NoBrainer.travel
Privacy policy
Effective date: .
What data we use when you plan a trip, who receives it and how you can manage it.
1. Controller and contact
The service provider and data controller is mastalerz.it Arkadiusz Mastalerz, a Polish sole trader registered in CEIDG.
ul. Krasnowolska 18E, 02-849 Warszawa, Poland. NIP: 5632311091. REGON: 061610202.
Privacy, complaints and support: hello@nobrainer.tech.
2. Purposes and lawful bases
The GDPR is the General Data Protection Regulation. We use each category of data for the following purposes:
- Preparing and delivering your requested plan, saving versions, running your account and private journal: performing the free-service contract or taking steps at your request before it, Article 6(1)(b) GDPR.
- Optional information about travel companions, including a child’s birth month and year: the legitimate interest in tailoring the plan to the group at the trip organizer’s request, Article 6(1)(f) GDPR, subject to those people’s rights, especially children’s. Do not provide names, full birth dates or sensitive information.
- Enforcing free allowances, preventing abuse, securing the service and diagnosing faults: our legitimate interest in protecting the service and its users, Article 6(1)(f) GDPR.
- Handling feedback and general enquiries and using them to improve the app: our legitimate interest in providing help and resolving problems, Article 6(1)(f) GDPR. Complaints about your requested service rely on Article 6(1)(b); statutory duties concerning complaints and GDPR requests rely on Article 6(1)(c) GDPR.
- Newsletter: separate consent, Article 6(1)(a) GDPR. Minimal consent evidence, recording unsubscribes and establishing, exercising or defending claims: our legitimate interest in demonstrating lawful activity and respecting unsubscribes, Article 6(1)(f) GDPR; a specific legal obligation, where applicable, Article 6(1)(c) GDPR.
Providing data is voluntary. The trip details needed to prepare a plan and identification for sign-in are necessary for those requested features. An account, journal, children’s details, additional requirements, feedback reply address and newsletter are optional. Declining the newsletter does not prevent planning.
3. The form, plans and journal
When you submit the form, we process the destination and starting point, dates and day count, adult count, any optional children’s birth months and years, pace, interests, transport, budget category, language and requirements. We store the request, progress, result and saved plan versions to deliver it and support editing. A signed-in user’s plan is linked to their account ID; an anonymous plan uses an access token.
The journal stores selected countries, continents and places, custom place labels and entry creation times. Entries are self-reported, not a record of device-location tracking. They are not a public profile and are available through your account. Authorized administrative access may be needed to operate the service or handle a data request.
Do not enter health information, documents, passwords or booking codes. Anything you put in requirements also goes to the AI service described below.
4. Your account and sign-in
Google sign-in uses Google Identity Services in your browser. An identity token goes to Supabase, which manages the account and session. You can instead request a sign-in link to your email address; following it creates a Supabase session. Travel uses your account ID and email to provide account features, saved information and allowances. Profile information received from the sign-in provider may form part of the authentication record.
We do not ask for your Google password or access to your mailbox. Signing out ends use of the session but does not erase your account, plans or journal.
5. AI plan generation
OpenRouter and the model provider handling the request receive the trip details: destination, starting point, dates, day count, adult count, optional children’s birth months and years, pace, interests, transport, budget, requirements and plan language. The request code does not add your account email or ID. Personal data you enter in free text can still reach these providers.
Retention and data-use terms vary between model providers. We do not promise zero retention, exclusion from training or processing solely in the EU. See OpenRouter’s privacy policy and its model-provider list. You can ask us which recipient handled a particular request.
6. Weather, currency and photos
If your plan identifies MET Norway (api.met.no) as its forecast source, the data concerns the destination’s location and the forecast days. There is no need to send account details, email or additional requirements there. Climate averages for capitals come from CHELSA data bundled with the app; for other recognized places the app may read a small range of a public CHELSA file matching the place’s coordinates. No request contains account information or form contents. The plan identifies its weather source; data can be unavailable and does not assure conditions during your trip.
Wikimedia Commons receives attraction-photo search phrases. We retrieve images and source, author and licence information. When your browser loads an image from Wikimedia servers, the provider receives connection information, including your IP address. The currency code for a resolved country is read from a CLDR table bundled with the app, without sending a request.
ICS export creates a downloadable file. Importing it into a calendar sends selected content to that calendar’s provider at your direction; it does not grant Travel access to your calendar account.
7. Limits and security
Without an account, the allowance is one successful plan per IP address; a verified account receives three free plans per calendar year. The account period is measured in UTC and resets on 1 January at 00:00 UTC. We store counters, reservations, timestamps and a hash derived from an IP address or account ID to enforce allowances. A hash is not the raw IP address, but we still treat it as protected data.
Servers handling your connection process your IP address and may record technical information and errors in logs. We also store plan-processing, retry and error information. We do not claim that all logs are anonymous. Treat plan access tokens and sessions as confidential information.
8. Feedback and correspondence
The feedback form stores the category, language, message, timestamp and account ID if signed in. An optional reply address is encrypted before database storage and used to contact you about that message. It does not subscribe you to the newsletter. To limit abuse and duplicates, we also store a hash of the account ID or IP address and hashes of the submission. Feedback is not automatically published.
