VedutaPrivacy policy
Last updated 3 October 2026
Who is responsible
The data controller is Nadir Hussain, Italy. Write to [email protected] for anything about your data.
What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Your account (name, email, password hash or Google account id) | To sign you in and keep your trips | Contract (art. 6(1)(b) GDPR) |
| Optional profile details you add: photo, home city, country and mobile number | Shown on your account only; never shared, sold or used for marketing | Consent (art. 6(1)(a)), remove them at any time in Settings |
| Sign-in sessions: the device's browser name and IP address | To show you and our support team which devices are signed in, and to stop misuse | Legitimate interest (art. 6(1)(f)) |
| Account emails (confirmation, password reset, welcome, security notices) and your trip plan, sent once when a trip is fully planned | To confirm your address and keep your account secure | Contract (art. 6(1)(b)) |
| Trips, saved places, notes and reviews you write | To provide the planner | Contract (art. 6(1)(b)) |
| Reviews you publish: rating, text, and your first name with the initial of your last name | Shown publicly on the place, so other travellers can read them | Contract (art. 6(1)(b)) |
| Usage counts (map views, street views, AI requests) per account or anonymous device id | Fair-use limits and cost control | Legitimate interest (art. 6(1)(f)) |
| Questions you ask the guide and trip preferences you give the planner | To generate answers and plans | Contract (art. 6(1)(b)) |
| Messages you send the travel assistant, its answers and the plans it proposes | To answer, search transport between cities and set up trips you choose to save; each message is checked for abuse first | Contract (art. 6(1)(b)) |
| Cities you ask us to add, and when | To build the city, and to apply the monthly limit | Contract (art. 6(1)(b)) |
| Reports you make about a place: the reason and an optional note | To hide and correct wrong places | Legitimate interest (art. 6(1)(f)) |
| How busy a place was, when you tell us after a visit | To show crowd levels to other travellers | Legitimate interest (art. 6(1)(f)) |
| Which booking partner link you opened, with your account or device id | To reconcile partner commissions | Legitimate interest (art. 6(1)(f)) |
| Waitlist email and city of interest | To tell you when a city opens | Consent (art. 6(1)(a)), withdraw at any time |
| Product analytics events without cookies | To understand which features help travellers | Legitimate interest (art. 6(1)(f)) |
| Location, only when you tap “I'm here” to check in | To confirm a visit; never stored | Consent (art. 6(1)(a)) |
We never sell your data and never use it for advertising.
Who processes it for us
- Google (Maps Platform): 3D maps, Street View and place details shown in the app. When a traveller adds a city, we look up Google place IDs without any personal data and store only those IDs.
- Our hosting provider (Railway): Runs the application, stores your data in the EU, and keeps profile photos in a private storage bucket.
- OpenAI (United States): Generates plans and guide answers from your request and our place list, checks the text of reviews before they are published, writes place descriptions for cities travellers add, and searches the web for trains and buses between the cities of a journey (city names only); no name or email is sent.
- Cloudflare: Delivers the website and protects it from abuse; sees your IP address and the pages you request.
- PostHog (EU cloud): Cookieless product analytics; one-time links are removed from page addresses before sending.
- GoDaddy (email delivery): Sends account emails to your address.
- Booking partners (GetYourGuide, Viator; Stay22 for hotels on Booking.com, Expedia and others; TheFork for restaurant tables; Airbnb for homes, which pays us nothing): Only when you choose to open a booking link; the partner's site then applies its own cookies and privacy notice.
- Transport data (Duffel; Travelpayouts for Aviasales): When you plan a multi-city journey: receive only city or airport codes, the travel date and one adult, to return flight times and prices; nothing that identifies you.
- Paddle.com (when paid plans open): Our reseller and Merchant of Record: takes payment and issues invoices under its own privacy notice. We receive your plan, order ids and amount, never card details.
Google processes map requests under the Google Privacy Policy. Where a provider is outside the European Economic Area, transfers rely on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
How long we keep it
- Account, trips and usage counts: until you delete your account.
- Profile photo and optional details: until you remove them or delete your account; replacing a photo deletes the old one.
- Sign-in sessions, with device and IP address: 30 days after last use.
- Email confirmation links expire after 24 hours and password reset links after one hour; we keep only a fingerprint of each link, deleted a week after it expires.
- Records of actions our administrators take on an account: kept for security, with the email address masked once the account is deleted.
- Waitlist: until the city opens and we have told you, or until you ask to leave. If you never confirm the email we send, we delete the address after 30 days.
- AI and booking logs: 13 months, and only as anonymous counts once your account is deleted. Usage counts for visitors without an account: 13 months.
- Resolved reports about reviews and places: 12 months after the decision. Your reports are deleted with your account.
- Cities you asked us to add stay on Veduta for everyone; the link between the request and your account is removed when you delete your account.
- Crowd reports stay, without your name, if you delete your account, because they describe the place rather than you.
- Travel assistant conversations: 30 days after the last message, or until you delete them in the assistant.
Cookies and browser storage
We use only essential cookies, so no consent banner is needed for them. Analytics run without cookies.
| Name | Purpose and lifetime | Type |
|---|---|---|
| veduta_at | Keeps you signed in (15 minutes) | Essential |
| veduta_rt | Renews your sign-in, sent only to our sign-in service (30 days) | Essential |
| veduta_session | Tells the site to renew your sign-in; holds no personal data (30 days) | Essential |
| veduta_oauth | Protects a Google sign-in while it is in progress (10 minutes) | Essential |
| veduta_lang | Remembers the language you chose (1 year) | Essential |
| veduta_anon | Random device id for fair-use counting without an account (1 year) | Essential |
| Browser storage: veduta.local-trip | Places you saved before signing in, on your device only | Essential |
| Browser storage: veduta.drone-hint-dismissed | Remembers that you closed the flight-controls tip | Essential |
| Cache storage: veduta-trips | An offline copy of your own trips, on your device only; cleared when you sign out or delete your account | Essential |
| Cache storage: veduta-shell | The page shown when you have no connection; holds no personal data | Essential |
Your rights
You can access, correct, export and delete your data, object to processing based on legitimate interest, and withdraw consent at any time. Download or delete everything yourself on your account page, or write to [email protected]. You can also complain to your data protection authority; in Italy that is the Garante per la protezione dei dati personali.
Children
Veduta is for people aged 16 and over. We do not knowingly collect data from children.
Changes
If we change this policy in a way that matters, we will tell signed-in users before the change applies.