Privacy Policy

Privacy Policy

Last updated: 9 October 2026 Version: 3.0

1. Who we are

VoyTrail is operated by ST NEW, S.L., registered at Pz. Villa Castelldefels 4, Picasso BC, Of. AFW, 29006 Málaga, Spain, tax ID B21752753 ("VoyTrail", "we", "us").

We are the data controller for the personal data described in this policy.

Privacy contact: help@voytrail.com

This policy covers our website, the VoyTrail mobile app, the guest pages we host for accommodation providers, and the dashboard used by those providers. 2. A note on how VoyTrail works

You will usually meet VoyTrail through a page hosted for the place you are staying — a hotel, hostel or apartment. That venue decides what appears on its page. We provide the platform and hold the data described below. 3. Information we collect 3.1 Information you give us

Account information. If you sign in with Google, we receive your name, email address and profile picture URL from Google. We do not receive or store your Google password.
Booking information. When you book an activity: your name, email address, and — where the venue has enabled these fields — phone number, room or bed number, number of guests, and any free-text note you add.
Messages. Messages you send through in-app chat, including to your accommodation and in group chats.
AI assistant conversations. Where a venue enables the AI assistant, the questions you type and the conversation history in that session.
Support and feedback you send us directly.

3.2 Information collected automatically

Device and browser information, including device type, operating system and browser user agent.
Usage information, such as pages and features viewed, taps, and time spent — see Cookies and analytics below for how consent applies.
Approximate location derived from your IP address. We store the country. In some cases your IP address is sent to a geolocation provider to determine that country (see Who we share data with).
Identifiers, including a randomly generated visitor identifier, a session identifier, and a one-way hash of your IP address, used to distinguish visits without identifying you by name.
Push notification tokens, if you allow notifications.
Visit history — the venues whose QR code you scanned in the app, and the venue pages you opened there. Pages you open are kept on your device only (until September 2026, opening a page while signed in also recorded a visit; those records are kept like any other). A QR code you scan is recorded on our servers as a visit to that venue, which is what opens its group chats (and its city's) to you; if you scan while signed out, the code waits on your device and is recorded to your account when you sign in. If you keep the Show my past cities setting on (Profile → Meeting people), travellers you have written to in an accepted chat can see the cities you have visited and the month of your first visit there, never the venue. Profile → Meeting people lists those cities, including ones recorded on your other devices, and lets you remove any of them. Removing a place from Trips removes its city from your profile on all your devices (unless you stayed elsewhere in that city) and takes you out of its chat; if you are offline or signed out, this happens once you are back online and signed in (on a phone more than one account has signed in to, sign in before removing). We keep the visit itself, hidden, so that chat access keeps working if you come back; opening that place again, signed in, on a phone where you removed it shows the city again, as a new visit.

3.3 Your device's location

If you tap the location button on a venue's recommendation map, your device will ask for permission to share your location.

This location stays on your device. It is used only to draw your position on the map on your screen. It is not sent to our servers, not stored, and not shared with anyone. You can decline, and everything else on the map continues to work.

Please note this is separate from the approximate, country-level location we derive from your IP address, which is described in section 3.2 and which we do store. 3.4 What we do not collect

Payment card details. Card payments are handled entirely by Stripe. Card numbers never reach our systems.
Photos or camera images. The app uses the camera only to read QR codes on your device. No image ever leaves your device.
Your contacts, calendar, files, SMS or call history. We never request access to these.
Special category data. We do not ask for health, religious, political or similar information. Please do not enter such details in free-text fields.

4. Why we use your information, and our legal basis Purpose Legal basis (UK/EU GDPR) Creating and running your account Performance of a contract Processing bookings and sending confirmations Performance of a contract Delivering chat messages and notifications Performance of a contract Showing the cities you have visited to travellers you have written to in an accepted chat, while Show my past cities is on Legitimate interests; switch it off, or remove a city, at any time Answering questions through the AI assistant Performance of a contract Keeping the service secure and preventing fraud and abuse Legitimate interests Understanding which features are used, so we can improve them Consent, where you accept analytics; otherwise legitimate interests for a minimal record of a visit Meeting accounting, tax and other legal obligations Legal obligation

Where we rely on legitimate interests, we have considered the impact on you and limited what we collect accordingly. You can object to this processing — see Your rights. 5. Who we share your data with

We do not sell your personal information, and we do not use it for advertising.

