Traulo Privacy Policy

This Privacy Policy explains how we collect, use, share and protect your personal data when you use the Traulo mobile application and the website at www.traulo.com (together, the "Service").

We follow the European General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the Slovenian Personal Data Protection Act (ZVOP-2), the Slovenian Electronic Communications Act (ZEKom-2) and the Slovenian Consumer Protection Act (ZVPot-1).

---

1. Who we are

The data controller responsible for your personal data is:

Računalniške storitve REK, Mihael Rek s.p. Ulica heroja Jevtiča 5, 2000 Maribor, Slovenia Matična številka: 7412037000 Davčna številka: 89184882 Privacy contact: [email protected] Postal contact: the address above

We act as the controller under GDPR Article 4(7) for personal data processed through the Service. We have not appointed a Data Protection Officer; under GDPR Article 37 a DPO is not required for our scale and processing activities. You can reach our privacy contact directly at the email or postal address above.

---

2. What we collect

We collect only the personal data we need to deliver the Service, comply with our legal obligations, and protect the Service against abuse. We never sell your personal data and we never share it for third-party advertising.

2.1 Identity and account data

When you create an account or sign in, we collect:

• Your email address
• A user-chosen handle (username) and optional display name
• An identifier from your chosen sign-in provider — the opaque Apple user identifier (Sign in with Apple), or your Google account ID and the email/name claims you choose to share (Google Sign-In)
• Passkey credentials (WebAuthn public key, credential ID) for two-factor authentication, if you enroll one
• An optional avatar image that you upload
• An optional phone number in E.164 format, if you add it in your profile — stored alongside a one-way SHA-256 hash to allow contact matching (see §2.7). Clearing the field in Settings removes both. We never use your phone number for marketing or SMS notifications.

Profile visibility. Profiles of accounts created on or after the effective date of this policy are public by default (keeping a profile private needs a paid subscription); profiles of accounts created before that date are private by default. If you choose to make your profile Public in Settings → Account → Profile visibility, your handle, display name and avatar become visible to all Traulo users and to any unauthenticated visitor of www.traulo.com/@<handle>. Your vlog count, follower count and following count are also shown on that public profile page. You can revert to private at any time; doing so immediately hides your profile page from non-followers.

Public profiles, public vlogs and published trip guides are also discoverable through in-app search and through the discovery and search features on www.traulo.com — including by visitors who are not signed in — and may be indexed by external search engines. Only content you have made public is exposed this way; private profiles, private vlogs and unpublished plans are not.

2.2 Device data

When the app connects to our backend, we collect:

• A device identifier generated locally on first launch

• The Apple Push Notification Service token that allows us to deliver push notifications you have asked for — for example when someone follows you or comments, when you are invited to a plan or someone joins it, when a plan you share changes, when an idea, cost or settlement is added to it, when a stay is booked for it, when a member reminds you of a to-do, and when the forecast for a day of your trip changes markedly (rain on a day with outdoor stops, or a large change in temperature). These notifications can include the plan's title, a member's name, a place, the trip day and its date, an amount and, for a booking, its reservation reference. Reminders about your own trip (when to leave, check-in, a free-cancellation deadline ending tomorrow, the last lift down on a ski day) are scheduled on your device and are not sent through our servers.

• Your device's platform (iOS), app version, build number and locale (e.g., sl_SI)

• The IP address of API requests and a short User-Agent string (kept in session records to detect token theft and to revoke compromised sessions)

2.3 Content and media data

Traulo generates short vertical vlogs from media you choose. To do this we process, on your device:

• Photos and videos you select from your camera roll
• The technical metadata of those assets — creation timestamp, duration, resolution, frame rate, video codec, perceptual hashes (for deduplication), aesthetic scores (computed locally with Apple's Vision framework), and any EXIF location the camera embedded
• GPS waypoints (latitude, longitude, altitude, speed) sampled from location-tagged assets and used to compose the vlog's route
• Reverse-geocoded city and country names derived from those coordinates

When you save a vlog to the cloud (every account can save publicly shared vlogs within the free 1 GB allowance; paid plans can also save private vlogs, with more room), the following data is uploaded to our backend:

• The rendered vlog video file (MP4) and thumbnail image
• A composition snapshot in JSON form — the title, mood, music selection, captions, asset references, GPS waypoints, peak altitude and reverse-geocoded city/country
• The size of the file and our internal storage key

If you do not save a vlog to the cloud, none of this is uploaded — it stays on your device.

