Privacy Policy

1. Data Controller

2. What Data We Collect

• Account data: Email address and password (hashed) when you create an account.
• Profile data: Name, home airport, and travel preferences you voluntarily provide.
• Usage data: Search queries and destinations viewed.
• Technical data: IP address and browser type collected automatically by hosting infrastructure.

3. Why We Process Your Data

4. Data Processors

• Supabase — authentication and database (EU/EEA)
• Vercel — hosting
• Anthropic (Claude AI) — AI recommendations
• Resend — transactional email
• Travelpayouts — flight price data and affiliate links

We do not sell your personal data to any third party.

5. Data Retention

• Account and profile data: retained until you delete your account.
• Search history: last 20 searches, older entries deleted automatically.
• After deletion: all personal data permanently removed within 30 days.

6. Your Rights (GDPR)

• Access — request a copy of your data
• Rectification — correct data via profile settings
• Erasure — delete account via Settings → Delete account
• Portability — receive data in machine-readable format
• Objection — object to processing based on legitimate interest

Contact: support@taival.ai

You may also lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).

7. Cookies

We use technically necessary cookies for session management. We also use Vercel Analytics to collect anonymous, aggregated usage statistics (page views, country-level data). No personal identifiers are stored and no advertising or cross-site tracking cookies are used.

8. Security

We protect your data with HTTPS, hashed passwords (bcrypt), and row-level database security. No online transmission is 100% secure.

9. Changes

We may update this policy. Significant changes will be notified by email or in-app. The date at the top shows the latest revision.

10. Contact