We use the following providers. Some act on our instructions as processors; others determine some of their own processing. Provider What they receive Why Supabase Our database and authentication — all data described above Hosting and storage Stripe Your name, email address, phone number if given, booking details and the amount Processing payments and sending payment receipts Google (Firebase Cloud Messaging) Your notification token and a short preview of message text Delivering push notifications Google (Gemini) The text you type to the AI assistant and that conversation's history Generating the assistant's answers Mapbox Your IP address and map session identifiers Displaying maps Resend Your name and email address Sending booking confirmation emails ipwhois.app Your IP address Determining your country, where our servers cannot determine it directly

We also share information with your accommodation provider — the bookings you make with them and the messages you send them.

Other travellers see what you share with them: your chat messages (in a group chat, only people who have been to that place: they scanned a QR code there or are in its chat), your first name and photo, and, only to people currently in the same group chat, that you are or were in it, when you joined or left it and when you were last active there, when you confirmed you are 18 or over, whether you are open to meeting travellers, whether they can message you, whether you show your past cities, and, from Profile → Meeting people, your country, languages and (while Show my past cities is on, and only to travellers you have written to in an accepted chat) the cities you have visited. Staff of a place whose chat you are in see the same.

We may disclose information where required by law, to protect our rights or the safety of others, or in connection with a merger or sale of assets, in which case we will tell you before your data becomes subject to a different policy. 6. International transfers

Some of the providers above process data outside the European Economic Area, including in the United States.

Where that happens, transfers are made under an adequacy decision of the European Commission, or under Standard Contractual Clauses together with supplementary measures where required. You can request details of the safeguards in place by contacting us at help@voytrail.com. 7. How long we keep your data Data Retention Account data Until you delete your account, then removed within 30 days Bookings and payment records 6 years, as required by Spanish accounting and tax law Chat messages Until you delete your account; messages you sent then stay in the conversation without your name or photo Analytics events and QR scan records QR scans recorded to your account are removed with it; anonymous usage statistics are kept in aggregate Visit history (the venues whose QR code you scanned; recorded to your account once you sign in) Until you delete your account; places you remove from Trips are hidden, not deleted, until then Push notification tokens Until you disable notifications or uninstall the app AI assistant conversations Held in your browser or app only; not stored on our servers 8. Deleting your account and your data

You can delete your account and the personal data associated with it:

By email: write to help@voytrail.com from the address linked to your account

We will confirm your request and complete it within 30 days. Some records are kept longer where the law requires it — most commonly booking and payment records retained for accounting purposes. Where that applies, the data is restricted so it is no longer used for anything else. 9. Your rights

Depending on where you live, you have the right to:

access the personal data we hold about you
correct data that is wrong or incomplete
have your data deleted
restrict or object to how we process it, including profiling and processing based on legitimate interests
receive your data in a portable format
withdraw consent at any time, without affecting processing that already took place

To exercise any of these, contact us at help@voytrail.com. We will respond within one month.

If you are in Spain and you believe we have handled your data improperly, you can complain to the Agencia Española de Protección de Datos (AEPD), www.aepd.es. If you are elsewhere in the EEA or the UK, you can complain to your local supervisory authority. 10. Cookies and analytics

We ask for your choice about analytics the first time you visit a venue page, and you can change it at any time through the Cookie Preferences link in the page footer.

Essential. Needed for the site to work — your session, your language, and your cookie choice itself. These cannot be switched off.
Analytics. Which features are used, how far pages are scrolled, and how long is spent on them. Only set if you accept.

If you decline analytics, we still keep a minimal record that a venue page was opened, so that venues can see how often their QR codes are scanned. This record contains no analytics identifiers.

We do not use advertising or marketing cookies, and we do not track you across other websites. 11. Children

VoyTrail is not directed at children. We do not knowingly collect personal data from children under 14 (the age of consent for information society services in Spain; this age differs elsewhere in the EEA).

If you believe a child has provided us with personal data, contact us at help@voytrail.com and we will delete it. 12. Security

We use HTTPS for all data in transit, access controls on our databases, and row-level security so that venues and guests can only reach their own records. Payment card data is handled entirely by Stripe and never reaches our systems.

No service can promise perfect security, but we work to protect your data and will notify you and the relevant authority if a breach is likely to affect your rights. 13. Changes to this policy

We may update this policy. If a change materially affects how we use your data, we will tell you in the app or by email before it takes effect. The version number and date at the top of this page always reflect the current version. 14. Contact

ST NEW, S.L. Pz. Villa Castelldefels 4, Picasso BC, Of. AFW, 29006 Málaga, Spain help@voytrail.com