Privacy Policy

Tobias Paltz
Friedrich-Ebert-Straße 8
66131 Saarbrücken, Germany

Email: support@travault.app
Imprint: https://travault.app/impressum

Categories of personal data processed

• Account data (email address, account identifiers)
• Authentication data (hashed passwords)
• Profile and preference data (quiz answers regarding travel style, pace, budget, interests)
• Travel data (trips, day plans, cover images, visited countries, packing lists, flights, expenses and cost splitting)
• Location data (on-demand only, during active use)
• Content data (notes, plan entries, communications, files and photos you select for scanning)
• Contact data (email addresses)
• Contract data (premium status, product identifier, expiry date, Apple transaction identifiers, purchase and subscription events from Apple)
• Usage data (interactions with app functions)
• Meta-, communication and procedural data (IP addresses, timestamps)
• Log data (server log files)

Categories of data subjects

• Users of the app and website
• Communication partners (e.g. when contacting support)
• Business and contractual partners

Purposes of processing

• Providing app services and fulfilling contractual obligations
• Account management and authentication
• Personalization of travel suggestions
• AI-assisted travel planning
• AI-based recognition of booking data and receipts (on your request)
• Provision of weather, activity, flight-status and exchange-rate data as well as cover images
• Adding trips and flights to the device calendar
• Processing and management of premium subscriptions
• Trip sharing between users
• Communication with users
• Security and abuse prevention
• Affiliate commission accounting
• Compliance with legal obligations

Under the General Data Protection Regulation (GDPR), we rely on the following legal bases:

• Consent (Art. 6(1)(a) GDPR) – The data subject has given consent to the processing of their personal data for one or more specific purposes.
• Performance of a contract and pre-contractual measures (Art. 6(1)(b) GDPR) – Processing is necessary for the performance of a contract or pre-contractual measures.
• Legal obligation (Art. 6(1)(c) GDPR) – Processing is necessary for compliance with a legal obligation.
• Legitimate interests (Art. 6(1)(f) GDPR) – Processing is necessary for the legitimate interests of the controller or a third party, except where overridden by the interests or fundamental rights of the data subject.

In addition to the GDPR, German national data protection law (in particular the Federal Data Protection Act – BDSG) applies.

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, implementation costs, and the nature, scope, context and purposes of processing.

Our concrete security measures include:

• Transport encryption (TLS/SSL/HTTPS): All data transmissions between your device, our app, the website, and our backend services occur exclusively via encrypted connections.
• Local encryption of sensitive data (AES-256): Travel documents (passport, ID, visa data, etc.) are stored exclusively on your device using AES-256 encryption. They never leave the device.
• Password hashing: Account passwords are never stored in plaintext, but only as cryptographically secure hashes via our auth provider (Supabase Auth).
• Access restriction via Row-Level Security (RLS): Our database backend (Supabase / PostgreSQL) enforces a Row-Level Security policy on every table. This technically guarantees that each user can only access their own data.
• EU server location: Our primary backend (database, authentication, file storage) is operated in Frankfurt am Main, Germany (AWS region eu-central-1).
• IP address truncation (IP masking): Where IP addresses are processed and the full address is not required, they are truncated to make identification more difficult.
• Authenticated API access: All access to our server-side functions (e.g. AI suggestions) requires a valid authentication token. Unauthenticated requests are rejected.
• Rate limiting: AI requests are limited per user per day to prevent abuse.
• Data minimization: We only collect data that is necessary for the respective function. We do not use any tracking, analytics, or advertising IDs.

In the course of processing personal data, the data may be transferred to other entities, companies, or persons. Recipients may include IT service providers or providers of services and content embedded in our app or website. In such cases, we comply with all legal requirements and conclude appropriate contracts (e.g. data processing agreements) with the recipients.

The following sections (in particular Sections 9 to 16 and 19 to 23) provide concrete information on the individual service providers we use, their location, and the data transferred to them.

Where we transfer data to a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or where this occurs through the use of third-party services, this always takes place in accordance with legal requirements.

For data transfers to the United States, we rely primarily on the Data Privacy Framework (DPF), recognized by the European Commission's adequacy decision of July 10, 2023. In addition, we have concluded Standard Contractual Clauses (SCC) with the respective providers in line with the European Commission's requirements.

