Who is the controller
The controller of your data is the tupetate.com team, based in Spain. For any privacy question or to exercise your rights, write to us at info@tupetate.com.
What data we collect
- When you sign in (with Google or an email magic link): your email address, your name and, if you have it set in Google, your profile photo.
- When you use the chat: the content of your messages and the assistant's replies are stored against your account so you can continue the trip later. The ideas the assistant adds to the board (flights, hotels, activities) are saved to your account along with their prices and links.
- Basic technical data: approximate IP address (only to detect your city and suggest a departure point), browser type, and errors the server sees while serving you.
- Anonymous analytics: we use a privacy-friendly analytics tool to count page views in aggregate. We don't use Google Analytics and we don't tie that analytics to your account.
What we use it for
- Identify you to keep your session and your trips.
- Personalize the assistant's replies with the context you give it yourself.
- Detect abuse of the service (daily AI-usage limits per account).
- Improve the product by observing how it's used in aggregate (without identifying you individually).
Who we share it with
Only with the providers strictly necessary for the service to work:
- Anthropic (Claude): the content of your chat is sent to Anthropic's API to generate replies. Anthropic doesn't use that data to train models (commercial processing agreement).
- Google: if you sign in with Google, we receive your email/name/photo.
- Resend: if you request a magic link, we send it by email via Resend.
- Search, travel-data and map-geocoding providers: we send only the specific query (city, dates, place to locate), never your identity.
- Travelpayouts Drive: on our public pages (home, example trips and informational pages) we load a script from our affiliate network that adapts booking links to attribute commissions. This script is not loaded on your account's private pages (chat, your trips, settings), so it has no access to the content of your trips or your personal data.
When you click a booking link, you leave tupetate.com and enter the provider's site (Booking, Aviasales, GetYourGuide, etc.). There, that provider's privacy policy applies — not ours.
Cookies
We use cookies strictly necessary to keep you signed in. We don't use advertising or third-party tracking cookies. Some affiliate links, once you click, may place the provider's cookies in your browser to attribute the booking.
Your rights
Under the GDPR, you have the right to access, rectify or delete your data. To exercise them write to us at info@tupetate.com. We delete accounts on request within 30 days at most.
Changes
If we change this policy, we'll update the date above. Substantial changes will be announced on the platform itself before taking effect.
Related documents: Terms · Affiliate disclosure · About tuPetate