Privacy Policy

This Privacy Policy explains how Wanderverse.ai UG (haftungsbeschränkt) ("Wanderverse.ai", "we", "us", or "our") collects, uses, shares, and protects your personal data when you use our mobile application — distributed via the Apple App Store and Google Play — and our website (together, the "Service"). We are committed to protecting your privacy and handling your data transparently and in accordance with the EU General Data Protection Regulation (GDPR) and other applicable laws.

We do not sell your personal data, and we do not use it for third-party advertising or to track you across other companies' apps and websites.

1. Information we collect

Information you provide

• Account information. When you create an account, we collect your name and email address. If you sign in with Google, Facebook, or Apple, we receive basic profile information from that provider. You may also use the app as a guest with limited functionality.
• Trip data. Details you enter to plan trips — destinations, travel dates, travelers, preferences, itineraries, packing lists, and any notes or content you add.
• Communications. Messages you send us for support, feedback, or early-access sign-ups (for example, the WanderLens waitlist).

Information collected automatically

• Usage and analytics data. How you interact with the Service, features used, and session information, collected via Google Analytics for Firebase.
• Device and diagnostic data. Device model, operating system, app version, identifiers, and crash reports collected via Firebase Crashlytics to keep the app reliable.
• Approximate location. When you plan a trip we may use destination-related location data to provide weather, places, and activity suggestions. We do not track your precise device location in the background.

2. How we use your data

• To provide, personalize, and improve the Service — including generating AI itineraries, packing lists, weather-aware suggestions, and activity recommendations.
• To create and manage your account and authenticate you securely.
• To respond to your requests and provide customer support.
• To monitor performance, diagnose crashes, and prevent fraud and abuse.
• To send you service-related communications and, where you have opted in, product updates and early-access announcements.
• To comply with legal obligations.

3. Legal bases for processing (GDPR)

Where the GDPR applies, we process your personal data on the following legal bases:

• Performance of a contract — to deliver the Service you request (Art. 6(1)(b)).
• Consent — for optional features such as marketing emails and certain analytics; you may withdraw consent at any time (Art. 6(1)(a)).
• Legitimate interests — to secure, maintain, and improve the Service, where not overridden by your rights (Art. 6(1)(f)).
• Legal obligation — to comply with applicable laws (Art. 6(1)(c)).

4. How we share your data

We do not sell your personal data. We share data only as needed to operate the Service:

• Service providers (processors) who process data on our behalf under contract, such as cloud hosting and AI providers (see Section 5).
• Activity partners when you choose to view or book activities; bookings may be completed on the partner's platform under their terms.
• Legal and safety reasons, where required by law or to protect rights, property, or safety.
• Business transfers in connection with a merger, acquisition, or sale of assets, subject to this policy.

5. Third-party services

We rely on the following key third parties to deliver the Service. Each processes data under its own privacy terms:

• Google Firebase (Authentication, Firestore, Cloud Functions, Storage, Analytics, Crashlytics, App Check) — hosting, authentication, database, and diagnostics.
• Google Cloud / Vertex AI & OpenAI — AI models used to generate itineraries, packing lists, suggestions, and content extraction. Trip prompts may be sent to these providers to produce results.
• Google Places API — place and destination information.
• Visual Crossing — weather data for weather-aware planning.
• Viator and Tiqets — activity and ticket recommendations and booking links.
• Sign-in providers — Google, Facebook (Meta), and Apple, if you choose social sign-in.

6. Data retention

We retain your personal data for as long as your account is active or as needed to provide the Service. If you delete your account, we delete or anonymize your personal data within a reasonable period, except where we must retain it to comply with legal obligations, resolve disputes, or enforce our agreements. You can delete your account or request deletion at any time (see Section 9).

7. International data transfers

Some of our service providers are located outside the European Economic Area (EEA). Where we transfer personal data internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or adequacy decisions to ensure your data remains protected.

8. Your rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your data ("right to be forgotten");
• Restrict or object to certain processing;
• Data portability — receive your data in a portable format;
• Withdraw consent at any time, without affecting prior processing;
• Lodge a complaint with a supervisory authority.

To exercise any of these rights, contact us at privacy@wanderverse.ai. If you are in the EU, you may also contact your local data protection authority.

9. Account & data deletion

You can delete your Wanderverse.ai account and the personal data associated with it at any time:

• In the app — where available, open Settings → Account and choose to delete your account.
• By request — email privacy@wanderverse.ai from the address linked to your account, or write to us at the postal address above, and we will verify and process your request.

When you delete your account, we delete or irreversibly anonymize your associated personal data — including your profile, trips, itineraries, and packing lists — within 30 days, except where we are required to retain certain data to comply with legal obligations (for example, tax or accounting requirements) or to resolve disputes. Residual copies may remain in secure backups for a limited period before being overwritten. If you only wish to delete specific data rather than your whole account, contact us and we will help.

10. Security

We use technical and organizational measures to protect your data, including encryption in transit, authenticated access, Firebase App Check to help prevent abuse, and least-privilege access controls. No method of transmission or storage is completely secure, but we work continuously to safeguard your information.

11. Children's privacy

The Service is not directed to children under 16, and we do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you in the app or by email. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

13. Contact us

If you have questions about this Privacy Policy or how we handle your data, contact: