Privacy Policy
Version: 07.08.2026
1) Information on the Collection of Personal Data and Contact Details of the Controller
1.1 We are pleased that you are visiting our website and thank you for your interest. On the following pages, we inform you about the handling of your personal data when using our website. Personal data is all data with which you can be personally identified. 1.2 The controller in charge of data processing on this website, within the meaning of the General Data Protection Regulation (GDPR), is Nadek UG (haftungsbeschränkt), Friedrichstraße 155, 10117 Berlin, Germany, Phone.: +4915736704839, e-mail: contact@tripsight.app. The controller in charge of the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.
2) Data Collection When You Visit Our Website
2.1 When using our website for information only, i.e. if you do not register or otherwise provide us with information, we only collect data that your browser transmits to our server (so-called "server log files"). When you visit our website, we collect the following data that is technically necessary for us to display the website to you: - Our visited website - Date and time at the moment of access - Amount of data sent in bytes - Source/reference from which you came to the page - Browser used - Operating system used - IP address used (if applicable: in anonymized form) Data processing is carried out in accordance with Art. 6 (1) point f GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data will not be passed on or used in any other way. However, we reserve the right to check the server log files subsequently, if there are any concrete indications of illegal use. 2.2 This website uses SSL or TLS encryption for security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or inquiries to the controller). You can recognize an encrypted connection by the character string https:// and the lock symbol in your browser line.
3) Hosting & Content Delivery Network
3.1 Vercel For the hosting of our website and the display of the page content, we use the system of the following provider: Vercel Inc, 440 N Barranca Ave #4133, Covina, CA 91723, USA All data collected when accessing and using our website for information purposes is processed on the provider's servers. We have concluded an order processing agreement with the provider, ensuring the protection of our site visitors' data and prohibiting unauthorised disclosure to third parties. For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission. 3.2 Vercel We use a content delivery network offered by the following provider: Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA This service enables us to deliver large media files such as graphics, page content or scripts faster via a network of regionally distributed servers. The processing is carried out to protect our legitimate interest in improving the stability and functionality of our website pursuant to Art. 6 (1) point f GDPR. We have concluded an order processing agreement with the provider, ensuring the protection of our site visitors' data and prohibiting unauthorised disclosure to third parties. For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.
5) Contacting Us
5.1 When you contact us (e.g. via contact form or e-mail), personal data is collected. Which data is collected in the case of a contact form can be seen from the respective contact form. This data is stored and used exclusively for the purpose of responding to your request or for establishing contact and for the associated technical administration. The legal basis for processing data is our legitimate interest in responding to your request in accordance with Art. 6 (1) point f GDPR. If your contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6 (1) point b GDPR. Your data will be deleted after final processing of your enquiry; this is the case if it can be inferred from the circumstances that the facts in question have been finally clarified, provided there are no legal storage obligations to the contrary. 5.2 - Resend We use the following provider to send transactional emails, i.e. event-driven messages triggered by a specific user interaction (such as the conclusion of a contract, registration or password reset): Plus Five Five, Inc., 2261 Market Street, #5039, San Francisco, CA 94114, USA On the basis of our legitimate interest in effective and user-friendly email communication, we pass on the data you provide when carrying out such a user action to this provider in accordance with art. 6 (1) point f GDPR, so that they can handle the sending of emails on our behalf. We have concluded an order processing agreement with the provider, which safeguards the data of our website visitors and prohibits a disclosure to third parties. For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.
6) Data Processing When Opening a Customer Account and for Contract Processing
Pursuant to Art. 6 (1) point b GDPR, personal data will continue to be collected and processed to the extent required in each case if you provide us with this data when opening a customer account. The data required for opening an account can be found in the input mask of the corresponding form on our website. Deletion of your customer account is possible at any time and can be done by sending a message to the above address of the person responsible. After deletion of your customer account, your data will be deleted, provided that all contracts concluded via it have been fully processed, no legal retention periods are opposed and no legitimate interest on our part in the continued storage exists.
