Privacy Policy

This English text is provided for convenience only. In the event of any discrepancy, the French version is the binding one.

1. WHO PROCESSES YOUR DATA

Dareviz is an online service that lets you gather the travel content you have found and turn it into an itinerary. This policy explains which data is processed along the way, why, for how long, and what you can require.

It is written in accordance with the General Data Protection Regulation (EU 2016/679) and the French Data Protection Act of 6 January 1978 as amended.

Given its size and the nature of its processing, Dareviz is not required to appoint a data protection officer. Any question about your data is handled at the address above.

2. WHAT DATA IS PROCESSED

2.1 Your account

• First name and email address
• Password, stored in hashed form and never readable by us
• If you create your account with Google, your first name, your email address and your Google ID reach us this way, with no password for us to store
• Account creation date and date of last sign-in

2.2 Your subscription

The purchase is made from Lemon Squeezy, which sells in its own name. From it we receive the name, email address, billing country, plan chosen and payment status.

Your bank details never reach us and at no point pass through our servers.

2.3 What you gather in the service

• The links, texts and notes you submit for analysis
• The resulting activity cards, your trips and your itineraries
• The people you invite to a collaborative trip, and their contributions

2.4 The waiting list

If you sign up to be told when the mobile app launches, we keep your first name and your email address, and nothing else.

2.5 Your messages

If you write to us through the contact form, give us your feedback or report a bug from the app, we receive what you typed: your name or first name, your email address, your message, the rating you give and, for a bug, the page concerned.

2.6 Technical data

• IP address, browser and device type, in the server logs
• Number of extractions used, to apply your plan's allowance
• Sign-in dates and times, for account security
• When you sign up, an anti-bot score computed by Google reCAPTCHA from your IP address and technical signals from your browser
• When you sign up, your IP address, to limit the number of accounts opened from the same connection and to be able to identify who opened an account in case of abuse, and your email address in a normalized form, so that the same free trial is not obtained more than once

2.7 What we do not do

• We do not sell or rent your data to anyone.
• Neither we nor the providers that analyze your links use your content to train artificial intelligence models.
• We set no advertising cookies and no audience-measurement trackers.

3. WHY, AND ON WHAT LEGAL BASIS

Each processing operation rests on one of the bases set out in article 6 of the GDPR.

Processing	Purpose	Legal basis
Account and provision of the service	Give you access to Dareviz, analyze the links you supply, keep your trips	Performance of the contract
Subscription and billing	Take payment, issue the invoice, handle renewal and cancellation	Performance of the contract and legal obligation
Accounting	Keep accounting records	Legal obligation (art. L123-22, French Commercial Code)
Service messages	Confirmation, invoice, notice of a change or an outage	Performance of the contract
Waiting list and newsletter	Tell you about the launch, send you news	Consent, withdrawable at any time
Messages, feedback and bug reports	Replying to you, fixing a reported problem, improving the service	Legitimate interest in replying to your messages and improving the service
Security and technical logs	Detect abnormal access, prevent fraud, diagnose outages	Legitimate interest in protecting the service
Preventing abuse at sign-up	Limit sign-ups in bulk, prevent the same free trial from being obtained more than once, identify who opened an account in case of abuse or a request from an authority	Legitimate interest in protecting the service and its trial offer
Identifying a deleted account	Be able to tell a judicial authority who opened an account, if it asks	Legal obligation (article 6 of the French law on confidence in the digital economy, decree no. 2021-1362)

4. WHAT IS REQUIRED, WHAT IS NOT

An email address and a password are necessary to create an account: without them the service cannot be provided. Billing data is necessary to take out a paid subscription.

Everything else is optional. Not signing up to the newsletter, not giving your first name or not inviting other travelers has no effect on your access to the service.

5. WHO ELSE HAS ACCESS

Your data is shared only with the providers strictly necessary to run the service. Each acts on our instructions, under a processing agreement compliant with article 28 of the GDPR, except where noted otherwise below.

Hosting

Payment

Automated analysis of your content

Only the content needed for the analysis is sent to Anthropic and Google: the link or the text you submit, never your identity, your email address or your billing data. They do not keep that content beyond the processing and the technical period needed for the security of their service.

Fetching the content of the source you submit

Sign-in and security

Communication

Technical monitoring

Forms

The map and the places on your cards

Displaying the site and the app

To display other elements, your browser also loads resources from third-party servers, which receive your IP address like any web server: map backgrounds from CARTO, used only when the Google map cannot be displayed, place search from OpenStreetMap (Nominatim), which also receives the name of a place not yet on the map, code libraries from jsDelivr on the site's home page, and some card images, loaded from the site they come from.

These display services, Google Fonts included, are not our processors: they handle your IP address to serve you the resource requested, under their own policy.

Your data may also be disclosed to a judicial or administrative authority where the law requires it.

6. TRANSFERS OUTSIDE THE EUROPEAN UNION

Part of your data stays within the European Union: your database, with Supabase, in Frankfurt; the application server, with Railway, in Amsterdam; the showcase site, with Hostinger, in Cyprus; the fetching of source content, with Apify, in the Czech Republic; emails, with Brevo, in France; technical error monitoring, with Sentry.

