Privacy Policy

Controller (Responsible person)

Elena Blazanovic

Vienna, Austria

Email: Vamiroa@gmx.at

Vamiroa is currently operated privately as a free beta. There is no company, business registration, VAT number, or commercial address. There is no paid subscription, payment processing, affiliate system, or hotel booking service.

What information Vamiroa processes

Vamiroa does not intentionally request names, email addresses, payment information, passport information, or other sensitive personal information from trip-planner users.

When you plan a trip, you enter the following:

• •Destination
• •Travel dates
• •Number of travelers
• •Approximate budget
• •Travel interests / style
• •Language preference

These inputs, together with the generated day-by-day itinerary, are processed through Base44 (our hosting and backend platform) and stored in the Base44 itinerary cache.

Itinerary cache and retention

Cached itinerary records are kept for a limited time. Vamiroa applies a 30-day time-to-live (TTL) policy for cached records. Cleanup of expired records is performed when the itinerary-generation backend is invoked. For this reason, records may remain slightly longer than 30 days until the next generation request triggers cleanup. We do not guarantee deletion at an exact moment 30 days after creation.

The cache stores only the trip inputs and the generated itinerary described above. It does not contain names, email addresses, IP addresses, user IDs, advertising identifiers, or device identifiers.

Saved Trips and My Trips (local browser storage)

When you save a trip, it is stored locally in your browser using localStorage. Saved trips remain on your device until you delete them, clear your browser's local storage, or your browser otherwise removes them. Vamiroa keeps a maximum of 20 saved trips. Saved trips are not sent to the server.

Language preference and authentication tokens

Your selected language preference is stored locally in your browser (localStorage). Where applicable (for example, if you are logged in), Base44 authentication tokens may also be stored locally. These remain on your device until you clear them.

Cookies vs. local storage

Vamiroa distinguishes between cookies and local storage:

• •Local storage: data stored in your browser that remains on your device and is not automatically sent to the server with each request. Vamiroa uses local storage for saved trips, language preference, and (where applicable) authentication tokens.
• •Cookies: The Vamiroa app code does not set any cookies itself. Whether the Base44 hosting/CDN layer sets technical HTTP cookies is not known to us. No advertising, marketing, or tracking cookies are used.

Artificial intelligence processing

Vamiroa uses AI to build your itinerary:

Discovery: Google Gemini is used through Base44 (with web search) to research real places, public holidays, and nearby destinations for your chosen destination and travel dates.

Itinerary generation: Base44's LLM integration is used to build the day-by-day plan.

The following categories of trip information are transmitted to these AI services: destination, travel dates, number of travelers, approximate budget, travel interests, and selected language. This information is sent so the AI can generate a relevant itinerary.

External services

Vamiroa contacts the following external services to provide its features:

• •Base44 — hosting, database, backend functions, AI gateway, authentication.
• •Google Gemini (via Base44) — AI discovery with web search.
• •Photon / Komoot (photon.komoot.io) — destination autocomplete and place geocoding. The text you type is sent to Photon to suggest destinations and locate places on the map.
• •CARTO / OpenStreetMap — map tiles. When the map loads, standard map-tile requests are made to CARTO's CDN.
• •Wikimedia Commons — place imagery. Image search queries (place names) are sent to Wikimedia Commons to display photos.
• •Self-hosted fonts — Vamiroa's fonts (Fraunces and Inter) are hosted on Vamiroa's own server; they are no longer loaded from Google Fonts.

Vamiroa does not use Google Analytics, Meta Pixel, advertising trackers, or any custom third-party analytics. No such tracking is implemented in the app code.

Technical connection data

When you access Vamiroa or its external resources, standard technical connection data — such as your IP address — may necessarily be processed by the hosting provider, the CDN, and external service providers (such as Base44, CARTO, Photon, and Wikimedia) in order to deliver the requested resources. This processing is a technical necessity of how the internet works.

We cannot confirm whether Base44 or the other providers store logs or connection data, for how long, or in which exact countries or regions data is processed. Where these details are unknown, we do not state them.

Legal bases under GDPR

Where Vamiroa processes personal data, it does so on the following legal bases:

To provide the itinerary you actively request, processing of your trip inputs is carried out as a pre-contractual measure / provision of the requested service (Art. 6(1)(b) GDPR), and, where applicable, on the basis of our legitimate interest in operating the service (Art. 6(1)(f) GDPR).

Technical connection data (such as IP addresses) is processed where necessary for the provision of the service and on the basis of legitimate interests (Art. 6(1)(f) GDPR).

Vamiroa does not rely on your consent (Art. 6(1)(a) GDPR) for the core trip-planning functionality, because no consent mechanism is currently implemented. We do not ask you to consent to tracking or advertising, because none is used.

Data retention

• •Itinerary cache: 30-day TTL policy, with cleanup triggered on itinerary-generation requests (see above).
• •Saved trips, language preference, and local tokens: stored locally on your device until you remove them.
• •Base44-side retention (logs, backups, etc.): unknown — not specified by us.

Your GDPR rights

Under the General Data Protection Regulation, you have the following rights, subject to the legal conditions:

• •Right of access — you can ask what data about you is held.
• •Right to rectification — you can ask for inaccurate data to be corrected.
• •Right to erasure — you can ask for data to be deleted in certain circumstances.
• •Right to restriction — you can ask for processing to be restricted in certain circumstances.
• •Right to object — you can object to processing based on legitimate interests.
• •Right to data portability — you can receive certain data in a structured, machine-readable format.
• •Right to lodge a complaint with the competent supervisory authority. In Austria, this is the Austrian Data Protection Authority (Datenschutzbehörde, DSB).

To exercise your rights, contact: Elena Blazanovic, Vamiroa@gmx.at.

Children

Vamiroa is not directed at children and does not intentionally collect data from children.

Changes to this Privacy Policy

We may update this Privacy Policy to reflect technical or legal changes. The current version is always available in the app.

Contact

For privacy questions or requests: Elena Blazanovic, Vienna, Austria, Email: Vamiroa@gmx.at.