This dual safeguard provides comprehensive protection: the DPF forms the primary layer of protection, while the SCC serve as additional security and a fallback. Should the DPF undergo changes, the SCC will continue to apply as a reliable safeguard.

For each individual service provider, we indicate whether they are DPF-certified and whether SCC are in place. More information on the DPF and a list of certified companies can be found at https://www.dataprivacyframework.gov/.

We delete personal data once the original purpose ceases to apply or once the data is no longer required, unless a longer retention period is required by law (e.g. tax or commercial law obligations).

Account deletion by the user: You can delete your account at any time directly in the app (Settings → Delete Account). Upon account deletion, all data linked to your account (travel data including flights, expenses and settlements, quiz answers, visited countries, packing lists, nicknames, premium status including the mapping of your Apple purchase identifier and the log of subscription purchase events (see Section 16), auth data) is irreversibly deleted from our database. The app also removes the data belonging to your account that is stored locally on the device you are using (in particular the encrypted travel documents). Local data on other devices on which you have installed Travault is removed by uninstalling the app.

Retention periods under German law:

• 10 years – Books, records, annual financial statements, inventories, management reports, opening balance sheets, and related documentation (§ 147(1) No. 1 in conjunction with (3) AO; § 14b(1) UStG; § 257(1) No. 1 in conjunction with (4) HGB).
• 8 years – Accounting documents such as invoices and receipts (§ 147(1) Nos. 4 and 4a in conjunction with (3) sentence 1 AO; § 257(1) No. 4 in conjunction with (4) HGB).
• 6 years – Other business documents.
• 3 years – Data required to consider potential warranty and damages claims or similar contractual claims (§§ 195, 199 BGB).

Period commencement at year-end: Where a period does not begin on a specific date and is at least one year long, it automatically commences at the end of the calendar year in which the triggering event occurred.

Under the GDPR, in particular Articles 15 to 21, you have the following rights:

• Right to object: You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data based on Art. 6(1)(e) or (f) GDPR.
• Right to withdraw consent: You may withdraw any consent given at any time.
• Right of access: You have the right to obtain confirmation as to whether personal data concerning you is being processed and, if so, access to that data and further information.
• Right to rectification: You have the right to obtain the completion of incomplete data or the rectification of inaccurate data.
• Right to erasure and restriction of processing: You have the right to request deletion of your data or alternatively the restriction of processing.
• Right to data portability: You have the right to receive your data in a structured, commonly used, machine-readable format.
• Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority.

Competent supervisory authority for us:

Unabhängiges Datenschutzzentrum Saarland
Die Landesbeauftragte für Datenschutz und Informationsfreiheit
Fritz-Dobisch-Straße 12
66111 Saarbrücken, Germany
Phone: +49 681 94781-0
Email: poststelle@datenschutz.saarland.de
Website: https://www.datenschutz.saarland.de

We process user data in order to provide our online services (app and website). For this, we process the user's IP address, which is necessary to deliver content and functions to the user's device.

• Categories of data processed: Usage data, meta- and communication data (in particular IP addresses, timestamps), log data (server log files).
• Data subjects: Users.
• Purposes: Provision of the online service, IT security, stability and performance.
• Retention: Log file information is stored for a maximum of 30 days and then deleted or anonymized. Data whose further retention is necessary for evidentiary purposes is exempt from deletion until the respective incident has been finally resolved.
• Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).

Service providers used

Vercel (Website Hosting and CDN)

Provider: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA.
Function: Hosting of the website travault.app, including a global Content Delivery Network (Edge Network).
Data processed: IP address, request date/time, browser information (user agent), referrer URL, server log files.
Third-country transfer: USA. Vercel is certified under the EU-U.S. Data Privacy Framework; in addition, Standard Contractual Clauses are in place.
Privacy Policy: https://vercel.com/legal/privacy-policy
Data Processing Agreement: https://vercel.com/legal/dpa

Supabase (Backend, Database, Authentication, Storage, Edge Functions)

Provider: Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992 (US headquarters).
Function: Database hosting, user authentication, file storage (cover images), server-side functions (Edge Functions).
Data processing takes place in Frankfurt am Main, Germany (AWS region eu-central-1). No third-country transfer of content data occurs.
Data processed: Email address, hashed password, account metadata, travel data including flights and expenses, quiz answers, cover images, AI usage statistics, premium status and the log of subscription purchase events.
A Data Processing Agreement (DPA) under Art. 28 GDPR has been concluded with Supabase.
Privacy Policy: https://supabase.com/privacy
DPA: https://supabase.com/legal/dpa

To use the full range of app functionality, the creation of a user account is required. Account management is handled by our processor Supabase (see Section 9).

