Privacy Policy

Who we are

Vahyo is an AI travel planner. The operator of Vahyo is the controller responsible for your personal data under the EU General Data Protection Regulation (GDPR). The operator's name and address are listed in our Legal Notice.

For any privacy question or request, email us at contact@vahyo.com.

What we collect and why

Your account

When you register, we store your email address and password with our authentication provider, Supabase. Passwords are stored hashed, never in plain text. If you sign in with Google, we receive your email address and the basic profile details Google shares, such as your name. We use this to create your account and keep you signed in. The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR).

Your trips

We store what you put into a trip and what we generate for it, so you can come back to it in My Trips:

• the trip description you type;
• the filters you choose, such as dates, budget, transport, and your travel group;
• your answers to follow-up questions and any refinement instructions;
• the itinerary we generate.

The travel group can include how many travellers have accessibility needs. This is optional. Only set it if you want it considered in your plan. The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR).

Using Vahyo without an account

If you plan a trip without signing up, we create an anonymous session. It is a random identifier with no name or email attached. We use it to enforce the free plan limit and to let you keep your plan if you register later. We also process your IP address to limit abuse of the free service. The legal basis is our legitimate interest in offering a fair free tier and protecting the service (Art. 6(1)(f) GDPR).

Security checks

We use Cloudflare Turnstile to protect sign-in, registration, and anonymous sessions from bots. It evaluates technical signals from your browser and device, such as your IP address and browser characteristics. The legal basis is our legitimate interest in keeping the service secure (Art. 6(1)(f) GDPR).

Analytics, only with your consent

If you accept analytics cookies, we use PostHog to understand how Vahyo is used. It records the pages you view and how you interact with the site, such as clicks. When you request a trip plan, we also record high-level trip parameters, such as group size, trip length, travel month, budget, and transport preferences, but never the text of your request or your exact travel dates. Your browser sends this data to an address on our own website, and our website host, Vercel, forwards it to PostHog's EU cloud. Your browser doesn't connect to PostHog directly.

If you are signed in, this analytics data is linked to your account through your user ID and email address. We use that to understand how Vahyo is used and to leave our own team's activity out of the numbers. If you use Vahyo without an account, your analytics data isn't linked to a name, email address, or account. If you later create an account, analytics recorded earlier in the same browser become linked to it.

All of this happens only after you accept analytics cookies. If you decline or haven't chosen, PostHog is never started. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in Cookie Settings.

Affiliate links

Some links to hotels, activities and transport are affiliate links: if you book through them, Vahyo may earn a commission at no extra cost to you. This never changes which places we recommend.

We work with these affiliate partners:

• Travelpayouts (Go Travel Un Limited): affiliate link tracking. Its script loads only after you consent.
• GetYourGuide Deutschland GmbH: activity booking links and widget analytics. Its script loads only after you consent.
• CJ Affiliate (Epsilon International UK Ltd): tracks bookings made through our links on the booking site’s side. It loads no script on vahyo.com.

The legal basis for loading the Travelpayouts and GetYourGuide scripts is your consent (Art. 6(1)(a) GDPR). If you withdraw it in Cookie Settings, they are no longer loaded from your next page load.

How your trip requests are processed

To generate and refine itineraries, we send your trip request to AI model providers: Google (Gemini) and Anthropic (Claude). A trip request is your description, filters, answers, and refinement instructions. They process it to produce your plan. Please don't put personal details into a trip description that you don't want processed this way.

The plans are suggestions. We don't make decisions about you with legal or similarly significant effects based solely on automated processing.

Emails

Account emails, such as confirming your address, are sent through Resend from an EU sending domain.

Maps and images loaded by your browser

Some content is loaded directly by your browser from third parties, which therefore see your IP address:

• map tiles from OpenFreeMap when you view a trip map;
• travel times between stops from OpenRouteService, which receives the coordinates of those stops;
• the homepage background photo from Unsplash;
• a preview image from YouTube when you add a YouTube video link to your trip request;
• your profile picture from Google, shown in the account menu, if you signed in with Google.

Where your data is hosted

• Website: Vercel.
• Backend that generates plans: Railway, EU region.
• Accounts and trips: Supabase, Frankfurt, Germany.

Some providers named on this page are US companies and may process data outside the EU. Where that happens, the transfer relies on the safeguards the GDPR provides, such as the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

Our affiliate partners are based in these places:

• Travelpayouts is operated by Go Travel Un Limited, Hong Kong (registration no. 1658681, 4007 Central Plaza, 18 Harbour Road, Wanchai). There is no EU adequacy decision for Hong Kong, so your data may not be protected to the same standard as in the EU, and enforcing your rights there may be harder. This transfer therefore happens only with your explicit consent (Art. 49(1)(a) GDPR). Without it, the Travelpayouts script doesn’t load.
• GetYourGuide Deutschland GmbH is based in Berlin, inside the EU.
• CJ Affiliate is operated by Epsilon International UK Ltd in the United Kingdom, which the European Commission recognises as providing adequate data protection.

What we don't do

• We don’t run advertising networks or display ads.
• We don’t sell your personal data. After you consent, our affiliate partners (Travelpayouts, GetYourGuide) receive technical data such as your IP address and cookie identifiers when their scripts load or when you follow a booking link.

Apart from that, we share personal data only with the service providers named on this page, to run Vahyo, or when the law requires us to.

Cookies and browser storage

Essential cookies and browser storage keep you signed in, run the security check, and remember your consent choice. They are always on. Analytics cookies, and cookies from our affiliate partners' scripts, are only set if you accept them. See Cookie Settings for the details and to change your choice.

How long we keep your data

• Account data and trips are kept while your account exists. If you ask us to delete your account, we delete it together with your trips.
• Anonymous sessions and plans made with them are kept so free usage limits work and you can keep your plan if you sign up. You can ask us to delete them at any time.
• Analytics data is kept only as long as it helps us improve Vahyo, and is then deleted.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected (rectification);
• have your data deleted (erasure);
• restrict how we process your data;
• receive your data in a portable format (portability);
• object to processing based on our legitimate interests;
• withdraw your consent at any time, without affecting processing that already happened;
• lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work.

To make a request, email contact@vahyo.com. We reply within one month and may ask you to confirm your identity first.

Changes to this policy

When we change how we handle personal data, we update this page and the date at the top.