How Vanabout handles your data, under the GDPR. Controller: Lars Bremer, Auf Blehn 3, 54294 Trier, Germany — mail@vanabout.app.
| Data | Why | Legal basis |
|---|---|---|
| Email address | To sign you in (passwordless magic link) and to contact you about your trips. | Art. 6(1)(b) — performance of a contract |
| Your name | So the app can address you by name instead of your email. | Art. 6(1)(b) |
| Your language preference | So the site and your new trips are in the language you chose. | Art. 6(1)(b) |
| Trip details you enter (start/end point, dates, who is travelling, vehicle, travel preferences) | To generate your itinerary. This text is sent to Anthropic's Claude API (see below). | Art. 6(1)(b) |
| Email submitted to the "make this trip yours" form | To tell you when editing becomes available. | Art. 6(1)(a) — consent (you can withdraw any time) |
| Your public-beta place (which trip it is for, and when you claimed it) | To keep the beta to one free trip per person and a limited number of places. Deleted when the beta ends. | Art. 6(1)(b) |
| Feedback you choose to give on a trip (a rating, your comments, whether you would have paid, whether we may contact you) | To learn what works and what doesn't, and — only if you tick the box — to ask you about your answers. Read by the Vanabout team only. We keep a copy for 12 months after the beta ends, also if you delete the trip; it holds your answers, not your email address. | Art. 6(1)(a) — consent (giving feedback is voluntary) |
| Your choice to receive one follow-up email about your beta trip | To send you a single email a few days after your trip is ready, asking how it went. Only if you ticked the box; you can withdraw it by writing to us. | Art. 6(1)(a) — consent (you can withdraw any time) |
| IP address and technical request data | Unavoidably processed by our hosting, database and map providers to deliver the site and defend against abuse. | Art. 6(1)(f) — legitimate interest |
| Which page was opened, and the site that linked you here | To see whether the site works and where visitors arrive from. Counted in aggregate only — never tied to you, your account or your trips. | Art. 6(1)(f) — legitimate interest |
These are the actual services this app uses. Some are outside the EU; where that is the case, transfers rely on the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework.
| Provider | Purpose | Where |
|---|---|---|
| Amazon Web Services (AWS Europe, Luxembourg) | Website hosting (Amplify) and the server that generates itineraries (Lambda). | Frankfurt, Germany (eu-central-1) |
| Supabase Inc. | Database, sign-in and the magic-link emails. | Database in Frankfurt (eu-central-1); company is US-based |
| Apple Distribution International Ltd. (iCloud+) | Our mailbox. If you email us — a question, a withdrawal, a request to delete your data — that message is stored there. | Ireland (EU) |
| Anthropic PBC | Generates the itinerary. Your trip description is sent to them. Don't put anything sensitive in the "how do you like to travel" field. | USA |
| OpenStreetMap Foundation (Nominatim, Overpass) | Turning place names into coordinates and finding real campsites. | EU / UK |
| komoot GmbH (Photon) | The place-name autocomplete in the trip form. | Germany |
| HeiGIT gGmbH (openrouteservice) | Measuring the real road distance and driving time between your stops. Only the coordinates of the stops are sent — never anything about you. | Heidelberg, Germany |
| OpenFreeMap | Map tiles. Your browser requests these directly, so their servers see your IP address. They state that they do not log IP addresses in normal operation. | EU (Hetzner servers) |
| Umami Software, Inc. | Counts page views so we can tell whether the site works. Nothing is stored on your device, and your browser never contacts them directly — the measurement is served through our own domain. | EU data region selected; company is US-based. Transfers are covered by EU Standard Contractual Clauses. |
We use no tracking cookies, no advertising, and nothing that follows you to another site. There is still no consent banner — here is exactly why. We count how the site is used with Umami, with their EU data region selected. It stores nothing at all on your device — no cookie, no local storage, no fingerprint — so there is nothing for you to consent to. We record which page was opened, which site linked you here, and the rough kind of device; we build no profile of you, and your browser never contacts the provider directly, because the measurement is served through our own domain.
The basis is our legitimate interest in knowing whether the site works (Art. 6(1)(f)). If you would rather not be counted, switch on “Do Not Track” or Global Privacy Control in your browser and we will not record the visit — or write to us and object (Art. 21). Either works; neither costs you anything on the site.
When you sign in, your session is stored in your browser's local storage — this is strictly necessary to keep you logged in. Your chosen language is stored the same way, so the site opens in it next time. The site also remembers small display settings there — for example whether a trip's overview is shown compact — and, if you click “make this trip yours” before signing in, which trip you meant, so it is not lost on the way through the sign-in email. These are settings for the site itself: they are never sent anywhere, never used to recognise you, and never shared.
Your account, profile and trips are kept until you ask us to delete them. Emails collected via the interest form are kept until we contact you, or until you ask us to remove them. Technical server logs are kept only briefly by our providers. Feedback you give on a trip is deleted together with that trip or your account, except a copy we keep for 12 months after the public beta ends to improve Vanabout: it holds your answers, not your email address. Your public-beta place is deleted when the beta ends.
When you delete a trip it disappears from your account at once and is permanently removed 30 days later. Within those 30 days we can still restore it for you if you deleted it by mistake — just ask. After them the trip and everything belonging to it — its stops, its share links and the record of how it was generated — are gone for good, and we cannot get them back.
If you have paid for a trip, the payment record is the one thing erasure does not remove. German tax law (§ 147 AO) obliges us to keep booking records, and Art. 17(3)(b) GDPR exempts them from erasure for that reason. What we do instead is cut the link to you: the record is detached from your account and the raw data we received from our payment provider is deleted, leaving only the amount, the currency, the date and the transaction id. We keep that for the retention period German tax law requires, and no longer.
Email mail@vanabout.app and ask us to. We delete your login, your profile, every trip on the account with all its stops and share links, and any interest-form entry under the same address. What survives is the pseudonymised payment record described above. There is no self-service button for this yet — a person handles the request, and we confirm to you once it is done. At the same address you can ask for a copy of everything we hold about you (Art. 15 and Art. 20); we send it as a single machine-readable file.
You have the right to access your data (Art. 15), correct it (Art. 16), have it deleted (Art. 17), restrict its processing (Art. 18), receive it in a portable format (Art. 20), and object to processing (Art. 21). Where processing rests on consent, you may withdraw it at any time with future effect. Email mail@vanabout.app and we'll do it.
You also have the right to complain to a supervisory authority — for us, the data protection authority of the federal state in which we're established.