Trip plans and guides. Traulo can turn a trip into a structured trip plan or guide — a day-by-day itinerary with places and stops (their names and coordinates), a route, written notes and tips, and photos you attach to individual stops. A guide may also include GPS route tracks you import (for example from a .gpx file — a sequence of latitude/longitude/elevation points and the timestamps recorded with them) together with the type of activity (such as a hike or a bike ride). We store this so we can show and let you edit your plan. When you publish a guide it becomes public content that others can view and save (see §2.1 here and §8.8 of the Terms); a plan you keep private stays in your account and is not shown to other users, except the members you invite (§2.13).

Private trip plans. A private plan can also hold your trip dates and nights, the number of travellers, your home (the place you set in Settings, or one the app works out on your device from where your photos of the last months were taken — you can change or clear it), notes and checklists, costs and how they are split, ideas and votes, bookings, and photos you add. If you start a plan from a published guide, the plan records which guide it came from. When you delete a plan you can restore it for 30 days; after that it is erased.

Walks and trails. To show walks, trails and huts near your plan, our servers look up map data for the area from OpenStreetMap through the Overpass service, and your device fetches terrain-height tiles and, for some views, trail data directly (see §5). These requests contain an area of the map — not your name or account — but a request made from your device carries your device's IP address, as any web request does.

Ski areas. For a ski day our servers look up the ski area's runs, lifts and huts from OpenStreetMap through the same Overpass services, by the area's location only. Every member of a plan — including a member who can only view it — can mark their own part of a ski area (the lifts and runs they mean to ski). Your own part is stored on our servers against the plan and your account, is shown only to you, is never part of a published guide, and is deleted when you clear it, when you leave or are removed from the plan, when the plan is erased, or when your account is deleted. A member with the edit role can also set a part for everyone, which is part of the plan like any other edit.

Stations near your route. To suggest a train or bus station for a leg of your trip, the app sends our servers the location of that leg's start or end. Our servers ask an OpenStreetMap Overpass service for stations around the centre of a map cell of about 5 km that contains it — never your exact point and never your identity — and keep the answer for 30 days for that area, shared by everyone who asks there; the distance to you is worked out afterwards and not stored.

Weather. For each day of a plan, the app sends our servers the day's place (its coordinates, date and time zone). For the next ten days our servers ask Apple WeatherKit for the forecast at that place — rounded to about 1 km, with the country so that official weather alerts can be included — and receive daily and hourly values such as temperature, feels-like temperature, chance and amount of rain, wind and gusts, and the sky. A forecast is kept for at most 3 hours for an area of about 10 km and shared by everyone asking there; we keep no history of forecasts, except that, to tell members when a trip day's forecast changes (§2.2), we note per trip day what the last forecast said (rain or not, the day's high) for up to 20 days. For days further ahead we show typical weather for the season, computed once per area of about 50 km from NASA's public climate data. None of these requests contain your name or account.

The live trip view. If you allow location access while using the app, the live trip view reads your phone's position to show where you are on today's route and what comes next. Your position stays on your device: it is not sent to our servers, not stored by us and not shown to other members. We never ask for "Always" location access and do not use your location in the background.

