Privacy Notice
Version 1.3 · effective 2026-09-15 · last updated 2026-09-15
This notice explains what we do with personal data on this website. Right now the website does one thing: it lets you join a wishlist so we can tell you when Trip Designer launches, and optionally answer a few questions about how you travel. There are no accounts, no payments and no product to log into yet.
Who we are
- Controller: Trip Designer
- Address: Barcelona, Spain
- Contact: privacy@trip-designer.com
- We have not appointed a Data Protection Officer - at our size we are not required to, and we would rather say so than name one that does not exist.
You can reach a person about anything in this notice at privacy@trip-designer.com.
What we collect, why, and on what basis
We ask for as little as we can get away with. The email address is the only required field; every survey question is optional and skippable.
You are under no statutory or contractual obligation to give us any of this, and nothing happens if you do not - there is no account to lose and no service to be refused. The only consequence of leaving the email field empty is that we cannot tell you when we launch, which is the one thing the form exists to do.
| What | Why | Legal basis |
|---|---|---|
| Email address | To email you while we build, when Trip Designer launches, and when we open a new city. | Your consent (Art. 6(1)(a)). You tick a box; you can withdraw at any time. |
| Language, and which button you signed up from | To write to you in the right language, and to understand which parts of the page work. | Our legitimate interest in running the site (Art. 6(1)(f)). |
| Survey answers - trips taken, where you'd like us to go next, planning tools, spend band, travel interests, what you do, whether you'd have paid, what annoys you about planning | To decide which cities and features we build first. | Your consent, given separately when you send the answers. Every question is optional. |
| Your name, only if you offer to talk to us | So we know what to call you when we get in touch about a short call. | Your consent. We only ask for it if you tick the interview box. |
| IP address | To rate-limit the form and run the bot check, so the signup list is not filled with junk. | Our legitimate interest in preventing abuse (Art. 6(1)(f)). |
| When you consented, and to which wording | So we can demonstrate that you agreed, and to what. | Required by Art. 7(1). |
We deliberately do not ask for your income, and the travel-interest options deliberately exclude anything that would reveal health, religion or sexual orientation. There is also no automated decision-making or profiling with legal or similarly significant effects - we look at the answers in aggregate to decide what to build.
Who else processes it
We use a small number of suppliers to run the site. Your email is stored in the EU (Frankfurt), but several of these companies are US-based even where they host in Europe, so some data is processed outside the EU under the safeguards below. We would rather say that plainly than claim your data never leaves the EU.
| Supplier | What they do | Where it is processed | Company based in | Transfer safeguard |
|---|---|---|---|---|
| Vercel | Website hosting, plus traffic and performance measurement | Frankfurt (fra1) | United States | EU-US Data Privacy Framework and/or Standard Contractual Clauses |
| Neon | Database | Frankfurt (eu-central-1) | United States | EU-US Data Privacy Framework and/or Standard Contractual Clauses |
| Upstash | Abuse prevention (rate limiting) | EU | United States | EU-US Data Privacy Framework and/or Standard Contractual Clauses |
| Cloudflare | DNS and email routing | Global edge | United States | EU-US Data Privacy Framework and/or Standard Contractual Clauses |
| Cloudflare Turnstile | Bot check on the signup form | Global edge | United States | EU-US Data Privacy Framework and/or Standard Contractual Clauses |
| Resend | Sending email | United States | United States | EU Standard Contractual Clauses |
| PostHog EU Cloud | Website analytics | Frankfurt | United States (parent) | EU-US Data Privacy Framework and/or Standard Contractual Clauses |
| Forwarding mailbox provider | Receiving email sent to us | Global | United States | EU-US Data Privacy Framework and/or Standard Contractual Clauses |
You can ask us for a copy of the safeguards relied on for any of these transfers.
How long we keep it
| What | How long |
|---|---|
| Your email address, language and which button you signed up from | 24 months |
| Your survey answers | 24 months |
| A one-way hash of your address, if you unsubscribe | Indefinitely - see below |
| Security log entries (including your IP address) | 12 months |
Those periods are outside limits, not targets: if you ask us to delete your data, we do it then, not 24 months later.
Unsubscribing and deleting are different things, and we would rather say so than blur them. Unsubscribing stops the emails: that is the consent you gave when you ticked the box, and withdrawing it is one click. Your survey answers are a separate consent, given when you sent them, for deciding what we build - so they stay, and they still count towards that. If you want them gone as well, email us and we will delete everything, usually the same week.
The one thing we keep after an erasure is a hash of your address. It is a one-way hash - we cannot turn it back into your email - and we keep it precisely so that we never add you back to the list by mistake.
Your rights
- Ask what we hold about you, and get a copy.
- Have it corrected if it is wrong.
- Have it deleted.
- Ask us to restrict or stop processing it, or object to it.
- Get it in a portable format.
- Withdraw your consent at any time - every email has an unsubscribe link, and withdrawing is as easy as giving it (Art. 7(3)).
- Complain to a supervisory authority. Ours is the Agencia Española de Protección de Datos (AEPD).
How to ask
Email privacy@trip-designer.com from the address you signed up with and say what you want. We will reply within one month. We will not ask you for identity documents to delete a mailing-list entry - replying to the address on file is enough, and demanding a passport would be worse than the risk it guards against. Our reply may come from a different address than privacy@trip-designer.com, because that alias currently only receives mail.
Age
You must be at least 16 to join the wishlist. This is our own floor rather than a legal minimum - Spanish law sets the age of digital consent lower - and we have set it to match the age limit the product itself will have.
Website analytics and session recording
If - and only if - you accept analytics, we use PostHog (EU, Frankfurt) to measure how the site is used, and to record your visit. A recording is a reconstruction of the pages as you saw them, showing movement, scrolling and clicks. It is not video, and it does not use your camera or microphone.
Every input box is masked before the recording leaves your browser, so your email address, your answer to the free-text question and your first name are never recorded. The options you select in the survey are not masked and are visible in the recording, because they form part of the page rather than something you typed. Our lawful basis is your consent, and withdrawing it stops both the analytics and the recording.
Recordings and analytics events are processed by PostHog on our behalf, under the same safeguards as the other suppliers listed above, and are kept for the period shown in the retention table. You can ask us to delete them along with the rest of your data.
Traffic and performance measurement
Independently of the analytics above, and whether or not you accept them, our host Vercel counts page views and measures how fast pages load for real visitors. Neither uses cookies nor reads anything from your device. They receive the page address, the referring page, an approximate location derived from your IP address, and your browser and device type; visits are counted with a code the server derives from the request and discards after 24 hours, so it cannot link your visits over time or across other sites. Sensitive values are removed from the address before it is sent - the token in an unsubscribe link never leaves our servers.
The lawful basis is our legitimate interest (Art. 6(1)(f)) in knowing that the site is reachable, fast, and read at all. We consider the impact low because the measurement is aggregated, first-party, not shared onward, and cannot be tied back to you - but you can object at any time under Art. 21 by emailing us, and we will exclude you.
Cookies
This site sets one cookie to remember your language choice, one to remember your analytics answer, and optional analytics cookies that are only set if you accept them. Until you accept, the analytics software stores nothing on your device. The details are in our Cookie Notice.
Security
The site is served over HTTPS, data is encrypted at rest by our suppliers, access to the database is restricted, and security-relevant events are logged. Tokens in unsubscribe links are stored only as hashes, so a copy of our database would not let anyone unsubscribe you or work out whether you are on the list.
Changes
If we change this notice we update the version and date at the top. If a change affects what you consented to, we will ask again rather than assume your existing consent covers it.