Privacy Policy

The controller of your personal data is Edoardo Geiss, the individual who operates 4trips, based in Italy. For anything concerning this policy or your data, contact us at edoardo.create@gmail.com.

We are not required to appoint a Data Protection Officer and have not done so.

• Account data: your name, email address and password. Passwords are stored only as a one-way argon2 hash: we never see or store the password itself. We also record when you accepted our Terms and Conditions and this Privacy Policy, and which version. We also record whether you've confirmed your email address. If you add one, a profile photo, which the members of your groups can see. It's cropped and resized in your browser before upload, which also removes hidden photo data such as location.
• Trip content: the groups and trips you create or join, departure city, the dates you mark as available, your travel preferences (budget, interests, pace, free-text notes), destination votes, itinerary requests and feedback, expenses and settlements, chat messages, bookings you record and documents you upload (for example booking confirmations or tickets).
• Travel map: the countries and cities you mark as visited, lived in or wanted, any dates you add, and which trip a place came from. You choose who can see it: only you, or also the members of your groups (on the group map). Until you choose, it's visible only to you.
• Invite data: group join codes and trip invite links, and which group you joined through them.
• Technical data: IP address, browser and device information, and the request and error logs generated when you use the Service.
• AI usage records: which AI feature was used, when, by which account and how many tokens it consumed: used for fair-use limits and cost control (see section 4).
• Analytics data: only if you consent: see section 5.

4trips is a group tool: what you add to a group or trip (preferences, availability, votes, messages, expenses, documents and bookings) is visible to the other members of that group or trip, and the trip chat shows short updates when someone joins, changes their availability or preferences, or adds an expense. That is the core purpose of the Service, so only share there what you are comfortable sharing with them.

We don't ask for special categories of data (such as health information or religious beliefs). If you choose to include such information, for example a dietary or accessibility need in your preference notes, you do so voluntarily and give your explicit consent (Art. 9(2)(a) GDPR) to its processing solely to provide the features you use, including, when an AI feature is used, sending it to our AI provider. You can remove it at any time.

• To create and manage your account and provide the Service: groups, trips, availability, voting, itineraries, expenses, chat, documents, bookings and the AI features you choose to use. Legal basis: performance of our contract with you (the Terms and Conditions), Art. 6(1)(b) GDPR.
• To send you service emails: a link to confirm your email address when you sign up or change it, and a link to reset your password when you ask for one. We don't send newsletters or marketing emails. Legal basis: performance of our contract with you, Art. 6(1)(b) GDPR.
• To keep the Service secure and working: preventing abuse, enforcing fair-use limits on AI features and diagnosing errors. Legal basis: our legitimate interest in operating a secure and reliable service, Art. 6(1)(f) GDPR.
• To keep a record of your acceptance of our Terms and Conditions and Privacy Policy. Legal basis: our legitimate interest in being able to demonstrate what you agreed to, Art. 6(1)(f) GDPR.
• To understand how the Service is used and improve it (product analytics). Legal basis: your consent, Art. 6(1)(a) GDPR, and, for storing information on your device, Art. 122 of the Italian Privacy Code, which implements the ePrivacy Directive. You can withdraw it at any time.
• To comply with legal obligations and respond to lawful requests from authorities. Legal basis: Art. 6(1)(c) GDPR.

Your name, email address and password are needed to create an account; without them we can't provide the Service. Everything else you add is optional, although some features need it to work (for example, destination suggestions need some preferences).

We don't sell your personal data, and we don't use it for advertising or share it with advertisers.

Some features of 4trips are powered by artificial intelligence (AI): destination recommendations; itinerary generation and refinement; alternative plans for a day with bad weather; itinerary translation; chat summaries ("Catch me up"); and reading booking details from a document you upload. Content produced by these features is generated by an AI system, not written by a person, and is presented in the app as suggestions. We give you this information in line with the transparency principles of the GDPR and of the EU Artificial Intelligence Act (Regulation (EU) 2024/1689).