2.4 Usage and behaviour data

To improve the auto-selection algorithm and protect against abuse we record, server-side:

• Feed and viewing activity — for each public vlog or guide shown to you in a feed we record, against your account, how many times it was shown to you, how long you watched it, whether you watched it to the end, and whether you opened it. We use this in two ways: to shape what your own feed shows you next (so you are not shown the same post over and over, and so posts closer to what you actually watch rank higher), and — in aggregate across all viewers, not as your individual record — to score how well a post holds attention, which feeds the Explore rankings and the weekly Editor's-choice selection described in §2.8 and §4. We store one row per viewer per post, not one per event, and delete it after 90 days.
• Auto-select telemetry events — anonymised at the algorithmic level (per-asset decisions, asset actions, composition completions and abandonments). Stored in monthly partitions and deleted after 30 days; aggregated rollups are retained for up to 2 years.
• Abuse signals — rate-limit breaches, schema rejections, deduplication storms, oversize batches. Used to detect and block automated abuse.
• AI quota ledger — a per-month count of AI editorial requests you have made, with a request identifier (no content).
• AI call log — for each AI editorial request: model used, token counts, cost, latency, error code (if any). The request body itself is not retained.
• Saved AI results — when an AI request you paid a credit for (a vlog edit suggestion or a plan improvement) produces a usable answer, we keep that answer for 24 hours, stored under your account and the request's identifier. If the answer does not reach you (lost signal, app closed), the app asks again with the same identifier and receives the saved answer — no second AI call and no second charge. A drafted trip plan is saved as a plan in your account straight away, and its answer is kept for 1 hour for the same purpose. Only you can retrieve your own saved answers. If the AI produced nothing usable, the credit is returned instead.

If you turn on telemetry opt-out in Settings, we no longer record auto-select telemetry for you. Feed and viewing activity is not covered by that switch — it is what makes a ranked feed work at all — but it is never shown to other users, never used for advertising or for tracking you across other apps and websites, and is deleted on the 90-day cycle above. Abuse signals and AI call logs are kept under our legitimate interest in operating the Service safely.

2.5 Diagnostics

We use Firebase Crashlytics and Apple's MetricKit to collect crash logs and performance diagnostics. These include:

• Crash stack traces and the application state at the moment of the crash
• Performance metrics (launch time, hangs, energy, disk space)
• Your user identifier (so we can correlate crashes with the affected account and reach you if there is an account-level problem)

2.6 Billing data

We use RevenueCat to manage subscriptions and one-time purchases, both in the app (where Apple takes the payment) and on www.traulo.com (where Stripe takes the payment for us, through RevenueCat's web checkout). We receive, depending on the product:

• Your subscription status (active / trial / grace / expired / canceled / refunded), the plan you are on, the billing period, the anniversary day and the store you bought it in (the App Store or the website) — for auto-renewing subscriptions (Traveler / Daily Vlogger)
• A record of one-time purchases — product ID, purchase date and the AI credits added to your account — for AI credit packs (10 / 20 / 100 credits)
• A non-financial purchase or subscription identifier issued by RevenueCat, Apple or Stripe
• For purchases on the website: the email address the receipt is sent to, the billing country and postal code Stripe needs to calculate VAT, and the record of the request you make before paying (Terms §8.5) — which wording you agreed to (a version code), when, and in which language

Apple is the merchant of record for App Store purchases; for purchases on the website we are the seller and Stripe processes the payment. We never see your payment card or bank account details — on the website you type them into Stripe's own payment form.

If you end up subscribed twice, our servers ask RevenueCat which of your subscriptions can be refunded and refund the web one (Terms §8.1); a record of what was done is kept with your billing records.

2.7 Contacts (optional)

When you tap "Find friends from your contacts" in the Search tab, Traulo asks iOS for permission to read your address book. If you grant it:

• We compute a one-way SHA-256 hash of each contact's email address and phone number on your device.
• We send only the hashes to our servers. We discard them after the lookup completes.
• We never store your contacts, their names, their phone numbers, or their email addresses on our servers.
• If a contact's own Traulo account email or phone matches one of those hashes, we show them to you so you can follow them.

You can revoke contacts access at any time in iOS Settings → Privacy & Security → Contacts → Traulo. If you deny or revoke access, the feature is simply unavailable — no other functionality is affected.

