Privacy policy

This policy explains how we handle personal data when you use the VagabondBase website, app and public API, and when you write to us. We call these the “Service”. If something is not clear, write to us at privacy@vagabondbase.com.

The short version

• We collect what we need to run VagabondBase: your account, and what you and the people on your trips add to them.
• We do not sell your data, we do not show ads, and we do not use analytics or advertising trackers.
• We do not use your content to train AI models.
• The people on a trip can see that trip. You choose who can see your documents.
• We store your data in the European Union. Some of our providers are in other countries, with the safeguards that the law requires.
• You can see, export, correct and delete your data.

1. Who is responsible for your data

The controller of your personal data is Simone Cervini, a self-employed individual based in Italy, VAT number IT11110640965 (“we”, “us”). For any question about your data, write to us at privacy@vagabondbase.com.

2. The data that we collect

• Account data: your email address, your name and your settings.
• Trip content: what you and the other people on your trips add, such as itineraries, booking details, places, expenses, packing lists, notes and documents, for example tickets and passports. Trip content can include information about you and about other people.
• Technical data: your IP address, your browser and device type, your sign-in sessions, and records of how you use the Service, for example when you are active on a trip and the errors that occur.
• Messages: what you write to us, and our answers.

The people on your trips can add information about you, for example your name in a note or a ticket in your name. In this case, we receive your data from them.

We do not collect payment data, the location of your device, your contacts or advertising identifiers.

3. Why we use your data

We use personal data only for these purposes and with these legal bases under the General Data Protection Regulation (GDPR):

• To provide the Service: your account and sign-in, your trips and the sharing of them, maps and places, documents, the AI features and the public API, and the emails that the Service needs, such as login codes. Legal basis: our contract with you (article 6(1)(b)).
• To keep the Service secure and to prevent fraud and abuse. Legal basis: our legitimate interest, and that of our users, in a secure service (article 6(1)(f)).
• To give support when you write to us. Legal basis: our contract with you (article 6(1)(b)) or our legitimate interest in answering messages (article 6(1)(f)).
• To fix and improve the Service with technical data and statistics. We do not read your content for this, and we do not create profiles. Legal basis: our legitimate interest in a reliable service (article 6(1)(f)).
• To obey the law, for example to answer authorities and to handle reports of illegal content. Legal basis: our legal obligations (article 6(1)(c)).
• To establish, exercise or defend legal claims. Legal basis: our legitimate interest (article 6(1)(f)).
• To handle the data that people add about other people, such as travel companions, so that a group can plan a trip together. Legal basis: the legitimate interest of the group, and ours, in a shared trip (article 6(1)(f)).

You must give your email address to use the Service. All other data is optional, but some features do not work without it.

We do not ask for sensitive data, such as health information. If you add it, for example an allergy in a note for your group, you give your explicit consent for us to store it and show it to the people that you share it with (article 9(2)(a)). You can withdraw your consent when you delete it.

We do not make decisions about you that are based only on automated processing and that have legal or similarly significant effects on you. We do not send marketing emails. If we start, we will ask for your consent when the law requires it.

4. AI features

Some features use AI, for example to suggest a title for an event in your itinerary. For these features, we send to our AI provider only the trip information that the feature needs, not your name or your email address. The provider processes the data on our behalf, and its contract with us does not allow it to use the data to train its models.

If you connect an AI assistant or other software to your account through the public API, its provider receives the data that it reads, and its own terms and privacy policy apply.

5. Who can see your data

The people on your trips

The people on a trip can see its content, and the name and email address of the other people on it. Documents are visible only to the people that are chosen for them. Anyone who joins with an invite link becomes one of the people on the trip.

People who work on VagabondBase

Only we and the people who work for us with our authorization can access personal data, and only when it is necessary, for example to help you when you ask, to solve a security problem or to obey the law. Everyone who works for us is bound by confidentiality.

Our service providers

These companies process personal data on our behalf, under contracts that oblige them to protect it and to use it only on our instructions:

• Amazon Web Services: hosting of the website and the app, file storage and content delivery (European Union, with content delivery worldwide).
• PlanetScale: database (European Union).
• Resend: sending emails (United States).
• Anthropic: AI features (United States).
• Cloudflare: receiving the emails that you send us (United States).

Gmail

We read and answer your emails in Gmail. Google provides Gmail under its own terms, uses your messages under the Google Privacy Policy, and can store them in the United States and in other countries.

Google Maps

The app uses Google Maps to show maps and to find places. When you use these features, Google receives data such as your IP address and your searches. We are responsible, together with Google, only for the transmission of this data to Google. Google then uses it as an independent controller under the Google Privacy Policy.

Other cases

• When the law requires it, or when it is necessary to protect the rights or the safety of people.
• If another person or company takes over the Service, for example after a sale of the business. This policy continues to protect your data, and we tell you before.

We do not sell your personal data or share it for advertising.

6. Transfers outside Europe

We store your data in the European Union. When a provider processes data outside the European Economic Area, we use the safeguards that the GDPR requires, such as an adequacy decision of the European Commission, including the EU-U.S. Data Privacy Framework, or the standard contractual clauses of the European Commission. You can ask us for a copy of these safeguards.

7. How long we keep your data

• Account data: while your account is active, and for up to 30 days after you delete it.
• Trip content: until you or the other people on the trip delete it. If you delete your account, the content that you added to trips that you share with other people stays in those trips, without your name and email address.
• Technical data: up to 90 days, unless we need it longer for a security investigation.
• Messages: up to 2 years after the conversation ends.
• Backups: deleted data can remain in the backups of our providers for up to 90 days.
• Inactive accounts: if you do not use your account for 3 years, we can delete it. We send you an email before.

We keep data longer only when the law requires it or when we need it for a legal claim.

8. How we protect your data

We use technical and organizational measures that are appropriate to the risk. Data is encrypted in transit and at rest, access is limited to the people who need it, and we make regular backups. If a personal data breach occurs, we inform the competent authority within 72 hours when the law requires it, and we inform you when the breach puts your rights at high risk.

You can help: keep your email account secure, sign out of devices that other people use, and share invite links and API keys only with care.

9. Your rights

You have the right to access your data, to correct it, to delete it, to limit its use, to receive it in a portable format, to object to its use based on our legitimate interest, and to withdraw your consent at any time.

You can change or delete much of your data yourself in the app. For everything else, write to us at privacy@vagabondbase.com. We answer within one month, and we can ask you to confirm your identity.

Some content in a shared trip is also part of the records of other people, for example an expense that you paid together. When you ask us to delete it, we balance your request with their rights, and we remove what identifies you.

You can also make a complaint to a data protection authority: in Italy, the Garante per la protezione dei dati personali, or the authority of the country where you live or work.

10. Cookies

We use only the cookies and device storage that are necessary for the Service to work, for example to keep you signed in and to make your trips available without a connection. We do not use analytics or advertising cookies, so we do not need your consent and we do not show a cookie banner.

11. Children

VagabondBase is not for children younger than 16. If we learn that a child younger than 16 has an account, we delete it. Parents and guardians can add information about their children to a family trip, and they are responsible for it.

12. When a business plans your trip

A business, such as a travel agent, can use VagabondBase to plan trips for its clients. For the data of its clients, the business is the controller and we process the data on its behalf, under our data processing terms. If a business added your data, send your requests to that business.

13. Information for the United States

The categories of personal information that we collect, their sources and our purposes are in sections 2 and 3. We disclose personal information only to the recipients in section 5. We do not sell personal information and we do not share it for cross-context behavioral advertising. We use sensitive personal information only to provide the Service.

You can ask to know, access, correct and delete your personal information, also through an authorized agent, and we do not treat you differently when you do. If we refuse a request, you can appeal by replying to our answer.

14. Changes to this policy

When we change this policy, we update the date at its top. When a change is important, we tell you in advance by email or in the app.