Account data

Upon registration we process:

• Email address
• Password (stored exclusively as a cryptographic hash, never visible in plaintext)
• Account creation timestamp and onboarding status

Quiz data for personalization

During onboarding we offer a voluntary travel quiz where you may provide information on your travel style, pace, budget, and interests. We use these answers solely to display tailored AI suggestions and recommendations. The quiz can be skipped; in that case generic suggestions will be shown.

Travel data

In the course of using the app, we process the data you voluntarily enter about your trips:

• Trip name, destination, travel period
• Day plans (plan entries with date, activity, notes)
• Bucket-list entries (without date)
• Cover images of your trips
• Visited countries (for the world-map feature)
• Packing lists (predefined and custom)
• Flights (flight number, date, departure and arrival airport, departure and arrival times, airline, seat, booking reference). Ticket photos stay encrypted on your device; the database only records whether a ticket photo exists.
• Expenses and cost splitting (description, amount, category, date, who paid and between whom it is split; for foreign currencies also the original amount, original currency and the exchange rate used) as well as settlement payments between travel companions

Categories of data: Account data, profile and preference data, content data, usage data.
Data subjects: Users.
Purposes: App functionality, personalization, contract performance.
Retention: Until account deletion by the user.
Legal basis: Performance of a contract (Art. 6(1)(b) GDPR); for the quiz, consent (Art. 6(1)(a) GDPR).

Travault allows you to store sensitive travel documents such as passports, ID cards, visas, driver's licenses, and vaccination records within the app.

Technical implementation: These documents are stored exclusively on your local device using AES-256 encryption. They are not transmitted to our servers, not stored in the cloud, and at no point accessible to us.

These documents are not transferred to third parties; the app has no feature for sharing vault documents.

The "Scan booking" feature is separate from this: files you select there yourself are transmitted to our AI service provider to recognize the booking data (see Section 14).

When you uninstall the app, all locally stored travel documents are irrevocably removed from your device.

Note: Because the documents are processed exclusively locally, no processing of these documents within the meaning of the GDPR takes place by us.

Travault allows users to share trips with other Travault users (e.g. travel companions, family, friends).

How it works: You can generate an invite code and pass it to the person with whom you want to share a trip. Upon acceptance, that person becomes a member of the trip and can access the shared content.

Categories of data processed:

• Invite codes (randomly generated, time-limited)
• Membership relations (Trip-ID + User-ID)
• Your display name, which is shown to the other members of a shared trip
• Nicknames that members can give each other within a trip (visible only to the members of that trip)
• Travel companions without a Travault account whom a member adds for cost splitting (name and colour)
• Shared trip content (plans, notes, flights, expenses and cost splitting)

Data subjects: Users (both trip owner and invited members) as well as travel companions without an account who are added by members.
Purposes: Provision of the sharing functionality, contract performance.
Legal basis: Performance of a contract (Art. 6(1)(b) GDPR) and consent of both parties involved (Art. 6(1)(a) GDPR); for added travel companions without an account, legitimate interests in shared cost splitting (Art. 6(1)(f) GDPR).
Retention: Until the user leaves the trip or deletes the account.

You may end your trip membership at any time by leaving the trip in the app.

Travault processes your location data exclusively on-demand — only when you actively use a location-based function (e.g. suggestions for nearby activities).

We do not track your location in the background. No continuous or background location tracking takes place. No GPS trail is created or stored.

Technical implementation: When a location-based function is invoked, the operating system (iOS) prompts you for permission. You may revoke this permission at any time in iOS settings. The determined location (coordinates) is held only briefly in memory, passed to the relevant function (in particular the AI suggestions near you, see Section 14), and not permanently stored. If you open a suggested place in Apple Maps during an ongoing trip, the app passes your location to Apple Maps as the search center.

If you have switched on location use for today’s suggestions in the day plan (this happens the first time you tap “Use my location”), the app uses your location every time it generates suggestions for the current day, as long as the iOS permission remains granted; a marker in the day plan shows this and switches it off at any time. To tell you that you are far from your planned trip stop, the app compares your location with the stop’s coordinates on the device only; your location is not transmitted to anyone for this.

Categories of data: Geo-coordinates (short-term).
Data subjects: Users.
Purposes: Provision of location-based functions.
Legal basis: Consent (Art. 6(1)(a) GDPR) — granted by confirming the iOS permission dialog.
Retention: No permanent storage.

Travault offers AI-assisted travel suggestions (e.g. day-plan recommendations based on your destination and mood). This feature uses the language model Claude Haiku 4.5 by Anthropic.

Data flow:

1. You select a mood/preference within the app (e.g. "active", "relaxed", "culturally curious").
2. Our app sends a prompt to our own server-side function (Supabase Edge Function `ai-proxy`, region Frankfurt).
3. This Edge Function forwards the prompt to Anthropic's API in the United States.
4. Anthropic processes the prompt and returns a response, which we display in the app.

Data transmitted to Anthropic:

• Travel destination (e.g. "Rome") or the trip stop of the day or a day place you entered
• Travel date/period
• Your mood/preference selection
• Your current location (coordinates, rounded to about 10 metres), if you request suggestions near you and have granted location access
• Optionally anonymized quiz data (travel style, budget category, etc.)
• Already shown suggestions (to avoid repetition)

Not transmitted:

• Your name or email address
• Your account ID in our database
• Travel documents from your local document storage (exception: files you select yourself for scanning, see below)
• IP address or other direct identifiers

Recognition of bookings and receipts

You can also have the AI read booking confirmations and receipts so you do not have to type the details. This only happens when you start the respective scan feature yourself:

• Scan booking: You select a PDF file or an image (e.g. a screenshot) or paste the text of a booking email. The app recognizes details such as the provider, booking number, travel dates, places and flight number.
• Scan receipt: You take a photo of a receipt with the camera. The app recognizes the amount, currency and description for a new expense.

The content of the selected file, the pasted text or the photo is transmitted to Anthropic via our Edge Function `ai-proxy`. This content may contain personal data, such as your name or a booking number. We do not store the file or photo itself on our servers. You then take the recognized details into the app: flights and expenses are stored in our database as described in Section 10, other bookings only locally on your device.

Provider: Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA.
Third-country transfer: USA. Anthropic is certified under the EU-U.S. Data Privacy Framework; Standard Contractual Clauses are also in place. Under its Commercial Terms, Anthropic does not by default use the data submitted via the API to train its models.
Categories of data: Profile and preference data (anonymized), content data (trip context; when using the scan features, the selected files, texts and photos).
Data subjects: Users.
Purposes: Provision of the AI-assisted travel-planning function.
Legal basis: Performance of a contract (Art. 6(1)(b) GDPR) — the AI feature is a core contractual feature of the app.
Rate limiting: The number of AI requests per user per day is limited. The specific limits vary depending on the request type and subscription status (Free / Plus). Current limits may change to prevent abuse and ensure fair use.
Anthropic Privacy Policy: https://www.anthropic.com/legal/privacy
Commercial Terms: https://www.anthropic.com/legal/commercial-terms

For displaying current and forecast weather data for your travel destinations, we use the OpenWeather API.

Data flow: When a weather-related function is invoked, the app sends the name of your travel destination or trip stop (with country code where available) to the OpenWeather API. Your location is not used for this. The API returns weather data, which we display.

Geocoding of trip stops: When you save trip stops, the app uses the same provider’s geocoding service to determine the coordinates of the place name you entered. Here too only the place name (with country code where available) is transmitted, never your location; the response is a pair of coordinates, not weather data.

Data transmitted to OpenWeather:

• Name of the travel destination or trip stop
• IP address (technically required by HTTP request)

Provider: OpenWeather Ltd., United House, 9 Pembridge Road, London, W11 3JY, United Kingdom. Server location: Estonia (EU).
Third-country transfer: United Kingdom — covered by the EU Commission's adequacy decision (Brexit Adequacy Decision of June 28, 2021). No third-country transfer in the strict sense.
Categories of data: Travel data (destination), meta/communication data (IP).
Purposes: Provision of weather information.
Legal basis: Legitimate interests (Art. 6(1)(f) GDPR) and/or performance of a contract (Art. 6(1)(b) GDPR).
Privacy Policy: https://openweather.co.uk/privacy-policy

The Travault app is distributed via the Apple App Store. The app is currently in TestFlight beta phase. The app contains optional paid premium features ("Travault Premium"), which are purchased as a subscription via Apple In-App Purchases (IAP).

