NaraeNarae
Back

Privacy Policy

Last updated: 11 September 2026

1. Introduction

Narae Voyage ("we", "our") is committed to protecting the privacy of its users. This Privacy Policy explains how we collect, use, share and protect your personal data in accordance with the General Data Protection Regulation (GDPR).

2. Data Controller

The data controller is Narae Voyage.

Contact:privacy@naraevoyage.com

3. Data Collected

We collect the following data:

3.1 Identification data

  • First and last name
  • Email address
  • Profile picture (optional)
  • Google ID (if signing in via Google)

3.2 Travel data

  • Destinations and travel dates
  • Travel preferences (activities, budget, dietary requirements)
  • Itineraries created and saved
  • Travel photos (if shared)

3.3 Technical data

  • IP address
  • Browser and device type
  • Browsing data (pages visited, duration)
  • Cookies and trackers

4. Purposes of Processing

Your data is used to:

  • Provide the Service: Account creation, itinerary generation, trip saving
  • Personalisation: Recommendations based on your preferences
  • Communication: Notifications, service emails, newsletter (with consent)
  • Improvement: Usage analysis to improve the Service
  • Security: Fraud detection and account protection

5. Legal Basis for Processing

The processing of your data is based on:

  • Performance of a contract: Necessary to provide the Service
  • Consent: For the newsletter and non-essential cookies
  • Legitimate interest: Service improvement and security
  • Legal obligation: Data retention in accordance with the law

6. Data Sharing

Your data may be shared with:

6.1 Hosting and Infrastructure

  • Supabase: Database and authentication (EU)
  • Vercel: Website hosting and serverless functions (global)
  • Sentry: Technical error tracking (EU/US)
  • Firebase (Google): Push notifications (US)

6.2 Authentication

  • Google: Sign in via "Sign in with Google"
  • Apple: Sign in via "Sign in with Apple"

6.3 Itinerary Generation

When generating an itinerary, your travel preferences (destination, dates, style) are transmitted to the following services to find the best activities, restaurants and accommodation:

  • Google Gemini (generative AI): Itinerary design based on your travel preferences (Google LLC, US)
  • Claude (Anthropic, generative AI): Itinerary design when this engine is configured (Anthropic PBC, US)
  • Google Places API: Search for attractions, opening times, photos (Google LLC, US)
  • Google Directions API: Calculation of travel times (Google LLC, US)
  • SerpAPI: Search for restaurants and hotels (SerpAPI LLC, US)
  • Viator (Tripadvisor): Activities and excursions (Tripadvisor LLC, US)
  • Open-Meteo: Weather data (Open-Meteo, EU — open source, no personal data)
  • OpenStreetMap / Overpass: Additional points of interest (open source, no personal data)
  • Nominatim: City geocoding (open source, no personal data)

Before sending data to the AI, we ask for your explicit consent. The data concerned includes your preferences (destination, departure, dates, budget, group and requirements), the itinerary, and your requests or chat messages. Google Gemini also analyses the text provided or the content accessible via the social link you choose. In the mobile app, dictation transmits the audio recording to Google Gemini for transcription. Texts and recordings may contain personal information that you include in them.

You can refuse and continue to view or manually edit your trips. Your versioned decision is remembered for your account in this browser or app. You can withdraw this consent in Profile or Privacy → Data & AI on the web, or Profile → Data & AI in the mobile app. Future transmissions will then require your permission; data already transmitted cannot be recalled.

6.4 Payment and Communication

  • Stripe: Web payment processing (Stripe Inc, EU/US — PCI DSS certified)
  • RevenueCat: iOS subscription and in-app purchase management (RevenueCat Inc, US)
  • Resend: Transactional email delivery (Resend Inc, US)

6.5 Other users

  • Public trips and shared profiles according to your visibility settings

We never sell your personal data to third parties.

7. Retention Period

  • Account data: Retained as long as the account is active, then deleted when your deletion request is processed. A processing error is flagged and allows a retry.
  • Trip data: Retained as long as you keep them in your account
  • Group expenses after deletion: In trips belonging to other members, amounts, shares and reimbursements remain viewable under a "Deleted account" participant, without your name or link to your profile. A separate identifier per trip maintains the consistency of the group's accounts. Your own expense notes are removed.
  • Technical data: 13 months maximum
  • Billing data: 10 years (legal obligation)

8. Your Rights (GDPR)

In accordance with the GDPR, you have the following rights:

  • Right of access: Obtain a copy of your data
  • Right to rectification: Correct your inaccurate data
  • Right to erasure: Delete your data ("right to be forgotten")
  • Right to restriction: Restrict the processing of your data
  • Right to portability: Receive your data in a readable format
  • Right to object: Object to the processing of your data
  • Right to withdraw consent: Withdraw your consent at any time

You can directly exercise your rights of access, portability and erasure from yourprofile page("Export my data" and "Delete my account" buttons).

For any other request, contact us at privacy@naraevoyage.com

9. Cookies

We use cookies to:

  • Essential cookies: Website operation, authentication
  • Preference cookies: Theme (light/dark), language
  • Analytics cookies: Usage statistics (with consent)

You can manage your cookie preferences in your browser settings.

10. Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, modification, disclosure or destruction:

  • Encryption of data in transit (HTTPS/TLS)
  • Encryption of data at rest
  • Secure authentication
  • Restricted access to personal data

11. International Transfers

Certain data may be transferred to countries outside the European Union (notably the United States for Vercel). These transfers are governed by appropriate safeguards (standard contractual clauses, adequacy decisions).

12. Minors

The Service is not intended for persons under 16 years of age. We do not knowingly collect personal data from minors. If you are a parent and believe that your child has provided us with data, please contact us.

13. Modifications

We may modify this Privacy Policy. In the event of a substantial modification, we will notify you by email or via the Service.

14. Complaint

If you consider that the processing of your data does not comply with regulations, you can lodge a complaint with the CNIL: www.cnil.fr

15. Contact

For any questions relating to this Privacy Policy: privacy@naraevoyage.com