Who is the controller
The controller of your data is the tupetate.com team, based in Spain. For any privacy question or to exercise your rights, write to us at info@tupetate.com.
What data we collect
- When you sign in (with Google or an email magic link): your email address, your name and, if you have it set in Google, your profile photo.
- When you use the chat: the content of your messages and the assistant's replies are stored against your account so you can continue the trip later. The ideas the assistant adds to the board (flights, hotels, activities) are saved to your account along with their prices and links.
- Basic technical data: approximate IP address (to detect your city and suggest a departure point, and — see below — to detect abuse of free-trial signups), browser type, and errors the server sees while serving you.
- Anonymous analytics: we use a privacy-friendly analytics tool to count page views in aggregate. We don't use Google Analytics and we don't tie that analytics to your account.
What we use it for
- Identify you to keep your session and your trips.
- Personalize the assistant's replies with the context you give it yourself.
- Detect abuse of the service (daily AI-usage limits per account).
- Detect repeated free-trial signups from the same visitor: we briefly combine your IP address with standard browser headers (like browser/language type) for up to 48 hours after a free trial is granted, then delete that combination. This is not a tracking script and doesn't follow you across other sites.
- Improve the product by observing how it's used in aggregate (without identifying you individually).
Who we share it with
Only with the providers strictly necessary for the service to work:
- Anthropic (Claude): the content of your chat is sent to Anthropic's API to generate replies. Anthropic doesn't use that data to train models (commercial processing agreement).
- Google: if you sign in with Google, we receive your email/name/photo.
- Resend: if you request a magic link, we send it by email via Resend.
- Search, travel-data and map-geocoding providers: we send only the specific query (city, dates, place to locate), never your identity.
- Travelpayouts Drive: on our public pages (home, example trips and informational pages) we load a script from our affiliate network that adapts booking links to attribute commissions. This script is not loaded on your account's private pages (chat, your trips, settings), so it has no access to the content of your trips or your personal data.
When you click a booking link, you leave tupetate.com and enter the provider's site (Booking, Aviasales, GetYourGuide, etc.). There, that provider's privacy policy applies — not ours.
Cookies
We use cookies strictly necessary to keep you signed in. We don't use advertising or third-party tracking cookies. Some affiliate links, once you click, may place the provider's cookies in your browser to attribute the booking.
Your rights
Under the GDPR, you have the right to access, rectify or delete your data. To exercise them write to us at info@tupetate.com. We delete accounts on request within 30 days at most.
Changes
If we change this policy, we'll update the date above. Substantial changes will be announced on the platform itself before taking effect.
Related documents: Terms · Affiliate disclosure · About tuPetate