Privacy Policy

1. Who we are

TripOS (trip-os.org) is operated by Alberto Mendez Ceniga, an individual based in Spain, who is the data controller for your personal data. Contact for any privacy question or request: .albertomc.info@gmail.com

2. What data we collect

• Account data: email, name, username and profile photo.
• Trip data: trips, reservations (flights, hotels, activities…), budgets, notes and the confirmation emails or files you paste or upload.
• Travel documents: passport, ID, driver's licence, visa and insurance details you choose to store, including numbers, expiry dates and scans.
• Sharing data: the travel partners you add to a trip and invite links you create.
• Technical data: basic logs (IP address, browser, errors) needed to run and secure the service.

We do not collect payment card data and we do not sell your data.

3. Why we use it (legal basis)

• To provide the service you signed up for — organising and sharing your trips (performance of a contract, GDPR art. 6.1.b).
• To keep the service secure and fix errors (legitimate interest, art. 6.1.f).
• To meet legal obligations when required by law (art. 6.1.c).

4. AI reading of your confirmations

When you paste an email or upload a file, its content is sent to an AI model solely to extract the reservation details. It is not used to train models and not kept by the AI provider beyond processing. Avoid pasting information you do not want processed.

5. Who can see your data

• You. Travel documents are always private to you.
• Travel partners you add to a trip can see that trip and its reservations, plus your name, username and photo.
• Other signed-in users can find you by name or username (with your photo) to add you to a trip — never your email.
• Service providers acting on our behalf: cloud hosting and database (Lovable Cloud), and AI processing (Lovable AI). They are bound by data-processing terms.

Some providers may process data outside the EEA; in that case transfers rely on EU Standard Contractual Clauses or equivalent safeguards.

6. Affiliate links

We may show an insurance offer (SafetyWing) through an affiliate link. Clicking it takes you to their site, where their own privacy policy applies. We do not share your personal data with them.

7. How long we keep it

We keep your data while your account is active. Deleted trips stay recoverable until you delete your account. When you delete your account, all your data and files are permanently erased immediately, except minimal technical logs kept up to 30 days.

8. Security

Data is encrypted in transit, access is restricted per user by database rules, files are stored in private storage and only served through short-lived links.

9. Your rights

Under the GDPR you can at any time:

• Access and portability — download all your data from Profile → "Download my data".
• Rectification — edit your data directly in the app.
• Erasure — delete your account from Profile → "Delete account".
• Restriction and objection — email us at .albertomc.info@gmail.com

We reply within one month. You can also complain to the Spanish Data Protection Agency (AEPD, aepd.es) or your local authority.

10. Children

TripOS is not intended for children under 14. Minors can be listed as passengers by an adult account holder.

11. Changes

We will post any update on this page and change the date above. Significant changes will be notified in the app.