Privacy Policy of Travee GmbH

1. Controller

Travee GmbH
Kolonnenstraße 8, 10827 Berlin, Germany
Email (privacy & general): contact​[at]​travee.eu
Managing Director authorized to represent: Conrad Emanuel Mildenstrey

2. Purposes, Data Categories, Legal Bases

We process personal data only to the extent necessary. Unless stated otherwise below, we base processing on:

• Art. 6(1)(b) GDPR (contract/contract initiation)
• Art. 6(1)(f) GDPR (legitimate interests -- each with a balancing test)
• Art. 6(1)(c) GDPR (legal obligations, e.g., commercial/tax retention)
• for consents: Art. 6(1)(a) in conjunction with Art. 7 GDPR

For access to end devices (cookies/local storage/SDK identifiers), "§ 25 TDDDG (formerly § 25 TTDSG)" governs.

2.1 Use of the Travee App (Core Function)

Data: Account/profile data (name, email, password hash), app/language settings, travel and content preferences, in-app interactions.

Purpose: Provision and personalization of content (audio guides, routes, recommendations).

Legal basis: Art. 6(1)(b) GDPR.

Retention: until account deletion; backups 90 days (see section 10 for details).

2.2 Signup Source (Acquisition Attribution)

Data: When an account is created in our app, we record once where the signup originated: campaign parameters (e.g., utm_*), the referring website's domain, which page and button on our website led to the app, and a random click identifier.

Purpose: Internal analysis of which marketing channels lead to signups. This data is not used to build usage profiles and is not shared with third parties.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in measuring marketing effectiveness).

Retention: Linked to your account and deleted together with the account (see section 10 for details).

Objection: You may object at any time under Art. 21 GDPR via the contact given in section 12.

2.3 Location Data (if enabled)

Data: GPS/Wi-Fi/cell-based location (precise/approximate).

Purpose: location-based recommendations, navigation, "nearby".

Legal basis: Art. 6(1)(b) GDPR insofar as required for core functions; otherwise consent (Art. 6(1)(a) GDPR).

Retention: context-dependent; no permanent history unless required for the core function.

Note: Permissions can be revoked at any time in the operating system.

2.4 Microphone/Voice Functions (if enabled)

Data: Voice commands/short audio inputs (on-device or server-side), transcripts.

Purpose: voice mode and natural interaction.

Legal basis: Art. 6(1)(b) GDPR; where applicable consent (Art. 6(1)(a) GDPR).

Important: No creation of voice profiles/voiceprints and no biometric identification; no profiling from voice characteristics.

Transcription: Audio inputs are -- insofar as required for the voice mode -- transcribed automatically; the transcripts may be evaluated according to § 2.17 for functional operation, quality/product improvement, and security.

Retention: Raw audio is generally not stored permanently; where required for troubleshooting, only short-term (see section 10 for details).

2.5 Personalization & Profiling (without legal effect)

Data: Preferences, usage patterns, context (location/time).

Purpose: more relevant content, timing of notices.

Legal basis: Art. 6(1)(f) GDPR (user-friendly UX) and/or Art. 6(1)(b) GDPR.

Note: No automated decisions with legal effect within the meaning of Art. 22 GDPR.

2.6 Audio Generation via Third Parties (e.g., ElevenLabs)

Data: Text content (guide scripts, personalized salutation), technical metadata.

Purpose: text-to-speech output of audio guides.

Legal basis: Art. 6(1)(b) GDPR; processing under Art. 28 GDPR.

Retention: see section 10.

2.7 Map Services & Places (e.g., Google Maps/Places, MapTiler)

Data: IP address, where applicable location (if granted), device info, search queries.

Purpose: map display, POI data, route planning.

Legal basis: Art. 6(1)(b) and/or Art. 6(1)(a) GDPR (depending on implementation).

Retention: per provider specifications; we store only what is necessary for the purpose.

2.8 Affiliate Links & Booking Redirects (e.g., GetYourGuide/Viator/Booking)

Data: referrer/partner ID, calling URL, where applicable cookie/SDK IDs for commission attribution.

Purpose: commission accounting, abuse/fraud prevention.