Provider: Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA, or Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland (for EU users).

Data processed by Apple: Apple ID, device ID, purchase history, payment data (for IAPs), crash and performance data (if enabled), TestFlight participation status.

Important: Processing of your Apple ID, payment data, and purchase history takes place exclusively by Apple. We do not receive payment data or other personal financial information from Apple, and we use no service provider for purchase management.

Third-country transfer: USA. Apple is certified under the EU-U.S. Data Privacy Framework.
Apple Privacy Policy: https://www.apple.com/legal/privacy/en-ww/
Privacy notices for app use: Apple's own privacy notices for app purchases and subscriptions apply in addition.

How we verify and store your premium status

To unlock premium features and assign the AI quotas correctly, we ourselves process the following purchase information, cryptographically signed by Apple:

• From the app to our server (Supabase, Frankfurt): after a purchase, a restore and at app start, the app sends the transaction proofs signed by Apple ("signed transactions") to our server function, which verifies the signature against Apple's root certificate.
• From Apple to our server: Apple informs our server function about changes (renewal, cancellation, expiry, refund, revocation; "App Store Server Notifications"). These messages are signed by Apple as well and are processed only after successful signature verification.

Data contained: transaction and original transaction identifier, product identifier, purchase, expiry and, where applicable, revocation time, environment (test/production), type of access (purchase or Family Sharing), and the randomly generated identifier of your Travault account, which the app registers with Apple at purchase time as the "appAccountToken". Your Apple ID, your name and your payment data are not included.

Stored in our database: premium status, product identifier and expiry date in your profile; the mapping of the Apple purchase identifier to your account (including any revocation); an event log (event ID, event type, environment, transaction identifiers, account identifier, timestamps) so that each message is processed only once. The signed proofs themselves are not stored.

Retention: until account deletion; the event log and the mapping are deleted together with the account. Apple's own purchase history is unaffected.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
No third-country transfer for this processing: verification and storage take place in Frankfurt; the messages go from Apple to our server.

Travault uses local push notifications only. These are scheduled and triggered directly on your device by the app itself (e.g. reminders for upcoming trips or day plans).

We do not use remote push notifications and no external push services (such as the Apple Push Notification Service via server, Firebase Cloud Messaging, etc.). No device tokens or comparable identifiers are transmitted to our servers or to third parties.

You can disable push notifications at any time in iOS settings for Travault.

Categories of data: No transfer to third parties; purely local processing.
Legal basis: Consent via iOS permission dialog (Art. 6(1)(a) GDPR).

We process personal data of our contractual and business partners — such as customers and prospective customers — for the initiation, performance, and conclusion of contractual relationships and similar legal relationships. This includes pre-contractual measures upon request and communications relating to the contractual relationship.

For Travault, this primarily means providing the app's functionality, managing your account, and processing any in-app purchases (via Apple).

We process master data (email address, account ID), contract data (subscription status), usage data, and communication content. Where necessary, we also process data disclosed during the handling of an inquiry.

We also process data to safeguard our rights and to fulfill legal obligations, in particular commercial- and tax-law retention obligations.

• Categories of data: Account data, contact data, contract data, usage data, meta/communication data.
• Data subjects: Users, prospective customers, business and contractual partners.
• Purposes: Provision of contractual services, security, communication, business processes.
• Retention: As per Section 7.
• Legal basis: Performance of a contract (Art. 6(1)(b) GDPR), legal obligation (Art. 6(1)(c) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

When you contact us (e.g. by email at support@travault.app), the information you provide is processed to the extent necessary to respond to your inquiry and any requested actions.

Service providers used

IONOS (email hosting)

Provider: IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany.
Function: Hosting of our travault.app domain, including mail mailboxes.
Data processed: Content and metadata of incoming emails.
Third-country transfer: None (Germany).
Privacy Policy: https://www.ionos.com/terms-gtc/terms-privacy/

Google (email reception via forwarding)

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent: Google LLC, USA).
Function: Emails sent to support@travault.app are technically received by IONOS and automatically forwarded to a Gmail mailbox where we process them.
Data processed: Content and metadata of forwarded emails.
Third-country transfer: USA (intra-group). Google is certified under the EU-U.S. Data Privacy Framework.
Privacy Policy: https://policies.google.com/privacy

Note: If you wish to avoid this processing by Google, please contact us via an alternative channel (e.g. by post to the address in Section 1).

