How Vanabout handles your data, under the GDPR. Controller: Wai Yue Kong, Leuchtkäfer (Einzelunternehmen), Auf Blehn 3, 54294 Trier, Germany — mail@leuchtkäfer.de.
| Data | Why | Legal basis |
|---|---|---|
| Email address | To sign you in (passwordless magic link) and to contact you about your trips. | Art. 6(1)(b) — performance of a contract |
| Your name | So the app can address you by name instead of your email. | Art. 6(1)(b) |
| Trip details you enter (start/end point, dates, who is travelling, vehicle, travel preferences) | To generate your itinerary. This text is sent to Anthropic's Claude API (see below). | Art. 6(1)(b) |
| Email submitted to the "make this trip yours" form | To tell you when editing becomes available. | Art. 6(1)(a) — consent (you can withdraw any time) |
| IP address and technical request data | Unavoidably processed by our hosting, database and map providers to deliver the site and defend against abuse. | Art. 6(1)(f) — legitimate interest |
These are the actual services this app uses. Some are outside the EU; where that is the case, transfers rely on the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework.
| Provider | Purpose | Where |
|---|---|---|
| Amazon Web Services (AWS Europe, Luxembourg) | Website hosting (Amplify) and the server that generates itineraries (Lambda). | Frankfurt, Germany (eu-central-1) |
| Supabase Inc. | Database, sign-in and the magic-link emails. | Database in Frankfurt (eu-central-1); company is US-based |
| Anthropic PBC | Generates the itinerary. Your trip description is sent to them. Don't put anything sensitive in the "how do you like to travel" field. | USA |
| OpenStreetMap Foundation (Nominatim, Overpass) | Turning place names into coordinates and finding real campsites. | EU / UK |
| komoot GmbH (Photon) | The place-name autocomplete in the trip form. | Germany |
| HeiGIT gGmbH (openrouteservice) | Measuring the real road distance and driving time between your stops. Only the coordinates of the stops are sent — never anything about you. | Heidelberg, Germany |
| CARTO | Map tiles. Your browser requests these directly, so CARTO sees your IP address. | EU / USA |
| Unsplash | The photograph on the home page is loaded from their CDN, which sees your IP. | USA |
We run no analytics, no advertising and no tracking cookies. There is therefore no consent banner. When you sign in, your session is stored in your browser's local storage — this is strictly necessary to keep you logged in, and nothing else.
Your account, profile and trips are kept until you ask us to delete them. Emails collected via the interest form are kept until we contact you, or until you ask us to remove them. Technical server logs are kept only briefly by our providers.
You have the right to access your data (Art. 15), correct it (Art. 16), have it deleted (Art. 17), restrict its processing (Art. 18), receive it in a portable format (Art. 20), and object to processing (Art. 21). Where processing rests on consent, you may withdraw it at any time with future effect. Email mail@leuchtkäfer.de and we'll do it.
You also have the right to complain to a supervisory authority — for us, the data protection authority of the federal state in which we're established.