at any time.
• To complain to a data protection authority: yours, or ours: Hessischer Beauftragter für Datenschutz und Informationsfreiheit (HBDI) (https://datenschutz.hessen.de).

10. Who can use it

The service is for people aged 16 or over. Please add other people’s names and photos only if they agree.

11. Automated decisions

AI writes your plan, and it checks text you type before use. It makes no decisions with legal or similarly important effects on you. If it refuses your text, you can change it and try again.

12. Changes

If what we do with data changes, we will update this page and its date, and tell you about important changes on the site or by email.