Legal basis: End-device access: § 25 TDDDG (consent unless technically required). Subsequent processing: Art. 6(1)(a) and/or (f) GDPR.

Retention: minimized and purpose-bound per partner requirements.

Note: Contract/checkout with the third party (independent controller).

2.9 App Stores/In-App Purchases

Data: transaction IDs, product information, pseudonymous device IDs.

Purpose: processing purchases/subscriptions, license verification.

Legal basis: Art. 6(1)(b) GDPR.

Note: Apple/Google act as independent controllers for payment processing.

2.10 Support/Communication

Data: email address, content of the inquiry, technical logs.

Purpose: responding to inquiries, troubleshooting.

Legal basis: Art. 6(1)(b) and (f) GDPR.

Retention: 12 months after completion (see section 10 for details).

Business enquiry form (website): If you contact us through the "Travee for Business" form, we process your name, company, work email address, industry, your message and your chosen starting point, plus your IP address for abuse protection. The enquiry is stored with our hosting provider AWS (Frankfurt) and sent to our team by email; a notice with your name, company, industry, starting point and message (without your email address) is posted to our internal team channel in Slack. To limit abuse, a keyed hash of your IP address is kept for at most two hours. Bot protection: see § 2.22. Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps at your request) and Art. 6(1)(f) GDPR (protection against abuse). Retention: 12 months after receipt.

2.11 Usage Analytics & Crash Reports (e.g., Firebase Analytics/Crashlytics, Sentry)

Data: app events, crash data, device information, where applicable advertising IDs (IDFA/AAID).

Purpose: stability, performance, product improvement.

Legal basis: § 25 TDDDG (end-device access) + Art. 6(1)(a) GDPR (consent); exceptionally Art. 6(1)(f) GDPR for strictly technically required measurement without marketing reference.

Retention: 14 months (see section 10 for details).

2.12 Newsletter/Product Updates

Data: email, opt-in, timestamp (double opt-in).

Purpose: information about Travee.

Legal basis: Art. 6(1)(a) GDPR; proof of consent (Art. 7 GDPR).

Withdrawal: at any time; link in every email.

2.13 Website Visit & Server Logs

Data: IP, date/time, pages accessed, user agent, referrer.

Purpose: delivery, security (e.g., DDoS protection), error diagnostics.

Legal basis: Art. 6(1)(f) GDPR.

Retention: 7 days (see section 10 for details).

2.14 Website Reach Measurement (Cookieless)

Data: Visited page path, language, clicked element (e.g., links/buttons to our app or to the app stores), campaign parameters from the address bar (e.g., utm_*), the referring website's domain, and a pseudonymous daily identifier.

Purpose: Measuring the use of our website (pages viewed, clicks on links/buttons to our app and to the app stores) with our own first-party system in order to assess and improve reach and effectiveness. No third-party analytics providers receive this data.

No cookies: This measurement uses no cookies and no comparable storage on your end device; § 25 TDDDG is therefore not triggered.

Pseudonymous identifier: To distinguish visitors, a pseudonymous identifier is computed from the IP address and browser information using a secret key that changes daily. The IP address is used only transiently in memory for this computation and is neither stored nor logged. The identifier cannot be linked back to a person and does not allow tracking across days or across other websites.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in measuring and improving the reach and effectiveness of our website and marketing).

Retention: Raw measurement events are deleted after 14 months at the latest (see section 10 for details); aggregated statistics contain no identifiers.

Objection: You may object at any time under Art. 21 GDPR via the contact given in section 12.

2.15 Push Notifications (if enabled)

Data: device token (APNS/FCM), app/device metadata.

Purpose: service notices (e.g., tour status) and optionally information/tips.

Legal basis: Art. 6(1)(b) GDPR for service-critical notices; otherwise consent or Art. 6(1)(f) GDPR (with opt-out).

Retention: tied to runtime; opt-out at any time in OS/app settings.

2.16 Data Sources

Data originates from self-disclosure, app/website usage, and -- depending on the feature -- from third-party APIs (e.g., maps/POI, payment or affiliate partners).

2.17 Chat & Voice Guide Histories (Content & Usage Analysis)

Data: contents of your chat messages and voice guide interactions (transcripts), associated metadata (timestamps, language, approximate location/context information, app/device information, pseudonymous user/device IDs) as well as derived data (e.g., topics/categories, intents, embeddings, quality/usage metrics).

Purposes:

• a) Functional operation (conversation/answers, history)
• b) evaluation of voice guide transcripts together with chat histories to understand use cases and improve product/quality (e.g., topics, intents, handover points)
• c) Security/abuse prevention (e.g., spam/abuse detection, rate limiting)
• d) Aggregated analyses (feature usage, topic popularity -- without personal reference; see section 9)

Legal basis:

• a) Art. 6(1)(b) GDPR (contract)
• b/c) Art. 6(1)(f) GDPR (legitimate interests in a stable, secure, and improved app; objection possible at any time, see section 12) and -- where required -- consent (Art. 6(1)(a) GDPR) via the consent center
• d) Art. 6(1)(f) GDPR (based only on aggregated/anonymous data)

Safeguards: strict access controls, pseudonymization, shortest possible raw storage, sample-based human review only for the stated purposes, no use of content for own purposes by processors, no training of external foundation models.

Retention:

• Histories/transcripts: 12 months (shorter if you delete)
• raw audio (if stored): only short-term for troubleshooting/improvement; then deletion
• derived metrics/embeddings: 14 months (pseudonymized)
• aggregated/anonymous analyses: without personal reference, can be used longer

2.18 AI/LLM-Based Content & Dialog Generation (e.g., OpenAI, Google Gemini, Perplexity)

Data: Contents of your chat messages and voice interaction audio/transcripts, camera frames captured during a visual question-answering session (if enabled), system prompts, conversation history, derived context (preferences, trip details, language, approximate location), technical metadata.

Purpose: Generation of conversational responses, trip planning, content drafts, tool-assisted actions, and current-events/web-search lookups within the Travee chat, voice, and camera features. Real-time voice dialog (Voice Guide) and real-time visual question-answering (camera frames) are processed via Google Gemini (Live API); text-based chat and trip planning are processed via OpenAI; current-events and web-search lookups are processed via Perplexity. Short reaction decisions in the chat (whether, and with which emoji, the guide reacts to one of your messages) are made with TypeSafe (Jev), reached through OpenRouter.

Legal basis: Art. 6(1)(b) GDPR (provision of the contractual service); for short reaction decisions in the chat, Art. 6(1)(f) GDPR (legitimate interest in a natural, responsive chat experience; objection possible at any time, see section 12); processing under Art. 28 GDPR.

Safeguards: No use of content for the provider's own purposes, no training of the provider's foundation models on Travee data (per processor agreement). Performance-related processor-side caching of prompt prefixes is technically necessary and limited to short retention windows (typically minutes, up to 24 hours).

Retention: see section 10 (chat/voice histories: 12 months on our side; processor-side caching is short-term and ephemeral).

2.19 Camera / Visual Question-Answering (if enabled)

Data: Live camera frames captured while you actively use the visual question-answering feature, associated metadata (timestamp, language, approximate location/context information, app/device information, pseudonymous user/device IDs), and any derived data (e.g., textual descriptions, intents).

Purpose: Real-time visual question-answering as part of the Travee voice/chat features (e.g., "what is this building?").

Legal basis: Art. 6(1)(b) GDPR insofar as required for the requested function; otherwise consent (Art. 6(1)(a) GDPR).

Important: No facial recognition, no creation of biometric profiles, no identification of individuals. Camera frames are used only to answer your immediate question.

Processing: Camera frames are streamed in real time to Google's Gemini Live API for visual question-answering and are not persistently stored by us; Google processes the frames as a processor under Art. 28 GDPR. Camera access is granted via the operating system and can be revoked at any time.

Retention: Frames themselves are not persistently stored; derived textual outputs may be retained as part of the chat/voice history (see § 2.17 and § 10).

