Rutavel

Privacy Policy

Version 1.2 · Last updated: 16 October 2026

At TravelBrain we take the protection of your personal data seriously. This policy explains what information we collect, what we use it for, who we share it with and what rights you have, in accordance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD).

1. Data controller

  • Owner: Paulino Villar Martínez
  • Tax ID (NIF/CIF): 36147400W
  • Address: Rúa Revolta, 2, 15999, Portosín
  • Contact email: app@travelbrain.dev

2. What data we collect

Depending on how you use the app, we may collect:

  • Account: first name, surname, email, password (stored encrypted, never in plain text), optional profile photo, language and time zone. If you sign in with Google or Apple, we receive the identifier for that account and your name and email.
  • Content you create: trips, places, notes, budgets and expenses, comments, votes, packing lists, and the links, texts or screenshots you share for the AI to analyse.
  • Bookings: flights, accommodation, restaurants and activities you enter or import by forwarding confirmation emails (Premium feature), including the names of travellers that appear in them and any documents you attach.
  • Conversations with the AI: messages from the trip chat and the help assistant.
  • Location: your approximate or precise location only while you use the app and only if you grant permission, to display the map and suggest nearby places. You can revoke this permission in your device settings.
  • Subscription: plan, status and transaction identifiers. We do not receive or store your card details; these are processed by Stripe, Apple or Google.
  • Technical data: IP address, device type, app version, push notification token and error reports.
  • App usage (analytics): only if you expressly accept it within the app, and you can withdraw it at any time.
  • Other people's data: if you invite someone to a trip or include companions in a booking, we process their email or name. Make sure they are aware of this; they can exercise their rights by writing to us.

3. Purpose and legal basis

  • Creating and managing your account, saving your trips and collaborating with other people: performance of the contract (Art. 6.1.b GDPR).
  • Generating itineraries, budgets, recommendations and AI-based responses from the content you share: performance of the contract (Art. 6.1.b GDPR).
  • Importing bookings from the emails you forward: your consent when forwarding them and performance of the contract (Art. 6.1.a and 6.1.b GDPR).
  • Managing your subscription and complying with tax obligations: performance of the contract and legal obligation (Art. 6.1.b and 6.1.c GDPR).
  • Sending you emails and notifications necessary for the service (verification, security, invitations, trip reminders): performance of the contract.
  • Sending you commercial communications and measuring app usage: your consent (Art. 6.1.a GDPR), which you may withdraw at any time.
  • Detecting errors and ensuring the security of the service, and responding to your enquiries through the contact form: legitimate interest (Art. 6.1.f GDPR).
  • Recording your consents (version, date and IP) and handling rights requests: legal obligation and legitimate interest (Art. 6.1.c and 6.1.f GDPR).
  • Optional cookies or storage on this website: consent (Art. 6.1.a GDPR) — see our cookie policy.

We do not make automated decisions with legal effects on you: the AI generates suggestions which you review and accept.

4. Data retention

  • Account and content: for as long as you keep your account active.
  • Account deletion: once requested, you have 30 days to cancel it. After that period we anonymise your profile; we keep in a blocked state only what the law requires us to retain.
  • Deleted trips: when you delete a trip it goes into a bin for 30 days, during which you can restore it. After that period it is permanently deleted, along with its places, itinerary, budget and images. If a trip is deleted by the TravelBrain team for moderation reasons, it is also deleted after 30 days, but it cannot be recovered.
  • Public trips you delete: if you had made a trip public and choose to keep an anonymous public copy, the copy contains only the trip content (title, description, destination, styles and places). It does not include your name, dates, personal notes, images, members, budget, comments or any link to your account, and you will not be able to withdraw it afterwards. If you prefer nothing to remain, choose “Delete completely”.
  • Billing: for the periods required by applicable commercial and tax obligations.
  • Session and verification tokens: deleted between 7 and 30 days after expiry.
  • Shared content not assigned to a trip: 90 days.
  • Consent and security log: for as long as necessary to demonstrate compliance and handle any claims.
  • Export of your data: the download link we send you expires after 24 hours.

5. Recipients and international transfers

We only share data with providers acting on our behalf and with whom we have a contract (Art. 28 GDPR):

  • Anthropic (USA): processes the content you share and your messages using AI.
  • Amazon Web Services and our hosting provider (European Union): file storage and service hosting.
  • Google (USA): sending emails, push notifications (Firebase Cloud Messaging), routes and purchases on Android.
  • Stripe: subscription payments.
  • Sentry: error reports.
  • LocationIQ, OpenRouteService and open mapping services: searching for places and routes, without your identity.

Apple and Google (app stores) and the affiliate partners you access by clicking a link act as independent controllers and are governed by their own policies.

For providers located outside the European Economic Area, we apply the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. You can request a copy of these safeguards at app@travelbrain.dev.

We do not sell your personal data to third parties.

6. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability at any time, as well as withdraw your consent where processing is based on it, by writing to us at app@travelbrain.dev or from your account settings in the app. To delete your account specifically, you can do so directly from the app or use our account deletion form. You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you believe we have not handled your data correctly.

We will respond to your request within a maximum of one month (extendable by a further two months in complex cases, notifying you accordingly). From Settings → Privacy in the app you can export your data, delete your account and manage your consents and profile visibility. We may ask you to verify your identity before processing the request.

7. Minors

The service is aimed at people over the age of 16. We do not knowingly collect data from minors under that age without the consent of their parents or legal guardians; if we detect an account belonging to a minor, we will delete it. If you are a parent or guardian and believe a minor has provided us with data, please contact us.

8. Changes to this policy

We may update this policy to reflect legal or service changes. We will publish any relevant changes on this same page together with the date of the last update.

9. Contact

For any questions about this policy or the processing of your data, please write to us at app@travelbrain.dev or through our contact page.