Privacy Policy

1. Data Controller

2. What Data We Collect

• Account data: Email address and password (hashed) when you create an account.
• Profile data: Name, home airport, and travel preferences you voluntarily provide.
• Usage data: Search queries and destinations viewed.
• Technical data: IP address and browser type collected automatically by hosting infrastructure.

3. Why We Process Your Data

4. Data Processors

• Supabase — authentication and database (EU/EEA)
• Vercel — hosting
• Anthropic (Claude AI) — AI recommendations
• Resend — transactional email
• Travelpayouts — flight price data and affiliate links

We do not sell your personal data to any third party.

5. Data Retention

• Account and profile data: retained until you delete your account.
• Search history: last 20 searches, older entries deleted automatically.
• After deletion: all personal data permanently removed within 30 days.

6. Your Rights (GDPR)

• Access — request a copy of your data
• Rectification — correct data via profile settings
• Erasure — delete account via Settings → Delete account
• Portability — receive data in machine-readable format
• Objection — object to processing based on legitimate interest

Contact: support@taival.ai

You may also lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).

7. Cookies and Analytics

Necessary cookies (always active): sign-in, session, language preference. These are required for the app to function and are exempt from consent under ePrivacy Directive (Recital 66).

Analytics (opt-in, requires your consent):

• Vercel Analytics — anonymous page views and country-level statistics. No personal identifiers.
• PostHog (EU-hosted server) — product analytics: search queries, feature clicks, mood selections. Signed-in users are internally identified by their Supabase user ID for cohort analysis. Anonymous users are tracked with a random ID stored in your browser.
• Vercel Speed Insights — anonymous performance metrics (Core Web Vitals) to help us optimize page speed.

Both analytics tools help us improve the product. We do not run advertising, cross-site tracking, or share this data with third parties.

You can withdraw or change your consent at any time:

8. Security

We protect your data with HTTPS, hashed passwords (bcrypt), and row-level database security. No online transmission is 100% secure.

9. Changes

We may update this policy. Significant changes will be notified by email or in-app. The date at the top shows the latest revision.

10. Contact