2.8 Social graph and interactions

When you use the social features of the Service, we collect and store the following data:

• Follow relationships. When you follow another user, or when another user follows you, we record the follow relationship, the user identifiers involved, and the timestamp. Your follower count and following count are displayed on your public profile if it is public. The identities of your individual followers and followees are not currently shown to other users — only aggregate counts are.
• Hearts (likes). When you heart a vlog, we record the interaction linked to your account, the vlog identifier, and a timestamp. The vlog's total heart count is visible to the creator and, on public vlogs, to all viewers. We do not currently display which specific accounts hearted a vlog to third parties.
• Block relationships. When you block a user, we record the block so that it can be enforced consistently across the Service. Block relationships are not visible to the blocked user or to third parties.
• Comments. When you post a comment on a vlog, we store the comment text, your account identifier, the identifier of the vlog, and a timestamp. A comment on a public vlog is visible to anyone who can see that vlog. You can delete your own comments, and the creator of a vlog can delete comments on their vlog or turn comments off; deleting a comment removes it from the Service (subject to backup rotation). We may notify a creator that you commented on their vlog.
• Companion tags and trip groups. When you tag another user as a companion on a trip — or another user tags you — we record the tag and the identifiers of the participants, the trip and trip-group identifier, each participant's own point-of-view (POV) vlog reference, and timestamps, so the participants' POV vlogs of the same trip can be presented together. This means another user can associate your account with a trip by tagging you, and you can do the same to them. Each participant controls their own POV vlog and its visibility, may decline or remove a tag, and may leave the trip group; doing so removes their participation and POV vlog from the shared trip. Companion stat cards generated from this data (for example, "You & @handle") may include the other participant's handle, display name, avatar and aggregate trip statistics.
• Saved guides (bookmarks). When you save another user's published trip guide, we record that you saved it, the guide identifier and a timestamp, so you can find it again and so the creator can see an aggregate count of how many people saved their guide. We do not show creators the identities of individual savers.
• Guide lineage (remixes) and place credits. When you create a trip guide inspired by another published guide, we record the link between the two guides ("inspired by") and may display that attribution publicly, so the original creator is credited. The same link is recorded when you take a single place from the community index into a plan of your own — including a private plan — and it points at the guide that published that place first. The link is an identifier for a guide, not for the person who copied it: the credited creator is not told who added their place, and a private plan stays private.
• Public rankings ("Top travellers"). Explore shows a public ranking of travellers, ordered on aggregate statistics derived from your own public vlogs — the number of distinct countries and distinct places you have posted from, and how many of your vlogs qualify. Only accounts whose profile is public are eligible; if your profile is private you are never listed, and switching it back to private removes you. If you would rather not appear while keeping a public profile, write to [email protected] and we will exclude your account from the ranking.
• Editor's choice. Once a week the Service selects a small set of already-published public guides to feature in Explore, on the globe and in the feed. Selection is automated and is described in §4. If a guide of yours is selected we display it — with your handle, display name and avatar — to other users, notify you, and generate a short one-line blurb for it.

Social graph data is used solely to operate the social features of the Service and to protect users from harassment. We do not sell, license or share it with third parties for advertising, profiling or any purpose other than operating the Service.

2.9 What we do NOT collect

To be specific: we do not collect health or fitness data, browsing history outside our app, search history, sensitive personal data within the meaning of GDPR Article 9, or financial information beyond purchase history (which, if you book a stay through the app, includes that booking — see §2.12; we never see your card number) and the trip costs you and your plan's members choose to record in a plan (§2.13). We do not access your contacts without your explicit permission (see §2.7 for how contact matching works when you opt in). We do not use your data for tracking across apps or websites (see §2.10 for how third-party booking links work when you choose to tap one, and §2.11 for the website analytics you can accept or decline — which measures our own site only, with advertising features switched off).