7) Use of Client Data for Direct Advertising
Subscribe to our e-mail newsletter If you register for our e-mail newsletter, we will regularly send you information about our offers. The only mandatory data for sending the newsletter is your e-mail address. The provision of further data is voluntary and will be used to address you personally. We use the so-called double opt-in procedure for sending the newsletter. This means that we will only send you an e-mail newsletter once you have expressly confirmed that you consent to receiving newsletters. We will then send you a confirmation e-mail asking you to confirm that you wish to receive the newsletter in future by clicking on an appropriate link. By activating the confirmation link, you give us your consent for the use of your personal data pursuant to Art. 6 (1) point a GPPR. When you register for the newsletter, we store your IP address entered by your Internet service provider (ISP) as well as the date and time of registration for the purpose of tracing any possible misuse of your e-mail address at a later date. The data collected by us when you register for the newsletter is used exclusively for the promotional purposes by way of the newsletter. You can unsubscribe from the newsletter at any time via the link provided for this purpose in the newsletter or by sending a corresponding message to the responsible person named at the beginning. After unsubscribing, your e-mail address will be deleted from our newsletter distribution list immediately, unless you have expressly consented to further use of your data, or we reserve the right to a more extensive use your data which is permitted by law and about which we inform you in this declaration.
8) Processing of Data for the Purpose of Order Handling
8.1 To fulfill the contract, we work with the following service provider(s), who support us in whole or in part in the execution of concluded contracts. Certain personal data is transferred to these service providers in accordance with the following information. 8.2 Use of Payment Service Providers - Stripe Online payment methods from the following provider are available on this website: Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland If you select a payment method of the provider, your payment data provided during the ordering process (including name, address, bank and payment card information, currency and transaction number) as well as information about the content of your order will be passed on to the provider in accordance with Art. 6 (1) point b GDPR. In this case, your data will only be passed on for the purpose of processing payment with the provider and only to the extent necessary for this purpose. 8.3 - Anthropic Claude We use software incorporating artificial intelligence from the following provider to provide our services: Anthropic Ireland Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland Information provided by you within the scope of a contractual relationship may be entered into the provider's software in order to organize, analyze, aggregate, modify, evaluate, or process it for the purpose of delivering our services. Information may also be transmitted to: Anthropic PBC, USA The collection and further processing of this information are strictly limited to the purpose of contract fulfillment. Processing for the purpose of training or further developing the provider's AI language models is expressly prohibited. Where the processing involves personal data, it is carried out based on our legitimate interest in structuring our services efficiently and making optimal use of available resources and technologies, in accordance with Art. 6(1)(f) of the GDPR. If the personal data belongs to third parties and you have entrusted us with its processing, such processing is secured through a data processing agreement concluded with us; this agreement specifies the measures taken to protect the data as well as your rights of control and access. We have concluded an order processing agreement with the provider, that ensures the protection of personal data processed by the provider and prohibits unauthorized disclosure to third parties. For the transfer of data to the USA, the provider relies on standard contractual clauses of the European Commission, which are meant to ensure compliance with the European level of data protection. 8.4 Electronic termination option for continuing obligations with consumers Consumers who have concluded contracts on this website for continuing obligations for which payment is required (e.g., subscription contracts) have the option of terminating these contracts via an electronic button in accordance with the applicable notice periods. Pressing the button leads to a confirmation page on which the consumer can provide more detailed information on the termination, clearly identify himself and subsequently declare his termination electronically. The collection of personal data and its transmission to us is carried out in accordance with Art. 6 (1) point b GDPR and only to the extent necessary for the proper processing of the termination. Pursuant to Art. 6 (1) point b GDPR, the provided personal data will also be used to confirm receipt of the termination declaration and the termination date by electronic means in text form. The additional legal basis for such processing is Art. 6 (1) point c GDPR. We are legally obliged to provide an electronic termination option for consumer contracts concluded by means of electronic commerce regarding continuing obligations for which payment is required. 8.5 Electronic Withdrawal Function for Distance Contracts Consumers who conclude contracts on this website for which a statutory right of withdrawal exists have the option to declare their withdrawal via an electronic withdrawal function, in accordance with the applicable withdrawal provisions. When using the withdrawal function, in addition to details identifying the specific contract being withdrawn from, other personal information—such as the consumer's first name, last name, and email address—must be provided or confirmed. The collection of this information and its transmission to us is carried out in accordance with Art. 6 (1) point b of the GDPR, and only to the extent necessary for the proper processing of the withdrawal request. Furthermore, and also based on Art. 6 (1) point b of the GDPR, the provided personal data is used to confirm receipt of the withdrawal declaration via email. An additional legal basis for this processing is Art. 6 (1) point c of the GDPR. We are legally obligated to provide an electronic cancellation function for remunerated distance contracts concluded with consumers.