These features only run when a trip member explicitly requests them: never automatically or in the background. To produce a result, we send the information the feature needs to our AI provider: for example the trip's dates, departure city and destination, group members' display names, preferences and notes, the feedback you typed, the chat messages to be summarised, or the uploaded document to be read. Because these are group features, a request made by one member can include information that other members of the same trip have added.

Our AI provider is Anthropic PBC (USA), whose Claude models process this data on our behalf as a data processor. Under Anthropic's commercial terms, data sent through its API is not used to train its models; Anthropic may retain it for a limited period for trust and safety purposes under its own policies.

To limit costs, we store AI results together with the request text that produced them for 6 hours. If an identical request is made within that time (even from another trip), the stored result is reused. These records are not linked to any account and are deleted after they expire.

AI suggestions can be wrong, incomplete or out of date: please check them (see our Terms and Conditions). No decision producing legal effects or similarly significantly affecting you is taken solely by automated means within the meaning of Art. 22 GDPR: AI output is only ever a suggestion, and your group and its organizer decide what to do with it. We don't use AI to profile you for advertising, and none of our uses of AI fall into the prohibited or high-risk categories of the AI Act.

We use PostHog, a product analytics service, to understand how people use 4trips so we can improve it, but only if you agree through the consent banner shown on your first visit. If you decline, or haven't chosen yet, no analytics data is collected, neither in your browser nor on our servers.

If you accept, we collect: page views; a defined list of product events (account created, group created or joined, trip created, availability or preferences submitted or skipped, destinations generated, destination voted or finalised, itinerary generated or refined, expense added, chat message sent, "Catch me up" used, document uploaded, booking added, affiliate link clicked, home page viewed, "Plan this trip" clicked on a sample itinerary, trip created from a sample itinerary, visit arriving from an AI assistant such as ChatGPT or Perplexity, recorded as the assistant name only); and technical information such as browser, device type, the referring page and approximate location derived from your IP address. Events are linked to a pseudonymous identifier and, once you are logged in, to your account ID. We never send the content of your messages, notes, documents or trip details to PostHog, and we use neither automatic click tracking nor session recording.

PostHog stores a first-party cookie and a local-storage entry (named ph_…) in your browser to recognise you across visits. Data is stored in PostHog's EU Cloud (Frankfurt, Germany); PostHog Inc. acts as our data processor.

You can change your choice at any time through the "Cookie settings" link at the bottom of the page. Withdrawing consent doesn't affect the lawfulness of processing carried out before the withdrawal.

• Strictly necessary cookies: access_token (keeps you signed in, expires after 15 minutes) and refresh_token (renews your session, expires after 30 days). Both are httpOnly cookies that scripts on the page can't read. They don't require consent because the Service can't work without them.
• Strictly necessary local storage: your chosen language, your analytics consent choice, and whether this browser was signed in last time (only a yes, no identity), so the home page can take you straight to your groups.
• Analytics (only with your consent): PostHog's cookie and local-storage entries (ph_…), kept for up to 1 year.

We use no advertising or cross-site tracking cookies.

Other members of your groups and trips, as described in section 2.

Service providers that process data on our behalf, under data processing agreements and only as needed to provide their service:

• Anthropic PBC (USA): AI features (section 4).
• PostHog Inc.: product analytics, only with your consent; data stored in the EU (section 5).
• Neon Inc.: database hosting; our database is located in Frankfurt, Germany.
• Cloudflare, Inc.: storage of uploaded documents and profile photos (Cloudflare R2) in the EU, in a private bucket reachable only through short-lived links generated for trip members.
• Fly.io, Inc.: hosting of our application server, located in the USA.
• Vercel Inc.: hosting and delivery of the web app over its global network. It also tells the app which country your IP address is in, used only to preselect the currency when you create a trip and never stored.
• Resend, Inc. (USA): sends our service emails (email confirmation and password reset), from its EU region in Ireland. It receives your name, your email address and the content of the email.
• OpenFreeMap: provides the map tiles for the itinerary map. When you open a map, your browser loads the tiles directly from OpenFreeMap's servers, which therefore see your IP address, as with any website you visit. No account or other data is sent.
• OpenStreetMap Foundation (Nominatim search service, UK): finds the places of your itinerary on the map. Our server sends only place names (such as "Basilica di San Petronio, Bologna"), never your name, account or anything else about you, and keeps the results so each place is only looked up once.

Affiliate partners: when you click a link to Skyscanner, Booking.com or Trainline, you leave 4trips. The link may contain the destination, travel dates and number of travellers to pre-fill the search, but never your name, email address or other personal data. Those sites process your data under their own privacy policies.

Google Maps: the "Open this day in Google Maps" link takes you to Google Maps with that day's place names filled in. Google then processes your visit under its own privacy policy; nothing is sent to Google unless you click the link.

Authorities, courts or other parties where required by law, or where necessary to establish, exercise or defend legal claims.

If 4trips is ever transferred to another operator (for example in a sale or merger), your data may be transferred as part of it; the new operator will be bound by this policy and we'll inform you in advance.

Some of our providers are located in the USA (Anthropic, Fly.io, Vercel, Resend) or are US companies that may access data from there. Where a provider is certified under the EU-U.S. Data Privacy Framework, the transfer is based on the European Commission's adequacy decision of 10 July 2023; otherwise it is based on the Standard Contractual Clauses approved by the European Commission (Art. 46(2)(c) GDPR), included in that provider's data processing agreement. You can ask us for more information, or for a copy of the relevant safeguards, at edoardo.create@gmail.com.

• Account data and trip content: as long as your account exists. You can delete your account yourself at any time in Account settings, or ask us to; your personal data is then erased, in any case within 30 days. Content you contributed to shared trips that other members still rely on (such as expenses or chat messages) may be kept, detached from your account.
• Uploaded documents: until a trip member deletes them, or the trip or your account is deleted.
• Travel map: until you remove a place or delete your account.
• Chat messages: as long as the trip exists. When you delete one of your messages, its text is erased at once and the others only see that a message was deleted.
• Profile photo: until you remove or replace it, or delete your account.
• Sign-in sessions: refresh tokens expire after 30 days.
• Email confirmation and password reset links: valid for 48 hours and 1 hour respectively, and deleted once used or expired. We store them only as a one-way hash.
• Cached AI results: 6 hours (section 4).
• AI usage records: as long as your account exists.
• Server logs: for a short period, usually no more than 30 days, unless needed to investigate a security incident.
• Analytics data: up to 12 months.
• Record of your acceptance of the Terms and Privacy Policy: as long as your account exists and afterwards only as long as needed to establish, exercise or defend legal claims.

Under the GDPR you have the right to:

• access your personal data and receive a copy of it (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data erased (Art. 17);
• restrict processing (Art. 18);
• receive the data you provided in a structured, machine-readable format and have it transmitted to another controller (Art. 20);
• object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Art. 21);
• withdraw your consent at any time, without affecting processing carried out before the withdrawal (Art. 7(3)).

You can correct your name and email address and delete your account yourself in Account settings. To exercise any of these rights, you can also email us at edoardo.create@gmail.com. We'll reply within one month (extendable by two further months for complex requests, in which case we'll tell you why). We may ask you to confirm your identity.

You also have the right to lodge a complaint with a supervisory authority: in Italy the Garante per la protezione dei dati personali (www.garanteprivacy.it), or the authority of the EU country where you live or work.

We protect your data with appropriate technical and organisational measures: passwords hashed with argon2, short-lived session tokens in httpOnly cookies, encrypted connections (HTTPS), documents in a private bucket reachable only through short-lived links, and access to trip data limited to its members. No system is completely secure; if a personal data breach is likely to put your rights at risk, we'll notify you and the supervisory authority as required by the GDPR.

You must be at least 16 years old to use 4trips. We don't knowingly collect data from anyone under 16; if you believe a minor has given us personal data, contact us and we'll delete it.

We may update this policy, for example when we add features or when the law changes. We'll update the date at the top and, for material changes, notify you in the app or by email before they take effect and, where required by law, ask for your consent again.

Questions, requests or concerns about your privacy: edoardo.create@gmail.com.