• Categories of data: Contact data (email), content data (message), meta/communication data.
• Data subjects: Communication partners.
• Purposes: Communication, inquiry handling.
• Retention: Inquiries are deleted after the matter has been finally resolved, unless statutory retention periods apply.
• Legal basis: Performance of a contract (Art. 6(1)(b) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

Our app contains so-called affiliate links to offers by third-party providers. If users follow these links and subsequently make a booking, we may receive a commission from the third-party provider. This is part of our business model and allows us to offer the basic functionality of the app for free.

GetYourGuide Partner Program

Provider: GetYourGuide Deutschland GmbH, Sonnenburger Straße 73, 10437 Berlin, Germany.
Function: Affiliate links to tours and activities on getyourguide.de or getyourguide.com. When a user clicks such a link, they are redirected to the GetYourGuide offer.

Personal data is transmitted to GetYourGuide only upon click. Before the click, no data is transferred — in particular no tracking pixels, cookies, or scripts from GetYourGuide are loaded.

Data transmitted upon click:

• IP address
• Browser and device information (user agent)
• Timestamp
• Our partner ID (RVLFLHH) for commission attribution
• Possibly cookie IDs (set by GetYourGuide after our redirect)

Third-country transfer: None (Germany).

• Categories of data: Usage data, meta/communication data, contract data (in case of a booking).
• Data subjects: Users.
• Purposes: Affiliate tracking, commission accounting.
• Legal basis: Legitimate interests (Art. 6(1)(f) GDPR — economic monetization of the online service).
• GetYourGuide Privacy Policy: https://www.getyourguide.com/c/privacypolicy

For the cover images of your trips we use the image library Unsplash.

Data flow: When you create a trip, the app searches Unsplash for a suitable photo. To do so, it sends a search term derived from the destination or trip name to the Unsplash API. We store the address of the image found together with the trip. The image itself is loaded directly from Unsplash's servers each time it is displayed.

Data transmitted to Unsplash:

• Search term (destination or trip name)
• IP address (technically required by HTTP request)

Your name, email address and account ID are not transmitted.

Provider: Unsplash, Inc., 1240 20 Ave SE, Suite 301, Calgary, AB T2G 1M8, Canada.
Third-country transfer: Canada. An adequacy decision of the European Commission exists for Canada (Decision 2002/2/EC). Unsplash states that it may also process data in other countries where it has facilities or engages service providers.
Categories of data: Content data (search term), meta/communication data (IP address).
Purposes: Appealing presentation of trips in the app.
Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).
Privacy Policy: https://unsplash.com/privacy

For flights you add to a trip, the app can display the current flight status (e.g. scheduled and actual times, delays, cancellations).

Data flow: The app requests the status directly from the flight-data API AeroDataBox, which is provided via the API marketplace RapidAPI. The request passes through RapidAPI's servers. The result is cached only locally on your device.

Data transmitted:

• Flight number and flight date
• IP address (technically required by HTTP request)

Your name, booking reference, seat and account ID are not transmitted. According to its own information, AeroDataBox logs the complete API request and the IP address of the requesting device; when used via an API marketplace, this data may also be stored there.

Providers:

• Data source: AeroDataBox [OPEN: operator and registered office, not stated on aerodatabox.com]
• Intermediary: RapidAPI [OPEN: legal entity and address, not confirmed]

Third-country transfer: [OPEN: country and transfer mechanism (DPF or Standard Contractual Clauses) for AeroDataBox and RapidAPI]
Categories of data: Content data (flight number, date), meta/communication data (IP address).
Purposes: Display of flight status.
Legal basis: Performance of a contract (Art. 6(1)(b) GDPR).
AeroDataBox Privacy Policy: https://aerodatabox.com/privacy
RapidAPI Privacy Policy: https://rapidapi.com/privacy

To convert expenses in different currencies (cost splitting), the app retrieves daily exchange rates from the public Frankfurter API.

Data flow: The app requests the rates for a base currency (e.g. "EUR"). The rates are then cached only locally on your device. Your expenses, amounts and names are not transmitted to the API.

Data transmitted:

• Code of the base currency
• IP address (technically required by HTTP request)

According to its own statement, the Frankfurter API does not collect or log personal data, IP addresses or request URLs.