9) Web Analysis Services
Vercel Analytics This website uses a web analytics service provided by the following provider: Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA To protect website visitors, the provider uses a pseudonymised visitor identifier to enable various analyses of website usage within a short time frame of no more than 24 hours. This visitor identifier is a randomly generated, time-limited hash value created on the basis of a reduced set of technical attributes. These include, in particular, the user agent (information about the browser and operating system) and the anonymised IP address, which is processed solely for the duration of the analysis and is subsequently discarded. Should personal data nevertheless be processed in individual cases, such processing is carried out on the basis of our legitimate interest in the statistical analysis of usage behaviour for optimisation purposes, in accordance with Article 6 (1) point f of the GDPR. In this case, you may permanently object to the collection and storage of your visitor data in future by notifying us. We have entered into a data processing agreement with the provider, which ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties. For data transfers to the USA, the provider has adhered to the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with European data protection standards.
10) Site Functionalities
10.1 - Supabase On our website, we use the service provided by the following provider to verify registration and login attempts for restricted areas of the site: Supabase, Inc., 548 Market St, San Francisco, CA 94104, USA Solely on the basis of our legitimate interest in safeguarding the structural and data security of our website, your registration details (email address, username and password) are transmitted to the provider for authentication in accordance with Article 6 (1) point f GDPR, in order to determine whether to authorise the registration attempt. We have entered into a data processing agreement with the provider which protects the data of our website visitors and prohibits disclosure to third parties. For the transfer of data to the USA, the provider relies on the European Commission’s Standard Contractual Clauses, which are intended to ensure compliance with European data protection standards. 10.2 OpenStreetMap This website uses an online map service provided by the following provider: OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, UK The online map service is a tool for displaying interactive maps in order to visually present geographical information. By using this service, our location is displayed to you and any geolocation is made easier. Already when accessing those sub-pages in which the map of the provider is integrated, information about your use of our website (such as your IP address) is transferred to servers of the provider and stored there. The processing of your personal data is carried out in accordance with Art. 6 (1) point f GDPR on the basis of our legitimate interest in the demand-oriented design of our website. If you do not agree to the future transfer of your data to the provider, it is possible to completely deactivate the provider's online map service by deactivating the JavaScript application in your browser. The online map service on this website can then no longer be used. To the extent legally required, we have obtained your consent for the processing of your data as described above in accordance with Art. 6 (1) point a GDPR. You can revoke your consent at any time with effect for the future. In order to exercise your revocation, please follow the option described above for making an objection. For a data transfer to the provider location, an adequate level of data protection is guaranteed by an adequacy decision of the European Commission. 10.3 - hCaptcha On this website, we use the CAPTCHA service of the following provider: Intuition Machines, Inc., 350 Alabama St, San Francisco, CA 94110, USA The service checks whether an input is made by a natural person or abusively by machine and automated processing with the aim of blocking spam, DDoS attacks and similar automated malicious attacks. To ensure whether an action is performed by a human being and not by an automated bot, Cloudflare Turnstile collects the IP address of the end device used, the recognition data of the browser, the operating system type and the date and duration of the visit and transmits these data to the provider's servers to be evaluated. This process is based on our legitimate interest in determining individual responsibility when using the Internet and in preventing abuse and spam in accordance with Art. 6 Para. 1 lit. f GDPR. We have concluded an order processing contract with the provider, ensuring the protection of our site visitors' data and prohibiting unauthorized disclosure to third parties. For the transfer of data to the USA, the provider relies on standard contractual clauses of the European Commission, which are meant to ensure compliance with the European level of data protection. 10.4 - Unsplash On some of our web pages, we use the server capacity of the following provider to display image files: Unsplash Inc., 400 Rue McGill, Suite 500, Montreal, Quebec H2Y 2G1, Canada Image content can be delivered and displayed in a targeted manner via the provider’s servers. When you access a page on our website that contains the provider’s content, a connection is established with the provider’s servers in order to load the relevant content. In doing so, your IP address is collected and transmitted to the provider to enable the external content to be delivered in a manner appropriate to your location. No personal data other than your IP address is transmitted to the provider. Once the content has been loaded, your IP address is deleted by the provider. The legal basis for the processing is our legitimate interest in designing our online offering in a resource-efficient and appealing manner, in accordance with Article 6 (1) point f GDPR. Where data is transferred to the provider’s location, an adequate level of data protection is guaranteed by an adequacy decision of the European Commission.
