Privacy Policy

1. Data controller

The controller of the personal data collected through this site is Andrea Battiato, who runs Clustrip. For any request about your data you can use the site's contact form.

2. Data we collect

Account data: email and identifier provided by your sign-in provider (Google) upon registration, plus the nickname you may choose. Your nickname stays private unless you ask us to publish it on the supporters wall (see section 5).

Usage data: the itineraries you choose to save to your profile (destinations, dates, travel preferences) and the preferences entered in the planner.

Contact requests: if you use the Contact form we store your name, email and message, for the sole purpose of replying to you.

Itinerary ratings: if you rate an itinerary we store the stars, the optional note you write (up to 2000 characters), the destination, the number of days, the language and the country of origin. If you are signed in at that moment we also store your account identifier, so we can get back to you if you report a problem; we never store your IP address. Please do not write personal data about yourself or others in the note: it is there to tell us how it went, not to identify anyone.

Usage statistics: we record events without identifiers (page visited, interaction type, the site you arrived from — detected once per visit — and country of origin derived from the network, never your IP address). For registered users only two kinds of row are linked to the account: itinerary generations, to enforce plan limits, and the marker that we already sent you a reminder email, so we do not send you a second one.

Traffic statistics (Vercel Web Analytics): we use the Vercel Inc. service to measure site traffic without cookies: pages viewed, traffic source (for example UTM parameters) and country. The data is aggregated and no profile of individual visitors is created.

Technical data for security: to stop abuse (bursts of requests, attempts to bypass plan limits) our server counts how many requests come from each IP address. Here the IP address is processed in the clear: it goes into a temporary counter hosted on Upstash Redis, which deletes itself when it expires, within one hour. We do not link it to your account, we do not store it in the database and it never enters the statistics. Similar counters, keyed to your account identifier rather than your IP, are used to enforce the generation and edit limits of your plan.

Payment data: we currently process no payment data, as subscriptions are not active yet. Once they are, payments will be handled entirely by Stripe: we will never store card numbers, only your Stripe customer ID and subscription status.

3. Purposes and legal basis

We process data to provide the service and enforce the limits of your plan (performance of contract, art. 6.1.b GDPR), to reply to requests sent through the Contact form (art. 6.1.b) and to produce aggregate, identifier-free statistics (legitimate interest, art. 6.1.f GDPR).

Also on the basis of our legitimate interest in protecting the service (art. 6.1.f GDPR) we process your IP address in the anti-abuse counters described above, for the short time stated there: without them anyone could exhaust the site's resources with automated requests.

Promotional emails are sent only with your consent (art. 6.1.a GDPR): see section 4.

Planner preferences are sent to our processing provider (Anthropic) for the sole purpose of composing the requested itinerary; they are not used for advertising profiling.

4. Newsletter and emails

We write to you for two different reasons. Service emails concern your account and are sent because they are needed for you to use Clustrip. Promotional emails — product news, travel tips and a reminder if you registered but have not tried creating an itinerary yet — are sent only if you gave your consent (art. 6.1.a GDPR).

When you register there is a newsletter checkbox: it is never pre-ticked, the choice is yours. You can change it from your profile whenever you like.

One thing we want to say plainly: anyone who registered before 11 July 2026 was subscribed automatically, because until that day the consent checkbox did not exist. If that is your case and you do not want to receive anything, one click is enough: every email contains a personal unsubscribe link that works without signing in, and mail programs show the unsubscribe button at the top of the message. Nobody with consent switched off receives anything: the rule covers both the newsletter and the automatic reminder.

Emails are sent through Resend. So that we never send you the same reminder twice we keep a marker of the message already sent, linked to your user identifier: that marker has no automatic expiry and stays as long as the account exists.

5. When something becomes visible to others

As a rule your itineraries are private and only you can see them. There are two cases, both the result of your own choice, in which something becomes visible outside your profile.

Share link: if you have an account you can create the share link of an itinerary you saved. From that moment anyone holding that address can open the itinerary without registering: it is a public link for whoever has it, and whoever receives it can forward it on to anyone. It is worth pausing on this point: the link does not protect you from someone passing it around, so only give it to people you trust.

We did build that page carefully, though, and we are glad to say so: the code in the address is random and unguessable, the page is excluded from search engines (it does not end up on Google), it never says who you are — your user identifier is never exposed — and the part holding the original request, meaning dates, group composition and budget, is stripped out before the page is shown. Whoever opens the link sees the itinerary, not you.

The link stays valid until you revoke it yourself from your profile: after revocation, whoever had the old address sees nothing. It also stops working if you delete that trip, and it disappears along with everything else if you delete your account. One last thing worth knowing: when you paste the link into a chat or a social network, that platform loads the preview itself and therefore reads the destination and length of the trip.

Nickname on the supporters wall: those who support Clustrip with a donation appear on the Supporters page. By default the entry is anonymous ("Account #1", "Account #2"…). Your nickname is published only if you choose to make it public, and you can change your mind at any time.

6. Retention and deletion

Account data remains active while you keep your profile.

Some deletions happen on their own: technical error logs disappear after 90 days, statistical events after 24 months, the anti-abuse counters holding the IP address within one hour.

Others we do by hand, periodically: requests sent through the Contact form and itinerary ratings have no automatic expiry today. We prefer to tell you this rather than promise a deadline the system does not yet enforce by itself. If you want one of your requests or ratings deleted right away, ask us through the contact form: we will do it.

Account deletion: you do it yourself, from your profile area, with “Delete account”. It is immediate and permanent — no cooling-off period, no backup copy sitting somewhere. Gone are the profile with your email and your nickname, the trips saved in the cloud and with them the share links born from those trips (whoever had them sees nothing anymore), the text of any reviews you wrote, and the requests sent from the Contact form with that address. Once it is done you get a confirmation email.

Two things survive the deletion, but with no link to you left, and here is why. The star rating you gave to itineraries stays without the name of whoever gave it: it feeds the average in the public library, and removing it would change a number other people read. The statistical usage counters stay too, unlinked from your account: we clear the reference to you, not the row, because deleting the row would distort the site's historical totals. Neither of them leads back to you.

If you do not want to delete everything you can do just a part, again from your profile area: delete individual trips saved in the cloud, revoke share links and switch the newsletter off.

7. Your rights (GDPR)

You have the right of access, rectification, erasure, restriction, portability and objection (arts. 15-22 GDPR). You may exercise them through the site's contact form; you also have the right to lodge a complaint with your supervisory authority.

8. Third parties

We rely on qualified providers processing data on our behalf: Supabase (database and authentication, data hosted in the EU — Ireland), Anthropic (itinerary composition), Vercel (hosting and Web Analytics traffic statistics), Upstash (the temporary anti-abuse and limit counters described in section 2, which include the IP address), Zoho (mailbox, EU servers) and Resend (service email and newsletter delivery, EU region). Once subscriptions are active, Stripe (payments) will be added. GDPR-compliant contractual safeguards are in place with each of them.

When you open an itinerary or the map, some resources are loaded directly by your browser from external services: place images from Wikipedia/Wikimedia, map tiles from CARTO (CartoDB), route calculation from OSRM (routing.openstreetmap.de, a FOSSGIS project) and railway tracks from public Overpass API instances (for example maps.mail.ru and overpass-api.de). In these cases your browser sends the usual HTTP request — which includes your IP address — to the operator of the service, which handles it under its own privacy policy; we pass none of your personal data to them.

Two more lookups leave directly from your browser while you fill in the form: city suggestions come from Open-Meteo (geocoding-api.open-meteo.com), region and country suggestions from the Wikipedia APIs. They therefore receive your IP address and the letters you are typing into that field, and handle them under their own privacy policies.

Other lookups leave from our server instead of your browser: Nominatim (OpenStreetMap), to recognise the accommodation you enter on the Refine page, and Wikidata, to find places worth visiting. In these cases your IP address never leaves us: all they receive is the search text, for example the name of the hotel or the city.

9. Affiliate links

Some links to travel and shopping partner sites (Booking.com, GetYourGuide, Amazon, Klook, Tiqets, Yesim, Saily, Welcome Pickups, NordVPN, Heymondo) are affiliate links: if you book or buy through them, Clustrip may receive a commission from the partner at no extra cost to you. The link to Airbnb goes through the same redirect, but it is not an affiliation: there we merely count the clicks.

The hand-off happens through a redirect on our server, and we put none of your personal data into the address. That said, here is how the web actually works: right after the jump it is your browser that connects to the partner's site, and at that moment it tells them its own IP address and the fact that you are coming from clustrip.com — exactly as happens with any link you click. We have configured the site so the partner only ever receives our domain name and never the exact page you started from. From then on their terms, privacy policy and cookies apply.

For statistics we only count clicks in aggregate form (partner, destination and country — never personal data or IP address).

Itineraries also contain plain external reference links (for example Google Maps, Tabelog, Yelp, TripAdvisor), with no affiliation: here too, the destination sites' own terms and policies apply.

10. Transfers outside the EU

Some providers (Anthropic, Vercel, Upstash) are US companies: even when data is hosted in the EU, any transfers to the United States take place under the EU-US Data Privacy Framework or standard contractual clauses approved by the European Commission.

11. Contact

For any question about this policy or your data, use the site's contact form: it opens with the request type Support already selected.