2.10 Booking suggestions and affiliate links

Inside trip guides we may show booking suggestions — such as stays, flights, activities, airport transfers or eSIM data plans — from third-party travel partners. To produce them we send a partner, or our affiliate-link provider, only the non-personal inputs needed for the lookup: a guide's destination place names and coordinates and, for flights, the major airports nearest your home region. We do not send your name, email, account identifier or device identifier to these partners.

When a suggestion is an affiliate link and you tap it, you are redirected out of Traulo to the partner's own website or app. From that point the partner is the controller of any data you give it, and its own privacy policy and cookies apply. So that the click can be attributed for our commission, our affiliate provider receives an attribution code that identifies the guide and its creator — not you. We also keep an internal, append-only log of these clicks (the guide, the creator and the partner's domain, with a timestamp) to calculate earnings; that log contains nothing that identifies the person who clicked.

We do not sell your personal data and we do not share your identity with these partners for advertising. Tapping a booking suggestion is always optional. The processors and partners involved are listed in §5.

---

2.11 The website: cookies and analytics

This section applies to www.traulo.com — the website where you can browse Traulo, sign in, and view your own vlogs, guides and travel map. The iOS app does not use cookies; everything below is about the site.

Cookies we set to make the site work. These are set because the site cannot do what you asked without them. Under the ePrivacy rules they are strictly necessary or the direct result of a choice you made, so they do not require your consent.

We also keep a few small values in your browser's own storage. These are not cookies and are never sent to our servers with your requests: traulo.device, a random identifier for this browser so that a passkey registered here is recognised at your next sign-in; av_home / av_region, the departure point and region you last chose when viewing travel suggestions in a guide; traulo.home.v1, the home location you set in the website's Settings — a grid cell of about 5 km and its town name — so new trips can leave from it; and, if you book a stay on the website, the booking holder's details you typed (traulo.holder…), so a page reload does not lose them. Clearing your browser's site data removes all of them.

Paying on the website. When you open a payment form on the website (a subscription, an AI credit pack or a hotel booking), Stripe sets its own cookies (__stripe_mid, __stripe_sid) to detect fraud. They are strictly necessary for paying safely, are not used for analytics, and are covered by Stripe's privacy policy.

To suggest a departure point when you first view travel suggestions, the website may ask an IP-location service (ipapi.co or ipwho.is) for the approximate region of your IP address; this request is made by your browser. Satellite map imagery on the website is loaded from Esri, and map requests carry your IP address and the area viewed.

Analytics, only if you say yes. We use Google Analytics to understand how the website is used — which pages people open, on what kind of device, and roughly where in the world they are.

Nothing analytics-related loads until you accept it. When you first visit, we ask. Until you answer, and permanently if you answer No, no analytics script is loaded, no analytics cookie is set, and no data reaches Google. Declining costs you nothing: signing in, your language, your map style and every feature of the site work exactly the same either way.

If you accept, Google Analytics sets its own cookies to recognise a returning browser and count visits. We configure it with advertising features switched off — no ad personalisation, no ad targeting, no advertising identifiers — and with IP anonymisation on. We do not use it to follow you onto other websites, and we do not combine it with your Traulo account.

Changing your mind. Choose Cookies in the footer of the website's start page, or in the website's Settings under About, and the question opens again. Answer Decline and Google Analytics stops at once in that page and its cookies are removed. You may also use Google's own opt-out browser add-on. Withdrawing consent is as easy as giving it.

Legal basis: your consent (GDPR Article 6(1)(a); ZEKom-2 Article 157). This is the only place in Traulo where consent is the legal basis, which is why it is the only place we ask.

Sign-in providers. If you choose Continue with Google or Continue with Apple, that provider's script loads at the moment you open the sign-in panel — not before, and not at all if you never try to sign in. From that point the provider's own privacy policy also applies to the sign-in exchange. We receive only what §2.1 describes.

