Privacy policy

1. Data controller

• Identity: José Barber Cortell, individual, operator of the Wandr service.
• Email: wandria0010@gmail.com

No Data Protection Officer has been appointed. The activity does not fall within Article 37 GDPR: we are not a public authority, we do not carry out large-scale systematic monitoring and we do not process special categories of data at scale.

2. Data we process and why

2.1 Account and profile

• What: email address, password (stored encrypted), username or alias, avatar (URL), travel preferences, aura colour, friend code.
• If you sign in with Google: we additionally receive your name and public picture according to the permissions you accept on the Google screen.
• Purpose: create and manage your account, save your trips, let you invite other people to collaborate.
• Legal basis: performance of a contract to which you are a party (Art. 6.1.b GDPR).

2.2 Trip data

• What: destination, dates, budget, interests, chat prompts, generated itineraries, notes and bookings. Prompts may contain personal data if you type them. We do not ask for that information; if you enter it, it is linked to the trip.
• Purpose: provide the service.
• Legal basis: performance of the contract.

2.3 Anonymous trips

• What: if you use the service without registering we generate a random identifier (client_token) that we store in your browser (localStorage) and we link trips to that identifier.
• Purpose: let you return to your trips without forcing you to create an account and, if you register later, claim them automatically.
• Legal basis: performance of the contract and technical necessity of the service.

2.4 Sharing and collaboration

• What: when you share a trip we generate a public link with a random token. Anyone with the link can see the trip. If you invite collaborators, their email is stored to send them the invitation.
• Purpose: let you share the plan with friends or family.
• Legal basis: your consent when pressing the share or invite button. Important: if a trip contains personal information and you share it, that information will stop being private.

2.5 Waitlist (pricing page)

• What: email address you leave when you express interest in a future plan (Pro, Team).
• Purpose: notify you when that plan becomes available. No recurring newsletter.
• Legal basis: your consent by ticking the relevant box. You can withdraw it by writing to wandria0010@gmail.com.

2.6 Technical data and analytics

• What: anonymous browser identifier, pages viewed, basic usage events, browser, language and approximate country inferred from the IP at city level. No session recording.
• Purpose: understand what works and what does not so we can prioritise improvements.
• Legal basis: your consent via the cookie banner. If you do not accept, analytics does not run.

3. Processors that receive your data

To provide the service we rely on the following data processors. All of them are contracted under GDPR-compliant clauses:

Important about AI models: when you use the chat, the content you type (prompts) is sent to OpenAI and/or Anthropic to generate the response. Both providers have contractually committed not to use the data to train their models.

We do not sell your data to third parties and we do not use it for third-party personalised advertising.

4. International transfers

Some processors handle data outside the European Economic Area, mainly in the United States. In all cases, transfers rely on:

• The EU-U.S. Data Privacy Framework when the provider is certified.
• Standard Contractual Clauses approved by the European Commission.

5. Retention periods

6. Your rights

You have the right to:

• Access your data.
• Rectify it if inaccurate.
• Erase it (right to be forgotten).
• Restrict processing.
• Object to processing based on legitimate interest.
• Portability of the data you have provided.
• Withdraw consent you have given, without retroactive effect.

To exercise them, write to wandria0010@gmail.com with «Data protection» in the subject line and attaching a copy of a document proving your identity. We will reply within a maximum of 30 days.

If you believe we process your data improperly, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) (calle Jorge Juan 6, 28001 Madrid).

7. Minors

The service is aimed at people aged 14 or over, the minimum legal age in Spain to give consent to the processing of personal data (Art. 7 LO 3/2018). If you are under that age you must not register or provide us with personal data. If we detect an account belonging to a child under 14, we will delete it.

8. Security

We apply reasonable technical and organisational measures: encrypted passwords, encryption in transit (HTTPS/TLS), database-level access control (Row Level Security), isolation of invitation tokens and auditing of access attempts.

No measure is infallible. If we suffer a breach affecting your data, we will notify you without undue delay when regulations require it.

9. Changes to this policy

We will publish any changes on this same page, updating the date. If the changes affect your rights, we will notify you by email or with a visible notice in the service.

See also our Cookie Policy and the Terms of use.