Skip to main content

Privacy policy

What we know about you, why, for how long, and what you can do about it.

Last updated: August 18, 2026.

The data controller is the publisher of the site, identified in the legal notice.

Your answers to the five questions: kind of trip, destination, dates, who is coming, budget. Your email address if you open an account or ask for a resume link. Your country of residence, which decides which modules are shown. Aggregated audience measurements, if you accept them.

To compose your itinerary, to let you come back to it from another device, to send you the emails you asked for, and to understand what works badly in the service.

Performance of the service you asked for, for your answers and your itinerary. Your consent, for information emails and audience measurement. Our legitimate interest in keeping the service running, for the technical logging of errors.

No data is deleted automatically to date: no scheduled job purges trips left unfinished or inactive accounts, and no warning is sent before a deletion. Announcing a period that nothing enforces would be worse than announcing none. The period we want to settle on — thirteen months without activity — is still for the publisher to decide and then to put in place, and this page will be revised then. Until then, erasure of your data is requested at the contact address in the legal notice, which is itself still to be opened. Technical logs are kept for as long as our error reporting provider keeps them, which is still to be filled in.

Our technical providers, and nobody else: the hosting of the site (Vercel Inc.), the database (Neon), the sending of emails (Brevo), error reporting (Sentry) and audience measurement (PostHog). The repository configuration places the database in the European region “eu-central-1” and audience measurement on PostHog's European instance. Two points must be confirmed by the publisher before the service goes live, and we do not state them until they are: the regions actually chosen with each provider, and whether any data is transferred outside the European Union — Vercel Inc. is a United States company — and, if there is such a transfer, the safeguards it rests on. We sell no data and trade none of it for advertising.

A link to a partner must carry only the destination, the dates and the number of people: never your name, your email address, your telephone number, your postal address or a means of payment. No page carries such a link yet. This is a rule we impose on ourselves in the way the code is organised, not a device that would guarantee it: the automated check that goes with it covers only the package that will build those links, and not the rest of the code. It will have to be widened before the first partner link goes live.

Only the trackers needed to run the service are set without your agreement. Audience measurement waits for your consent, and refusing it takes nothing away from what the service can do.

You may ask for access to your data, for it to be corrected, erased or ported, for its processing to be restricted, and you may withdraw your consent whenever you want. Requests go to the contact address in the legal notice, which is still to be opened: until it is, none of these requests can reach us, and we would rather write that down than let you believe otherwise.

If our answer does not satisfy you, you may lodge a complaint with the French data protection authority.

Back to the home page

Privacy policy · Karavanto