An email to hello@nobrainer.tech also includes your address and correspondence. Account deletion alone does not erase feedback text or correspondence; specify these if you want your request to cover them.
Optional assistance with feedback categorization uses TypeSafe/Jev only when that feature is enabled. In that case, the provider receives the message text without an attached reply address or account ID. Do not include confidential data in feedback.
10. Providers and transfers outside the EEA
Supabase provides authentication and the Travel database in eu-central-1 (Frankfurt). Vercel hosts the website; Render runs the API and plan generation in Frankfurt. These services process data on our behalf. Access can include account, plan, journal, feedback and connection data as needed for that service. EmailOctopus provides newsletter delivery on our instructions.
Other recipients depend on the features described above: Google, OpenRouter and model providers, the weather source, Wikimedia and, conditionally, TypeSafe/Jev. A provider’s own purposes, such as running a Google account and securing its services, fall under its privacy policy. Naming a provider does not mean it acts solely as our processor. Competent authorities or advisers may receive necessary information where required by law or to defend claims.
An EU database region does not mean every provider, subprocessor, support operation or log remains in the EEA. Processing can involve the US and other countries outside the EEA. Providers’ published terms describe mechanisms appropriate to particular flows, such as an adequacy decision or the European Commission’s standard contractual clauses. This does not assert that every mechanism applies to a particular transfer. Ask hello@nobrainer.tech for the recipient, country and safeguards relevant to your data and a copy of the applicable safeguards.
Provider documents: Supabase, Vercel, Render and OpenRouter.
11. How long we keep data
Your account, plans, saved versions and journal entries remain stored until you request deletion; you can remove individual journal entries yourself. The app does not set an automatic deletion date for these records. Independently of requests, data should be erased when no longer needed for its collection purpose.
Feedback and correspondence are retained to handle the matter and examine the reported problem. The app does not set an automatic deletion date for feedback. You can request deletion. Retention for claims lasts only as long as necessary to establish, exercise or defend them; a legal obligation can require selected data to be kept longer.
Allowance counters and abuse-prevention hashes are kept as long as needed to enforce the allowance and protect the service. An annual reset does not delete historical counters. Job records and logs support fault handling, security and potential claims; we do not promise a shared automatic deletion period.
Newsletter data supports delivery until you unsubscribe or withdraw consent. A minimal suppression record may remain to prevent further messages, and consent evidence for as long as needed to demonstrate consent or handle claims. Backups, logs and provider-held data have their own retention cycles; we do not promise immediate removal from every copy. Ask the controller about the period applicable to a specific record.
12. Cookies and browser storage
Supabase persists your sign-in session in the browser. The form stores your entries in sessionStorage for the tab session so you do not have to re-enter them. These mechanisms support requested features. You can sign out and clear site data in browser settings; blocking storage can prevent sign-in or form restoration.
If an anonymous plan identifier remains in your browser’s localStorage, it stays until you clear site data; clearing that identifier does not delete the server-side plan. Clearing browser storage does not restore an IP allowance or request server-side deletion. External forms and Google services use their own storage mechanisms as explained in their policies.
13. Deleting your account or data
There is no account-deletion button in the app. Email hello@nobrainer.tech with your account address and requested scope, such as your account, plans and versions, journal, specific feedback and reply address, or newsletter. For an anonymous plan, provide its ID; we will agree a safe way to verify access in our reply. Do not send a password or session token.
After necessary verification, we erase or anonymize data covered by a valid request that we no longer need to retain. Account closure covers its plans, versions and journal. We separately check feedback, anonymous data and other related records because account closure alone does not erase them. We explain any necessary retention, such as security, claims or legal records, with its basis and period or criterion. Where required, we pass the request to relevant recipients under applicable law.
Our reply explains completed actions and backup limitations. Signing out, clearing browser storage or unsubscribing from the newsletter does not erase other data.
14. Your rights and complaints
Subject to GDPR conditions, you can request access and a copy, rectification, erasure, restriction and portability for automated processing based on consent or contract. You can object to processing based on legitimate interests for reasons relating to your situation, and to direct marketing at any time. You can also withdraw consent.
Send requests to hello@nobrainer.tech. We respond without undue delay, normally within one month of receipt. If the GDPR allows an extension because of complexity or the number of requests, we explain the reason and extension within that month, for up to two additional months. We may request only proportionate information necessary to verify identity.
You can complain to the President of Poland’s Personal Data Protection Office (uodo.gov.pl) or another competent authority, particularly in your country of habitual residence, work or the alleged infringement. You do not have to complain to Travel first.
15. Automation and policy changes
AI generates plan suggestions automatically, and the system checks allowances and abuse signals. These are not decisions producing legal or similarly significant effects within Article 22 GDPR. Contact us by email about a feature or allowance you want us to examine.
The date at the beginning identifies this policy’s version. We inform you before processing for a new purpose and obtain consent where required. Changing this text does not replace consent. Contact hello@nobrainer.tech for any privacy matter.