11) Tools and Miscellaneous
11.1 - Lexware Office For the execution of the accounting, we use the service of the cloud-based accounting software of the following provider: Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany The provider processes incoming and outgoing invoices and, if applicable, also the bank transactions of our company in order to automatically record invoices, match them to the transactions and create the financial accounting from this in a semi-automated process. Insofar as personal data is also processed in this context, the processing is carried out in accordance with Art. 6 (1) point f GDPR on the basis of our legitimate interest in the efficient organisation and documentation of our business transactions. 11.2 Upstash For security purposes, this website uses the service of the following provider: Upstash, Inc., 6202 Vía De Adrianna, San Jose, CA 95120, USA The provider protects the website and the associated IT infrastructure from unauthorised third-party access, cyber attacks and viruses and malware. The provider collects the IP addresses of users and, if necessary, further data on their behaviour on our website (in particular URLs accessed and header information) in order to detect and defend against illegitimate page accesses and dangers. In doing so, the collected IP address is compared with a list of known attackers. If the captured IP address is identified as a security risk, the provider can automatically block it from accessing the website. The information collected in this way is transferred to a server of the provider and stored there. The described data processing is carried out in accordance with Art. 6 (1) point f GDPR on the basis of our legitimate interests in protecting the website from harmful cyber attacks and in maintaining structural and data integrity and security. We have concluded an order processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorised disclosure to third parties. For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission. 11.3 Sentry This website uses an automatic error reporting service from the following provider: Functional Software Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA In the event of technical complications or functional impairments in connection with the operation of the software of the provider, the system sends automatic error reports to the provider containing information on the respective source of the error and its origin. Server information as well as usage parameters such as the IP address, the browser used, time stamps and the URL accessed are transferred. Depending on the origin of the error, error reports may also contain further personal customer data that we have collected and stored in the course of the conclusion of a contract (in particular first name and surname, address, e-mail address). This is always possible if the error occurs in connection with a software-based processing of customer data. Insofar as personal data is also involved in the information transferred in this way, the processing is carried out in accordance with Art. 6 (1) point f GDPR on the basis of our legitimate interest in an efficient error cause analysis to improve the reliability and functionality of our website. For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.
12) Rights of the Data Subject
12.1 The applicable data protection law grants you the following comprehensive rights of data subjects (rights of information and intervention) vis-à-vis the data controller with regard to the processing of your personal data: - Right of access by the data subject pursuant to Art. 15 GDPR; - Right to rectification pursuant to Art. 16 GDPR; - Right to erasure (“right to be forgotten”) pursuant to Art. 17 GDPR; - Right to restriction of processing pursuant to Art. 18 GDPR; - Right to be informed pursuant to Art. 19 GDPR; - Right to data portability pursuant to Art. 20 GDPR; - Right to withdraw a given consent pursuant to Art. 7 (3) GDPR; - Right to lodge a complaint pursuant to Art. 77 GDPR. 12.2 RIGHT TO OBJECT IF, WITHIN THE FRAMEWORK OF A CONSIDERATION OF INTERESTS, WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR PREDOMINANT LEGITIMATE INTEREST, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE ON THE GROUNDS THAT ARISE FROM YOUR PARTICULAR SITUATION. IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO FURTHER PROCESSING IF WE CAN PROVE COMPELLING REASONS WORTHY OF PROTECTION FOR PROCESSING WHICH OUTWEIGH YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES TO ASSERT, EXERCISE OR DEFEND LEGAL CLAIMS. IF WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA WHICH ARE USED FOR DIRECT MARKETING PURPOSES. YOU MAY EXERCISE THE OBJECTION AS DESCRIBED ABOVE. IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT ADVERTISING PURPOSES.
13) Duration of Storage of Personal Data
The duration of the storage of personal data is based on the respective legal basis, the purpose of processing and - if relevant – on the respective legal retention period (e.g. commercial and tax retention periods). If personal data is processed on the basis of express consent pursuant to Art. 6 (1) point a GDPR, this data is stored until the data subject revokes his consent. If there are legal storage periods for data that is processed within the framework of legal or similar obligations on the basis of Art. 6 (1) point b GDPR, this data will be routinely deleted after expiry of the storage periods if it is no longer necessary for the fulfillment of the contract or the initiation of the contract and/or if we no longer have a justified interest in further storage. When processing personal data on the basis of Art. 6 (1) point f GDPR, this data is stored until the data subject exercises his right of objection in accordance with Art. 21 (1) GDPR, unless we can provide compelling grounds for processing worthy of protection which outweigh the interests, rights and freedoms of the data subject, or the processing serves to assert, exercise or defend legal claims. If personal data is processed for the purpose of direct marketing based on Art. 6 (1) point f GDPR, this data is stored until the data subject exercises his right of objection pursuant to Art. 21 (2) GDPR. Unless otherwise stated in the information contained in this declaration on specific processing situations, stored personal data will be deleted if it is no longer necessary for the purposes for which it was collected or otherwise processed.
