Privacy Policy
Last updated: 19 September 2026
1. Data controller
DIYTravel is responsible for the personal data described in this policy. For data-related enquiries, contact us at support@diytravel.io.
2. What we collect & why
We collect only the data necessary to provide our service. We do not sell your data to third parties.
| Data | Legal basis | Purpose |
|---|---|---|
| Email address | Contractual necessity | Account & communication |
| Trip preferences & itinerary data | Contractual necessity | Core service delivery |
| Your Google name and photo, if you sign in with Google | Consent | Account creation & display |
| Profile details (first/last name, travel interests) | Contractual necessity / consent | Personalisation & display |
| Location searches (place text you type when setting a day's base location) | Contractual necessity | Look up places via our maps provider (Mapbox) |
| Where you are travelling from (the town or city you enter) | Contractual necessity | To suggest trips and flights that make sense from where you live. Saved with your trip answers. |
| Your device location, only if you press “Use my location” | Consent | Sent to us once to find your nearest town. We keep the town name, not your coordinates. |
| A scrambled version of your IP address when you search without an account | Legitimate interest | To limit automated searching and keep the service reliable |
| Collaboration invitations (email of people you invite, including non-users) | Legitimate interest / contractual necessity | Send and manage trip invitations |
| Notification preferences | Contractual necessity | Respect your email choices |
| Support & problem reports (description, page URL, browser/device info, optional contact email) | Legitimate interest | Diagnose and fix issues you report |
| Booking link clicks (a scrambled version of your IP address that cannot be turned back into the original, the time, and the partner) | Legitimate interest | So our booking partners can credit us when you book through a link |
| AI chat messages (text you send to the AI Edit Assistant — capped at 1000 characters with basic redaction of obvious email addresses and phone numbers; AI responses are not stored) | Legitimate interest | Improving the service by understanding what people most often want to change. Delete anytime via Settings → Account; auto-deleted after 180 days. |
| Payment data (Trip Pass purchases) | Contractual necessity | Processed by Stripe (we do not store card details) |
3. Who we share your data with
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Secure storage of your account and trips, and sign-in | EU |
| Stripe | Payment processing | US / EU |
| Sign in with Google | US | |
| Anthropic | The AI assistant that edits your trip, destination comparisons, explanations of why a trip suits you, alternative takes on your results, improvements to a day, trip checks and packing lists (Premium only) | US |
| Mapbox | Place / location search (when you set a day's base location). Receives the text you type. | US |
| Resend | Transactional email delivery (welcome, invitations, reminders, digests). Receives the recipient email address and email content. | US |
| Vercel | Hosting & CDN | US / EU |
| Unsplash | Destination photographs, loaded directly from Unsplash, which therefore receives your IP address and browser details | US |
When you use Premium AI features, we may send the travel preferences you gave us and details of the trip you are working on to Anthropic for processing. We do not intentionally send account details such as your email address to Anthropic for these features, but trip content and free-text inputs you provide may contain personal information.
If the same request has been made before, we may show the earlier answer instead of asking the AI again. These saved answers are not linked to your account and do not contain your name or email address.
Anthropic states that, by default, inputs and outputs submitted through commercial products such as the Anthropic API are not used to train Anthropic's models.
When you follow a booking link you leave DIYTravel. GetYourGuide or Viator then handle your data under their own privacy policies.
4. Data retention
- Account data: kept while your account is active.
- Account deletion: personal data removed within 30 days of request.
- Affiliate click logs: retained 24 months, then deleted.
- Hashed IPs: one-way hash, cannot be reversed to identify you.
- AI edit messages: raw text deleted after 180 days. Anonymous counts (for example, how many edits were made) are kept indefinitely and cannot identify you. You can delete your stored messages at any time from Settings → Account.
- Backups: may persist up to 30 days after deletion.
5. Cookies
We currently use only strictly necessary cookies for authentication, to keep you signed in. We do not use marketing, analytics, or advertising cookies.
If we introduce non-essential cookies in the future, we will implement appropriate consent mechanisms before doing so.
6. Data security
We take appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS), secure authentication, and access controls. No system is completely secure, and we cannot guarantee absolute security.
7. Collaboration & sharing
- When you share a trip, collaborators see your display name, avatar, and trip content.
- A share link lets anyone who has the link and is signed in to DIYTravel view the trip. Links are not open to the public web, but anyone you send one to can pass it on, so share them with care.
- Removing a collaborator revokes their access.
- You control what you share — do not include sensitive personal information in trip notes.
8. International transfers
Your data may be processed in the US (Vercel, Anthropic, Stripe, Mapbox, Resend, Unsplash). These transfers are covered by appropriate safeguards including standard contractual clauses.
9. Your rights (UK GDPR)
You have the right to: access, rectification, erasure, restriction, portability, and objection. Contact support@diytravel.io and we will respond within 30 days.
You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.
You can choose which optional emails you receive in your account settings, and every reminder or digest email has a one-click unsubscribe link.
10. Children
DIYTravel is not directed at anyone under 16. We do not knowingly collect data from children.
11. Changes to this policy
We will update the “last updated” date when this policy changes. Material changes will be notified by email.
12. Third-party data and attributions
GeoNames
DIYTravel uses place and geographical data derived from GeoNames, with modifications by DIYTravel. GeoNames data is licensed under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence.