Draft last updated: 2026-09-28
This notice explains what personal data Giroplan collects, why, who it is shared with, and what rights you have. It is provided under Articles 13-14 of Regulation (EU) 2016/679 (GDPR).
The data controller is Luca Bordina, operating Giroplan as an individual (no registered business). Contact for privacy matters: info@giroplan.com.
For any request about your data or to exercise your rights, write to the email above.
No Data Protection Officer (DPO) is appointed: it is not mandatory for this processing. To be reassessed if the service grows.
We only collect the data necessary for you to use the Service:
Account data
Your trip data (you provide it by filling in the form or saving an itinerary)
Booking data (if you use the agenda / confirmation parsing)
What you send us of your own initiative (optional, none of it is needed to use the Service)
Technical and security data
We do not collect special categories of data (Art. 9 GDPR), we do not do advertising profiling, and we do not use tracking or analytics cookies. Partner content (§6) only loads if you open it yourself.
| Purpose | Data used | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Creating and managing your account, authenticating you | email, password | Performance of a contract — Art. 6(1)(b) |
| Generating itineraries, answering your questions in the chat, changing your trips on request and saving them | trip data, including the conversation | Performance of a contract — Art. 6(1)(b) |
| Reading confirmations and building the agenda/budget | booking data | Performance of a contract — Art. 6(1)(b) |
| Sending you address-verification and password-reset emails | Performance of a contract — Art. 6(1)(b) | |
| Protecting the Service from abuse (rate-limiting, access gate) | IP, technical cookies | Legitimate interest — Art. 6(1)(f) |
| Reading your feedback and replying to it | feedback text, page, email if given | Consent — Art. 6(1)(a) |
| Telling you when subscriptions open, and deciding what to build first | waitlist data | Consent — Art. 6(1)(a) |
| Sending you news and offers about Giroplan | Consent — Art. 6(1)(a) |
Providing the data marked as necessary (email and password) is required to use the Service: without it, an account cannot be created.
Where the legal basis is consent (feedback, waitlist, commercial communications), giving it is entirely optional and you can withdraw it at any time — from your account page for commercial communications, or by writing to the contact address in §1 — without affecting the lawfulness of what was processed before. Every commercial email we send carries a one-click unsubscribe link. We do not use waitlist or feedback addresses for anything other than the purpose stated above, and we never pass them on.
We do not sell your data. We only disclose it to the technical providers (processors, Art. 28) needed to run the Service:
| Provider | What it receives / what for | Where |
|---|---|---|
| Anthropic (Claude API) | the text of your itinerary requests; your chat messages, together with the earlier conversation and the trip they refer to; and the text of confirmations it interprets. When a question needs up-to-date information, the assistant may run web searches through Anthropic: the search terms it writes, based on your messages, are processed by Anthropic to carry them out | USA |
| Hosting provider (Render) | hosts the application | EU |
| Database provider (Neon) | hosts the Postgres database with your account, trips and bookings | EU |
| Brevo (Sendinblue SAS) | sending address-verification and password-reset emails: receives your email address and the message text | EU (France) |
| Google (Places API) (only if active) | place/activity search text you enter, to find things to do near your destination and show their photos | USA |
| Amadeus (only if active) | real flight/hotel search; receives the routes/dates of the search | EU/USA |
| Ticketmaster (only if active) | links to official events during your trip | USA |
In addition, the place-autocomplete feature in the form queries the OpenStreetMap/Nominatim map service directly from your browser to suggest locations as you type. Destination photos are loaded directly by your browser from Wikimedia/Wikipedia and from Unsplash (Unsplash Inc., Canada/USA): these services receive your IP address and which images were displayed, as any image host does; Unsplash counts views and downloads with a random identifier that is not linked to you. We send them no account data.
Transfers outside the European Union. Some providers (in particular Anthropic, Google and Ticketmaster) process data in the United States. Such transfers rely on the European Commission's Standard Contractual Clauses (SCCs) and/or other adequate safeguards under Chapter V of the GDPR.
To complete/verify: DPAs with Anthropic, the hosting provider, the database provider and the email provider, with SCCs for the US transfers; confirmation that data sent to the Anthropic API is not used to train the models.
The 24-month limits above are enforced automatically, not just declared: inactive accounts, waitlist addresses and feedback past that age are deleted by the service itself. Thirty days before an account is deleted we email you a warning — signing in once resets the clock and cancels the deletion.
Giroplan uses only technical cookies, necessary for the Service to work, for which consent is not required:
| Cookie | Purpose | Duration |
|---|---|---|
tp_session | keeps you signed in after login | 30 days |
tp_access | remembers that you entered the invite code | 30 days |
lang | remembers the language you chose with the EN/IT switch | 1 year |
We do not use profiling, advertising or third-party analytics cookies, and no third-party content loads on its own while you browse.
Partner content, on your request. In some sections ("Things to do") Giroplan may suggest a partner's bookable experiences. In its normal form this is a plain link (today to Klook) and no third-party code runs on the page: the partner only learns about you if you follow the link, like on any other site. Where GetYourGuide's direct program is active, a card with photos and prices may appear instead of a plain link: that card does not load until you open it, GetYourGuide's code only runs after you click the button — which counts as consent — and before you click, the card tells you what that involves. From that point on, GetYourGuide receives your request (IP address, referring page) and may use its own cookies, under its own notice, over which Giroplan has no control. If you never open the card, nothing loads. Some links in the showcase are affiliate links: if you book after following one, Giroplan receives a commission from the partner, at no extra cost to you.
Who the partners are. The providers Giroplan may link to, by what they sell, are: Booking.com, Agoda and Expedia (accommodation); Skyscanner, Kayak and Kiwi.com (flights); Trainline and Omio (trains and buses); Direct Ferries (ferries); Kiwitaxi (private transfers); DiscoverCars, Auto Europe and Localrent (car rental); ParkVia (airport parking); Klook, Tiqets and GetYourGuide (activities and museums); TheFork (restaurants); Ticketmaster (events); Airalo (eSIM); EKTA (travel insurance). Some of these links carry an affiliate identifier through a tracking network (Travelpayouts, Awin); that identifier is added on Giroplan's server and tells the partner only that you came from Giroplan — nothing about you is sent along with it. None of these providers load any code on this site. Where none of these providers sells a route (for example trains in Japan or buses in the United States), Giroplan links to the official website of the operator that runs it (such as JR, Amtrak or ADO) and to Rome2rio, a route planner, which also appears next to private transfers to show times and prices: these links are never affiliate. Like the partners, they load no code on this site. This list is kept up to date whenever a partner is added or removed.
Under Articles 15-22 of the GDPR you have the right to:
To exercise rights that are not already self-service in the app, write to the contact email in §1. We will respond without undue delay and in any case within one month.
You also have the right to lodge a complaint with the supervisory authority: in Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it).
When you paste or forward a booking confirmation, the text may contain data about other travellers (names, etc.). By entering it, you declare that you are entitled to process it and undertake to inform them, where necessary, of this notice. This data is used exclusively to build your trip agenda and follows the same retention and deletion rules described above.
We adopt appropriate technical measures to protect your data: encrypted passwords (PBKDF2 hash with salt), HttpOnly session cookies, an encrypted connection (HTTPS) and anti-abuse limits. No system, however, is 100% secure.
The Service is not directed at anyone under 16, who must not register without the consent of whoever holds parental responsibility. Registration automatically checks the declared age.
We may update this notice over time. The current version is always available at this address, with the last-updated date at the top. We will let you know if a change is substantial.
Giroplan · Back to the app · Terms