2.20 Hotel Booking via Travee (LiteAPI/Nuitée)

Data: Lead guest details (first/last name, email address, phone number), stay details (hotel, dates, room/rate, price), booking references and confirmation status. Payment data (e.g., card details) are entered directly with the payment service of our booking partner and never reach Travee.

Purpose: Brokering and processing of hotel bookings you actively request, display of the booking status in your trip, support with booking issues.

Roles: Travee acts as an intermediary. Your accommodation contract is concluded with the respective accommodation provider; the booking platform Nuitée Travel Limited (Dublin, Ireland; operator of "LiteAPI") processes the booking and payment as merchant of record. Nuitée and the accommodation provider are independent controllers for their own processing; their privacy notices apply.

Legal basis: Art. 6(1)(b) GDPR (processing of the booking you request). The embedded payment component's access to your end device is technically required for the requested booking (§ 25(2) TDDDG).

Third-country transfers: Nuitée is established in the EU (Ireland). Depending on your destination, the booked accommodation provider may be located outside the EU/EEA; the transfer of guest data required for the booking is then based on Art. 49(1)(b) GDPR (performance of a contract concluded in the interest of the data subject).

Retention: Booking records per section 10 (commercial/tax retention periods); booking details remain part of your trip until you delete them.

2.21 Forwarding Emails to Travee (Travee Inbox)

Data: the sender address of emails you forward and any additional sender addresses you add in your profile (confirmed with a one-time code sent to that address); the forwarded email (subject, text, formatting, images contained in it, attachments such as PDFs and images, time of receipt, and, for a forwarded message, its original sender, date and subject as stated in the email); results of technical checks (sender authentication, spam/virus scan); the bookings and expenses derived from it (e.g. dates, check-in and check-out times, the hotel's phone number, price, payment status and cancellation terms); a short summary of the email.

Purpose: Adding bookings and expenses from emails you forward to your trips, telling you in a new chat in Travee what was added or what Travee needs to ask you, and showing you a short summary and a readable copy of the email there. Travee does not reply by email.

Processing: Emails are received and stored via our hosting provider AWS. To recognize bookings and expenses, the email content is processed by OpenAI as a processor under our data processing agreement (see § 2.18). Emails are accepted only from your account address or addresses you have confirmed, and only if the sending email provider authenticates them. Emails from unknown senders are not processed and receive no reply.

Email copy and summary: To show you the email, we keep a sanitized copy of it. Active content (e.g. scripts and forms), references that would load external content, and tracking images are removed, images from the internet are not loaded, and only supported attachment types (PDF, JPG, PNG, WebP) are kept; very large or malformed emails may be kept as plain text only, and some images may be left out. The copy is therefore not an exact reproduction of the email, and the raw email file is not provided. The original sender, date and subject of a forwarded message are shown as stated in the email and marked as unverified; they are never used to identify you or to accept an email. The short summary is created automatically from the information read from the email, where necessary with the help of OpenAI, and is designed to leave out names and contact details of travelers, booking and access codes, PINs and payment card details. The copy and the summary are visible only to you; bookings and expenses added to a shared trip are visible to its members like other entries of that trip.

Legal basis: Art. 6(1)(b) GDPR (provision of the feature you use). Checking senders and keeping a short log of rejected emails: Art. 6(1)(f) GDPR (legitimate interest in protecting accounts against forged emails and abuse, and in answering support requests).

Retention:

• Raw email file: deleted shortly after processing, at the latest within about a week.
• Email content (the copy of the email with its text, images and attachments, subject, sender details, what was read from it, and the short summary): until 90 days after the end of the trip the email belongs to, up to the end of that day (UTC). An email belongs to a trip if Travee added something from it to that trip, or if its chat is assigned to that trip; trips that were removed or deleted no longer count. If it belongs to several trips, the latest end date counts, and if a trip's dates change, the date moves with them. If the email belongs to no trip, or to no trip with a known end date: 12 months after it arrived. The chat created for an email is part of your chat history (see § 2.17) and may be kept longer; the email's content is still removed from it at that point, and only Travee's message about what it did remains.
• Deleting the email yourself: you can delete the copy of the email at any time in its chat. It is no longer shown from that moment, and the stored files are deleted shortly afterwards. Bookings and expenses already added, Undo and the chat itself remain.
• Deleting the chat: removes the forwarded email, its copy, its text and any attachments that are not part of a saved expense (hidden at once, deleted within a day).
• Receipt files of expenses: have their own lifetime, independent of the email copy. Receipt files saved with an expense are kept for at most 90 days. Deleting the email or its chat does not remove a receipt file from a saved expense, and an expired receipt file does not affect the email copy.
• Minimal processing records: after the email content is removed, we keep for each accepted email only the time of receipt, the processing status and what Travee added, so the chat can show it, Undo keeps working and the same email is never processed twice. These records are deleted with your account.
• Pseudonymized sender address: a keyed hash of the sender address is kept for 30 days for support requests ("did my email arrive?").
• Rejected emails: no content is stored; only the keyed hash of the sender address, the time and the reason, for 30 days.
• Saved bookings and expenses: until you delete them or your account.
• Deleting your account removes your forwarded emails, processing records and sender addresses. Records of rejected emails are not linked to an account and expire after 30 days.

2.22 Bot Protection (Cloudflare Turnstile)

Data: IP address, browser and device characteristics (e.g., user agent, screen and browser properties), and signals about how the check page is used.

Purpose: Telling people from automated programs, to protect the website's business enquiry form and sign-in and access to the web app against spam and abuse. On the website, the check is loaded only when you start filling in the form.

Processing: Cloudflare, Inc. (USA) as a processor under Art. 28 GDPR. Cloudflare returns only a pass/fail result to us; we do not receive the collected browser data. Accessing device information for this check is strictly necessary to provide the service you request (§ 25(2) no. 2 TDDDG).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting our services against abuse).

Third-country transfer: USA (EU-US Data Privacy Framework / SCC).

---

3. Cookies & SDKs / Consent Management

We use cookies, local storage, and mobile SDKs. We use non-essential technologies only with consent (§ 25 TDDDG). Technically necessary technologies serve, for example, login/session, licensing, and security.

Categories (website):

• Essential (e.g., session, security, consent storage)
• Analytics/Performance (e.g., usage metrics, load times)
• Functional (convenience features)

We use non-essential categories only with consent.

Consent Management (App):

Travee Consent Center (in-house solution). Consents for analytics, personalization, where applicable marketing and -- where required -- content/history analysis are stored in the app (and for account usage pseudonymized server-side) for 12 months; withdrawal/opt-out at any time under Profile > Consent.

---

4. Recipients & Processing on Behalf

We transmit data only where necessary and enter into Art. 28 GDPR agreements with processors. Key categories:

• Hosting/Cloud: AWS (primarily region EU-Central-1/Frankfurt) -- compute, database, storage, CDN.
• Audio Generation: e.g., ElevenLabs (TTS).
• AI/LLM content generation: e.g., OpenAI (chat/dialog responses, trip planning, processing of forwarded emails), Google Gemini (real-time voice dialog and real-time visual question-answering on camera frames), Perplexity (current-events / web-search lookups), TypeSafe (Jev) (short reaction decisions in the chat), OpenRouter (routing of AI requests: reaction decisions, audio guide text rewrite).
• Maps/POI: Google Maps/Places (possibly independent controller), MapTiler (map tiles).
• Travel offers & bookings: Nuitée Travel Ltd. / LiteAPI (hotel booking & payment processing — independent controller/merchant of record).
• Analytics/Crash Reports: Firebase Analytics/Crashlytics, Sentry.
• Bot protection: Cloudflare (Turnstile).
• Internal team communication: Slack (notice of new business enquiries).
• Support/Email: e.g., Microsoft 365 or Google Workspace (email transport/helpdesk).
• App Stores/Billing: Apple App Store, Google Play (independent controllers).

An up-to-date list of the service providers/categories we use is provided in Section 17 – Services Matrix.

---

5. Third-Country Transfers (EU/EEA > Third Countries)

Where service providers process data outside the EU/EEA (e.g., USA), we take measures pursuant to Art. 44 et seq. GDPR:

• primarily use of the EU adequacy decision (e.g., EU-US Data Privacy Framework, if the recipient is certified), and
• otherwise Standard Contractual Clauses (SCC) together with additional safeguards.

Details on specific recipients are available upon request at contact​[at]​travee.eu.

---

6. Disclosure in the Event of Corporate Changes

In the event of corporate restructuring (e.g., merger, acquisition, sale of business units), personal data may pass to the acquiring party. In such cases, we ensure that the data is further processed only for the previous purposes and under appropriate protection, and we inform about material changes.

---

7. External Offers (Links to Third-Party Providers)

Our platform contains links to third-party offers (e.g., booking/payment or maps providers). These providers are solely responsible for processing personal data; their own privacy notices apply.

---

8. Do Not Track (website only)

Some browsers send Do Not Track (DNT) signals. We currently do not respond uniformly to DNT because no binding standards exist. You can adjust tracking preferences at any time via our consent center.

---

9. Aggregated/Anonymized Analyses

We may publish or share with partners aggregated or anonymized statistics about usage of our content (e.g., spots accessed, completion rates, topic popularity). No conclusions about individuals can be drawn.

---

10. Retention Periods

We store personal data only as long as necessary for purposes or legal obligations:

• Account/profile data: until account deletion; backups: 90 days.
• Signup-source data (acquisition attribution): stored with the account; deleted together with the account.
• Contract/transaction/invoice data: 6 or 10 years (HGB/AO).
• Support tickets: 12 months after completion.
• Business enquiries (website form): 12 months after receipt; keyed hash of the IP address for abuse protection at most 2 hours.
• Server logs: 7 days (security/error diagnostics).
• Website reach measurement (raw events): 14 months at the latest; aggregated statistics without personal reference.
• Analytics/crash data: 14 months (pseudonymized where possible).
• Chat/voice histories (transcripts): 12 months (shorter if you delete).
• Raw audio (if stored): short-term until transcription/troubleshooting, then deletion.
• Forwarded emails (Travee Inbox): raw email file deleted shortly after processing (at the latest within about a week); email content, including the copy of the email and its summary, until 90 days after the end of the associated trip, otherwise 12 months after receipt, also inside a chat that is kept longer, or earlier if you delete it; receipt files of expenses at most 90 days, independently of the email; minimal processing records (time, status, what Travee added) until account deletion; pseudonymized sender address (keyed hash) and log of rejected emails 30 days.
• Consent logs: 3 years (burden of proof).

---

11. Mandatory Information / Necessity

Certain information/permissions are required for core functions (e.g., email/password; where applicable location). Without these, the service cannot be provided or only with restrictions.

---

12. Your Rights

You have the rights to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and objection (Art. 21 GDPR).

• You may object at any time to processing based on legitimate interests (in particular history/content analysis for improvement/security); you can object to direct marketing without giving reasons.
• You can withdraw consent at any time with effect for the future.

To exercise your rights, an email to contact​[at]​travee.eu is sufficient.

Supervisory Authority: Berlin Commissioner for Data Protection and Freedom of Information Alt-Moabit 59--61, 10555 Berlin, Germany -- mailbox@datenschutz-berlin.de

---

13. Security

We implement technical and organizational measures pursuant to Art. 32 GDPR: TLS/at-rest encryption, role-based access (least privilege), logging, physical/logical access controls, regular backups, security scans, and patch processes.

---

14. Minimum Age

Our offering is not directed at persons under 16 years. Registrations of minors may require parental consent (Art. 8 GDPR). We do not conduct targeted marketing towards minors and do not create marketing profiles.

---

15. Data Export & Account Deletion (App)

You can delete your account in the app under Profile > Your Travee Account > Delete Account. Remaining backups are automatically overwritten after 90 days. If you are unable to access the app, you can also request account deletion via email. For detailed instructions, visit our Account & Data Deletion page.

To request a data export (Art. 20 GDPR), please contact us at contact​[at]​travee.eu.

---

16. Changes to this Policy

We update this privacy policy when functions, legal situation, or technical standards change. The current version is published at https://travee.eu/en/privacy-policy-travee-app.

---

17. Services Matrix