Privacy policy
Last updated: 1 October 2026
This policy explains which personal data EasyTrip (easytripsaas.com) processes, why, for how long and what your rights are, under Articles 13 and 14 of EU Regulation 2016/679 (GDPR).
If the language versions differ, the Italian version prevails.
Data controller
The controller's identification details and the address for privacy requests are being published.
Which data we process, why and on what legal basis
Account: email, name, preferred language
- Why we use it:
- Create your account and let you sign in
- Legal basis:
- Performance of the contract (Art. 6.1.b)
Trip: destination, dates, trip type, budget, style you write
- Why we use it:
- Generate and show the itinerary
- Legal basis:
- Performance of the contract
Preferences: interests, pace, stroller
- Why we use it:
- Tailor the itinerary
- Legal basis:
- Performance of the contract
Dietary restrictions and health-related mobility needs
- Why we use it:
- Choose suitable restaurants and stops
- Legal basis:
- Explicit consent (Art. 9.2.a), see below
Group: trip members, shared expenses, votes on alternatives
- Why we use it:
- Split expenses and decide together
- Legal basis:
- Performance of the contract
Payments: amounts, status, Stripe customer ID
- Why we use it:
- Collect payments, issue refunds, meet tax obligations
- Legal basis:
- Performance of the contract; legal obligation (Art. 6.1.c)
Approximate location (about 110 m), only when you ask for an alternative or an on-the-spot suggestion
- Why we use it:
- Suggest places near you
- Legal basis:
- Performance of the contract. The location is not stored
Service emails; promotional emails only if you turn them on
- Why we use it:
- Payment and trip notices; reminders and offers
- Legal basis:
- Performance of the contract; consent (Account → Privacy)
Messages to support (chat or support requests)
- Why we use it:
- Answer your requests
- Legal basis:
- Performance of the contract
Usage events and visited pages, only if you accept analytics cookies
- Why we use it:
- Understand how to improve the service
- Legal basis:
- Consent (Art. 6.1.a)
Technical data: IP address, logs, abuse counters
- Why we use it:
- Security and abuse prevention
- Legal basis:
- Legitimate interest (Art. 6.1.f)
Links to partners (for example to book) lead to websites that process your data as independent controllers: EasyTrip only records the click.
The itinerary is generated by an artificial intelligence system: it is a suggestion, and opening hours, closures and ingredients should be checked on site. We do not make automated decisions that produce legal effects on you.
Travel preferences and special categories of data
Optional. Preferences are only used to build your itinerary: without them, the trip works just the same.
Special categories. Dietary restrictions (vegetarian, vegan, gluten-free, lactose-free, halal, kosher, allergies) and mobility needs such as "I walk little", "I avoid stairs" or a wheelchair may reveal health data or religious beliefs: they are special categories of data (Art. 9 GDPR). We only process them with your explicit consent, which you give by ticking the dedicated box when you choose them, and we record the date of your consent.
Withdrawal. You can withdraw your consent at any time by removing these preferences from the trip: from then on they are no longer used and the consent date is deleted.
How we use them. They are sent to the artificial intelligence model provider together with the trip data, only to generate the itinerary, replace a stop or give you an on-the-spot suggestion.
Limits. Whether a restaurant suits a diet is stated by the artificial intelligence and is not guaranteed: unconfirmed places are marked "to be checked". For allergies we never mark a place as safe: always check with the restaurant.
What we don't do. We don't send them to analytics tools or write them in logs (at most we record how many you chose), and we don't use them for profiling or advertising. The organiser and the trip members can see them; they are part of your data export and are deleted with the trip.
Providers and transfers outside the EU
These providers process data on EasyTrip's behalf as processors (Art. 28 GDPR), each only for its own service.
Anthropic
- Service:
- Artificial intelligence model (itineraries, replacements, suggestions)
- Data it receives:
- Trip data, preferences (including special categories, if you entered them), approximate location
- Where:
- USA
Vercel
- Service:
- App hosting, performance statistics
- Data it receives:
- IP address, technical logs
- Where:
- Functions run in the EU (Paris); company based in the USA
Neon
- Service:
- Database
- Data it receives:
- Account and trip data
- Where:
- EU (Frankfurt)
Clerk
- Service:
- Sign-up and sign-in
- Data it receives:
- Email, name, sessions
- Where:
- USA
Stripe
- Service:
- Payments
- Data it receives:
- Payment data (the card is handled only by Stripe)
- Where:
- EU and USA
Resend
- Service:
- Email delivery
- Data it receives:
- Email address, message content
- Where:
- USA
Inngest
- Service:
- Background processes (generation, reminders)
- Data it receives:
- Trip data, preferences and generated itinerary, as temporary process state
- Where:
- USA
Upstash
- Service:
- Abuse limits
- Data it receives:
- User ID or IP address
- Where:
- EU or USA
PostHog
- Service:
- Usage analytics, only with your consent
- Data it receives:
- Usage events, identifier, IP address
- Where:
- EU
Crisp
- Service:
- Support chat, only when you open it
- Data it receives:
- Messages, email if you provide it, IP address
- Where:
- EU
CARTO
- Service:
- Map images
- Data it receives:
- Your device's IP address
- Where:
- EU, with a global delivery network
When data is processed outside the European Economic Area, the transfer relies on the safeguards of Articles 44-49 GDPR: an adequacy decision (EU-US Data Privacy Framework, for certified providers) or the European Commission's standard contractual clauses.
The search for verified places sends only the destination name to the artificial intelligence provider, never personal data.
How long we keep data
Account
- How long:
- Until you delete it from Account → Privacy (coordinated deletion of database, payments and sign-in)
Trips, with preferences and restrictions
- How long:
- As long as they stay in your account; a deleted trip is permanently erased after 90 days
Earlier versions of an itinerary
- How long:
- 365 days from generation
Date of consent to special-category preferences
- How long:
- As long as those preferences stay in the trip
Payment records
- How long:
- 10 years, for tax and accounting obligations
Technical logs
- How long:
- For a limited period, according to the hosting providers' settings
Your rights
You can request access to your data, rectification, erasure, restriction and objection to processing, and withdraw consent at any time, without affecting processing already carried out.
Portability is immediate: from Account → Privacy you can export your data as a JSON file and delete your account.
For everything else write to the address above: we reply within one month.
You can also lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or the authority of your country.
Minimum age
The service is intended for adults.
Changes
We publish every update here, with the date at the top; for significant changes we notify you by email.