Several operations involve a transfer to the United States: the service interface, with Vercel, taking payment, with Lemon Squeezy, forms, with Formspree, and part of the automated analysis, with Anthropic and with Google - the latter two also contracted through their Irish entity.

These transfers are framed by the standard contractual clauses adopted by the European Commission on 4 June 2021, which require the recipient to provide protection equivalent to the GDPR, together with the supplementary measures each provider documents. Formspree states that it relies on the same clauses but does not publish its data processing agreement; we have asked for it.

The Google map and the display services in section 5 (typefaces, fallback map backgrounds, code libraries) may serve their resources from servers located outside the European Union. They receive what any web server receives when your browser requests a resource (IP address, browser type) and, for place search, the name of the place searched.

You can obtain a copy of these safeguards by writing to dareviz.contact@gmail.com.

7. HOW LONG

No data is kept indefinitely. Each period matches the purpose pursued or a legal obligation.

Data	Retention period
Account and content	For as long as the account exists, then 3 years after the last sign-in
Deleted account	90 days in a separate archive, then permanently erased
First name, last name and email address of a deleted account	5 years after deletion, legal obligation
Google identifier (sign-in with Google) and password hash of a deleted account	1 year after deletion, legal obligation
Trips after cancellation	30 days, to give you time to export them
Accounting records and invoices	10 years, legal obligation
Bank details	Never kept by Dareviz
Waiting list and newsletter	Until consent is withdrawn, then 3 years at most
Technical logs	30 days at most
Email sending history	12 months
IP address recorded at sign-up	1 year after sign-up, even if the account is deleted earlier
Free-trial register (normalized email address, sign-up dates)	For the life of the account, then 3 years
Messages, feedback and reports	3 years after our last exchange

When you delete your account, your data leaves the service at once. A copy stays for 90 days in a separate archive that serves one purpose only: restoring your account if you ask us to, for instance after deleting it by mistake, as long as your address has not been used to open a new account in the meantime. After 90 days the archive is erased automatically.

Three things remain after deletion. Your email address, in a normalized form, is kept for 3 years in the free-trial register, so that a trial is not obtained a second time by deleting and then recreating an account. The IP address of your sign-up is kept until one year after it, so that we can identify who opened an account in case of abuse or a request from an authority.

And French law requires a service that hosts its users' content to keep enough to identify who opened an account. Your first name, last name and email address are therefore kept for 5 years after deletion. The identifier of your Google account, if you signed in with it, and the hash of your password (never the password itself) are kept for 1 year. This register is stored separately, holds nothing from your trips or cards, and is only used to answer a request from a judicial authority.

An account inactive for three years receives a reminder message. Without a reply from you, it is deleted.

8. COOKIES

Neither the site nor the app uses advertising cookies or audience-measurement trackers.

The app keeps in your browser only what it strictly needs: your session once signed in, your preferences (language, currency, display), your note drafts in progress, and temporary copies that speed up display. These stay on your device and serve only to run the service. Article 82 of the French Data Protection Act exempts them from consent.

The app's map, provided by Google Maps, sets no cookie and writes nothing to your browser. It receives your IP address to send you the map, like the other display services in section 5. None of this requires your consent, hence the absence of a banner.

On the sign-up page, the Google reCAPTCHA anti-bot service (section 5) may also read and set its own trackers, to check that the sign-up comes from a person and not a program.

Were an audience-measurement tool ever introduced, this section would be updated before it goes live. Should it set trackers that require consent, a banner allowing refusal as easily as acceptance would be shown beforehand.

9. AUTOMATED DECISIONS AND PROFILING

The analysis of the links you supply is automated: that is the very purpose of the service. It produces activity cards that you remain free to edit, keep or delete.

No decision producing legal effects concerning you, or significantly affecting you, is taken solely on the basis of automated processing within the meaning of article 22 of the GDPR. No profiling is carried out for advertising purposes.

10. SECURITY

The following measures protect your data:

• Encryption of traffic between your browser and our servers (HTTPS)
• Passwords stored as hashes, never in the clear
• Access to data limited to those who need it
• Regular backups and access logging

In the event of a data breach likely to result in a high risk to your rights, you will be informed as soon as possible, and the CNIL within 72 hours, under articles 33 and 34 of the GDPR.

11. MINORS

The service is open from the age of 15. Below that age, creating an account requires the joint consent of the minor and their legal guardian, under article 8 of the GDPR and article 45 of the French Data Protection Act. Were we to learn that an account was opened by someone under 15 without that consent, its data would be deleted without delay.

12. YOUR RIGHTS

You have the following rights over your data, which you may exercise at any time.

12.1 How to exercise them

Write to dareviz.contact@gmail.com. We reply within one month of receiving your request. That period may be extended by two months where the request is complex or where requests are numerous; you would be told within the first month, with the reasons for the extension.

We may ask for proof of identity, but only where there is reasonable doubt as to who is making the request.

12.2 Complaint to the CNIL

If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the French data protection authority:

13. CHANGES TO THIS POLICY

This policy may change. The last-updated date at the top of this page lets you track its changes.

The version in force is always the one published on dareviz.com.

14. CONTACT

For any question about this policy or about how your data is processed: