Privacy Policy

1. Data Controller

Michael Ehlers
Grundrauschen Digital
Claude-Monet-Weg 15
64372 Ober-Ramstadt, Germany
E-mail: [email protected]

2. Data We Process

vorfreudio.de processes the following personal data:

• Name and e-mail address (account, invitations, password reset)
• Profile picture (optional, uploaded by the user)
• Passkey credentials (public key, device identifier — no raw biometric data)
• Trip data (title, travel dates, description, cover image)
• Trip blocks (accommodation, transport, activities with location info, times, notes, photos)
• Cost data (amounts, categories — no full invoices or bank details)
• Fellow travelers (e-mail addresses of invited people, roles within the trip)
• Attachments (e.g. booking confirmations, uploaded by the user)
• Travel diary entries ("moments"): text, photos, date, optional location
• Chat history with the AI assistant (see section 7)
• Voluntary feedback during the beta phase (free text, category, current page URL)
• When used in Travel Professional mode: contact details of the professional's own clients (name, optionally e-mail/phone/notes), entered by the travel professional themselves

3. Purpose of Processing

Data is processed exclusively to provide the vorfreudio.de service: personal trip planning, coordination with fellow travelers, and management of travel information. No data is processed for advertising, analytics, or other purposes.

4. Legal Basis

• Art. 6(1)(b) GDPR — Performance of a contract: processing necessary to use the service (registration, login, trip management).
• Art. 6(1)(f) GDPR — Legitimate interest: platform security, abuse prevention, error analysis.

5. Hosting & Data Storage

All data is stored on servers operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Data is held exclusively within the EU. A data processing agreement under Art. 28 GDPR is in place with Hetzner.

6. E-mail Delivery

For transactional e-mail delivery (trip invitations, password reset), we use Brevo(Brevo GmbH, Köpenicker Str. 126, 10179 Berlin — the group entity contracting with German customers, part of Sendinblue SAS, Paris). Brevo processes recipients' names and e-mail addresses. Processing takes place within the EU (hosting subprocessors OVH and Google Cloud, located in France and Belgium respectively) — no transfer to third countries occurs for the transactional e-mail service we use. A data processing agreement is in place with Brevo.

7. AI Assistant

vorfreudio.de offers an optional AI assistant to help with trip planning. This uses the API of Anthropic(Anthropic PBC, San Francisco, USA; for EU customers: Anthropic Ireland, Limited, Dublin, Ireland). The AI's context window is given the trip data relevant to each request (e.g. trip blocks, dates, locations) along with the prior chat history. According to Anthropic, data submitted via the API is not used by default to train their own models. Chat history is stored server-side and can be deleted by the user at any time. A data processing agreement (Data Processing Addendum) is in place with Anthropic, which provides for the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR, Module Two: controller-to-processor) to govern any transfer of data to the USA.

8. Map Services

The map view uses Leaflet with map tiles from OpenStreetMap. Loading the map sends requests to OpenStreetMap servers (*.tile.openstreetmap.org), which transmits your IP address. Location search (geocoding) uses OpenStreetMap's Nominatim API. Coordinates are cached locally in your browser after the first request (localStorage, 30 days) and are not fetched again afterwards. No location data is stored permanently on our servers. Further information on OpenStreetMap's privacy policy: osmfoundation.org.

Beyond browser-side use, our server also queries the Nominatim API (place search / reverse geocoding) and Open-Meteo's weather and climate API when needed — e.g. for the weather widget, climate data analysis, the automatic cover image for trip e-mails, AI-based event search, and country lookup for emergency numbers. Only location data already stored as part of your trip (e.g. destination, accommodation coordinates) is transmitted — no additional personal data. Open-Meteo (open-meteo.com) is an open-data weather service that requires no registration or API key.

For the optional route calculation in the AI assistant (e.g. driving distance and time between two places), our server uses the API of OpenRouteService (HeiGIT gGmbH, Heidelberg, Germany). Only two coordinate pairs of the queried locations are transmitted — no name, e-mail address, or other identifier of your person. Further information: openrouteservice.org.

9. Retention Periods

If a user deletes their account, all personal data is permanently deleted within 30 days.

10. Your Rights

You have the following rights against the data controller:

• Access to your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)

For any requests, please contact us by e-mail at [email protected]. We process requests within 30 days (Art. 12(3) GDPR).

You also have the right to lodge a complaint with the competent data protection supervisory authority.

11. Cookies & Tracking

vorfreudio.de uses only strictly necessary cookies (a session cookie for login). No tracking, advertising, or third-party cookies are used.

For internal usage statistics (page views, no user profiles) we use Umami Analytics. Umami runs on a server operated by Hetzner Online GmbH in Germany, sets no cookies, and collects no personal data. Only anonymized page views are counted. No consent is required for this. We do not use Google Analytics, Meta Pixel, or comparable services.