Data source: Reference rates from central banks and official sources.
Provider: Frankfurter, open-source project (frankfurter.dev) [OPEN: operator and registered office, not stated on frankfurter.dev]
Categories of data: Meta/communication data (IP address).
Purposes: Conversion of expenses in different currencies.
Legal basis: Performance of a contract (Art. 6(1)(b) GDPR).

On request, Travault adds your trips and flights to your iPhone's calendar.

How it works: You can add trips as an event at the push of a button. The app adds flights as events, updates the event when the flight changes and removes it when you delete the flight. Travault does not read or process any other entries in your calendar.

Why full access: iOS only allows an app to change and delete its own events later with full calendar access. This is why Travault requests this permission.

Storage: The events are stored in your device's calendar. The app stores the link between a flight and its event only locally on your device; it is not transmitted to our servers. If you sync your calendar with a cloud service (e.g. iCloud), that service processes the events under its own terms.

Categories of data: Travel data (destination, period, flight details), purely local on your device.
Legal basis: Consent (Art. 6(1)(a) GDPR), granted via the iOS permission dialog. You can revoke access at any time in iOS settings.

Some features need access to your iPhone's hardware or data. iOS asks for your permission before the first access. You can revoke any permission at any time in iOS settings. Travault requests the following permissions:

• Camera: to scan travel documents and ticket photos and to photograph receipts. Documents and ticket photos are stored encrypted only on your device (see Section 11). Photos of receipts are transmitted to our AI service provider to recognize the amount and are not stored (see Section 14).
• Photos (read): to import documents from your photo library. Imported documents are stored encrypted only on your device, like scanned documents.
• Photos (add): to save trip cards to your photo library when you choose "Save Image" in the share menu. This happens purely locally.
• Face ID / Touch ID: to protect your stored documents. iOS performs the biometric check; the app only receives the result (successful or not) and no biometric data.
• Calendar: to add, update and remove trips and flights (see Section 24). The events stay in your device calendar.
• Location: for suggestions near you, only while using the app and only on request (see Section 13). For this purpose the location is transmitted to our AI service provider (see Section 14) and not permanently stored. Travault does not request background location access.
• Notifications: for local reminders (see Section 17).

Legal basis: Consent (Art. 6(1)(a) GDPR), granted via the respective iOS permission dialog.

We ask you to review the content of our Privacy Policy regularly. We adapt this Privacy Policy as soon as changes in our data processing activities require it. We will inform you as soon as the changes require any action on your part (e.g. consent) or other individual notification.

Where we provide addresses and contact details of companies and organizations in this Privacy Policy, please note that addresses may change over time and we ask you to verify the information before contacting them.

• Affiliate tracking: The logging of links by which we refer users to external offers. If a user follows an affiliate link and avails of an offer, we may receive a commission. Technical values (e.g. partner ID, timestamp) are transmitted to the affiliate partner for this purpose.

• AES-256: Advanced Encryption Standard with 256-bit key length — a symmetric encryption algorithm considered cryptographically secure and internationally established (approved e.g. by US government agencies for top-secret data).

• Account data: Data essential for identification and management of user accounts and contractual partners — in particular email address, account ID, and profile master data.

• Data Privacy Framework (DPF): Agreement between the EU and the USA, recognized as an adequacy decision since July 10, 2023, allowing legally secure data transfers to certified U.S. companies.

• Content data: Data generated in the course of creating content — for Travault, e.g. trip notes, plan entries, quiz answers.

• Contact data: Data enabling communication with persons, in particular email addresses.

• Meta-, communication and procedural data: Information about the manner of data processing — IP addresses, timestamps, device identifiers, log file entries.

• Usage data: Data on the use of digital products — which functions are used when, dwell time, click paths.

• Personal data: All information relating to an identified or identifiable natural person (Art. 4(1) GDPR).

• Log data: Server log files and comparable technical records of system events stored for security and operational purposes.

• Row-Level Security (RLS): A database mechanism that technically enforces, at the row level, that a user can only access their own data — even if the application layer should fail.

• Standard Contractual Clauses (SCC): Contractual clauses published by the European Commission to ensure an adequate level of data protection in transfers to third countries.

• Controller: A natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

• Processing: Any operation involving personal data — collection, storage, modification, retrieval, transmission, deletion.

• Contract data: Information on agreements between user and provider, e.g. subscription status, contract term, purchase history.