14) Retention periods by data category
In addition to the general information on retention above, the following periods apply to the individual categories of data: – Account data — retained for as long as your account is active. Deleted within 30 days of account deletion. – Search preferences — retained for as long as your account is active or until you clear your browser storage. – Usage counters — retained for 30 rolling days. – Payment records — retained for the period required by German tax and commercial law (10 years under § 147 AO). – Cancellation and withdrawal declarations — kept as legally required proof for the duration of the commercial- and tax-law retention periods (§ 257 HGB, § 147 AO), regularly 6 years. This also applies if you have no user account or your account has since been deleted. – Consent records for opt-in e-mails — when you confirm the double opt-in link, we store the IP address and the date and time of that confirmation as proof of your consent. After a withdrawal we no longer base this record on your consent but on Art. 6(1)(f) GDPR — our legitimate interest in being able to demonstrate that the e-mails sent up to that point were lawful (Art. 7(1) GDPR, § 7(2) UWG). We therefore keep it for the regular limitation period of three years (§ 195 BGB), which under § 199(1) BGB only starts to run at the end of the relevant year; it is deleted no later than four years after the consent ends. This does not affect the withdrawal itself: your address is removed from the distribution list immediately and you will receive no further opt-in e-mails. – Server logs — retained for up to 30 days by the hosting provider. – Error reports — retained for up to 90 days by the error-reporting provider.
15) Where your account and trip data is stored
Your account data (e-mail address, your password — stored exclusively as a cryptographic hash — and a name if you choose to provide one), your saved trips and your search and travel preferences are stored in a database provided by: Supabase, Inc., 548 Market St, San Francisco, CA 94104, USA. The project used for TripSight is pinned to the EU region Frankfurt am Main, so this data is stored within the European Union. The legal basis is Art. 6(1)(b) GDPR, as storage is necessary in order to perform the user agreement concluded with you. We have entered into a data processing agreement pursuant to Art. 28 GDPR with the provider.
16) Automated decision-making and profiling (Art. 22 GDPR)
TripSight ranks destinations algorithmically based on the preferences you submit (dates, budget, vibes, food, passport). This ranking does not produce legal effects concerning you or similarly significantly affect you within the meaning of Art. 22 GDPR. We do not use automated decision-making for credit, hiring, insurance, pricing or any other consequential decision.
17) Children's data (Art. 8 GDPR)
TripSight is not directed at children. Under Art. 8 GDPR, EU member states set the minimum age for valid consent between 13 and 16 (for example Germany 16, France 15, Italy and Spain 14, Sweden 13). We do not knowingly process personal data of users below the age that applies in their country of residence, and in case of doubt we apply 16 by default. If you become aware that a child has created an account, please contact us at contact@tripsight.app and we will delete the account.
18) Data security (Art. 32 GDPR)
We implement appropriate technical and organisational measures pursuant to Art. 32 GDPR: HTTPS/TLS for all data in transit, row-level security in our database so that users can only access their own data, environment-variable management for all API keys and secrets, the principle of least privilege for processor access, and regular updates of the software components we use.
19) Data breaches (Art. 33, 34 GDPR)
In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours (Art. 33 GDPR) and, where the risk is high, inform the affected users without undue delay (Art. 34 GDPR).
20) Supervisory authority and Data Protection Officer
Under Art. 77 GDPR you have the right to lodge a complaint with the supervisory authority of the EU member state where you live, work, or where the alleged infringement occurred. Our competent supervisory authority is the Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI), datenschutz-berlin.de. We do not meet the thresholds in § 38 BDSG and have therefore not appointed a Data Protection Officer. For all data-protection questions, please use the contact details given at the beginning of this policy.
21) Changes to this policy
We may update this privacy policy from time to time. We will communicate material changes by e-mail or by a notice on the website. The date given above reflects the most recent revision.
This privacy policy has been created by the specialist lawyers of IT-Recht Kanzlei and is protected by copyright (https://www.it-recht-kanzlei.de)
Sections 14 to 21 were drafted by the operator and are not covered by the notice above.