Privacy Policy

1. Who We Are

Itinly is a travel planning application operated by Jenny Potts trading as Itinly. We are the data controller responsible for your personal information.

Contact: jenny@itinlytravel.com

Website: https://www.itinlytravel.com

2. Information We Collect

Account information: When you create an account, we collect your name and email address.

Trip data: Destinations, itineraries, activities, dates, and notes you create within the app.

Location data: With your explicit permission, we access your device location to show your position on the map and to help you navigate to activities via your device's maps app. We do not intentionally store precise live location on our servers except where it may appear in technical logs retained only as necessary for security and troubleshooting.

Usage data: With your consent, we collect basic analytics such as the number of trips created and searches performed to help us improve the app and manage free plan limits. Analytics are not collected unless you opt in from your Profile. You can withdraw consent at any time.

Push notification tokens: If you enable notifications, we store a device token to send you trip reminders and updates. You can disable notifications at any time.

3. How We Use Your Information

We use your information to:

• Provide and maintain the app
• Save and sync your trip itineraries
• Recommend hotels and activities near your planned destinations
• Enable sharing and collaboration features
• Send trip reminders and notifications (if enabled)
• Manage subscription plans and usage limits

4. Third-Party Services

Itinly integrates with the following third-party services, each of which processes data in accordance with their own privacy policies:

OpenAI: Trip descriptions and preferences you provide are sent to OpenAI to generate and edit itineraries using AI. OpenAI processes this data according to their API data usage policy and does not use it to train their models.

Google Maps Platform: For map display and route directions between activities. Subject to Google's Privacy Policy.

Geoapify: For place search, geocoding, and location lookups. Subject to Geoapify's Privacy Policy.

Sentry: For crash reporting and error monitoring to improve app stability. Sentry may collect device information and error logs.

Pexels: For destination photos displayed on trip cards. Subject to Pexels' Terms of Service.

Booking.com: Affiliate links for hotel bookings. We do not share your personal data with Booking.com.

GetYourGuide & Viator: Affiliate links for tours and activities. We do not share your personal data with these providers.

5. International Data Transfers

Some of the third-party services we use (including OpenAI, Google, Sentry, and MongoDB Atlas) may process your data outside the United Kingdom. Where personal data is transferred internationally, we rely on appropriate safeguards such as the service provider's data processing agreements, standard contractual clauses, or adequacy decisions recognised by the UK Government.

6. Data Storage and Security

Your data is stored securely using MongoDB Atlas with encryption at rest and in transit. Authentication tokens are stored securely on your device using encrypted storage. We implement industry-standard security measures to protect your information.

7. Legal Basis for Processing

We process your personal data on the following bases under UK GDPR:

• Contract performance: To provide the trip planning service you signed up for (account data, trip data, subscription management)
• Consent: For analytics data collection (off by default until you opt in), push notifications, and location access. You can withdraw consent at any time from your Profile or device settings
• Legitimate interest: For crash reporting and service improvement, where our interest in maintaining a stable service does not override your rights

8. Your Rights

Under UK GDPR, you have the right to:

• Access your personal data through the app
• Rectify inaccurate personal data (update your name and profile information)
• Erase your personal data by deleting your account via Profile > Delete Account
• Restrict processing in certain circumstances
• Object to processing based on legitimate interest
• Data portability: Export your trip data as PDF (Pro feature)
• Withdraw consent at any time for analytics, notifications, or location access

To exercise any of these rights, contact us at jenny@itinlytravel.com. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. Data Sharing

We do not sell your personal information. Trip data is only shared with other users when you explicitly use the sharing or collaborator features. We may share aggregated, non-personally-identifiable usage statistics for analytics purposes. Such data cannot reasonably be used to identify any individual.

10. Data Retention

We retain your personal data for as long as your account is active. When you delete your account, we delete your personal data from our active systems (including trips, analytics events, friend connections, and collaborator entries). Residual copies may be removed from backups in line with our backup retention schedule. We may retain limited data where required for security, fraud prevention, legal compliance, or dispute resolution.

11. Children's Privacy

Itinly is designed for a general audience and is not directed at children. We do not knowingly collect personal information from anyone under 16. If we become aware that we have collected data from a child under 16, we will take steps to delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the app. Continued use of the app after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or your data, please contact us at:

Jenny Potts, trading as Itinly

jenny@itinlytravel.com

https://www.itinlytravel.com