---

2.12 Booking a stay through Traulo

Inside your own trip plan you can book a hotel room without leaving the app. This is different from the affiliate links in §2.10: the booking is made through our booking partner Nuitée Ltd (LiteAPI), an Irish company, and Traulo keeps a record of it so the stay shows in your plan. Booking in the app may not be available in every version of the app; where it is not, a stay opens on the partner's own site as described in §2.10. Here is exactly what happens with your data.

Who is responsible for what. We are the controller for what Traulo does: presenting the offer, collecting the booking details and passing them on, and keeping the booking in your plan. Nuitée takes your payment as the merchant and places the booking, and the hotel hosts you; each of them processes your details for its own part — including its own legal obligations, such as payment, fraud-prevention, tax and guest-registration rules — as an independent controller under its own privacy policy.

What you give us to make the booking. The booking holder's first name, last name and email address, an optional phone number, the names (and, if you add them, emails) of the other guests, and the ages of any children travelling. They pass through our servers to Nuitée, which passes them to the hotel so that the room is held in your name. We do not store the holder's or guests' names or contact details on our servers. The app keeps the holder's details on your device so the next booking is faster, and you can clear them there at any time; on the website they are kept in your browser's storage (§2.11). Reservation records on our side carry no guest names — only a pseudonymous guest reference issued by Nuitée.

Nationality. Hotels and Nuitée can set prices and local taxes by the guest's nationality, so the booking form asks for the lead guest's nationality. It starts from your device's or browser's region, and you can change it. If you are from the EU or EEA, you get one price, the same for every EU and EEA guest: we look prices up with one fixed EU nationality, and your own nationality is not sent to Nuitée. If you are from outside the EU and EEA, your nationality is sent to Nuitée for the price lookup and for holding the room. In both cases it is used only to price the room — it is not passed on when the booking is made, and the hotel does not receive it from us. We keep your nationality with the checkout record (§7); a held room is reused for any nationality that gets the same price. It is a country code, not linked to a passport or ID.

The stay itself. We store the hotel, the dates, the number of guests, the room and board type, the price and currency, any taxes or fees due at the property, the cancellation terms you were shown and their schedule (each cancellation fee and from when it applies), Nuitée's booking reference and the hotel's confirmation number, the trip plan the booking belongs to and — when you booked from a published guide — that guide and its creator. This is what lets your plan show the booking, lets you cancel it in the app, and lets us credit the guide's creator (§2.16; §8.10 of the Terms). The creator never sees who booked. If the plan is shared (§2.13), its other members see the booking in the plan — the hotel, the dates and the price — and who made it, but not the holder's or guests' contact details.

Payment. The card is entered on a secure page at www.traulo.com that embeds Nuitée's PCI-compliant payment form; the card details travel from your browser to Nuitée's payment provider (Stripe) and never reach our servers. We receive only whether the payment succeeded and the amount — and, if the card was declined, the short message the payment form showed you, so the app can tell you what happened. Neither we nor the hotel see your card number.

Booking tags. So that the booking can be matched to your plan and to the guide it came from, we attach to it pseudonymous identifiers — your account identifier, the plan and its owner's account identifier, and, when the stay came from a published guide, that guide and its creator's account identifier — as booking tags at Nuitée. These identify records in our system; they contain no name or email.

Reconciliation. Once a day we ask Nuitée for the status of bookings made through Traulo (confirmed, cancelled, refunded) so that your plan and the creator's earnings stay correct. Nuitée also notifies us of changes as they happen; we remove guest names and contact details from those notifications before we store them, and delete the stored notifications after 90 days (what the booking needs from them is already on the booking record).

Help with a booking. If you write to us about a booking, we use your message, the booking record and what you tell us to sort it out with Nuitée and, through it, with the hotel; we share with them only what the problem needs. We keep the correspondence as long as the booking record (§7).

Cancelling. You can cancel a booking from the plan at any time; the refund is decided by the cancellation terms you were shown before paying and is made by the payment provider. Before you confirm, the app shows what you would get back under those terms: the full price within a free-cancellation window, otherwise the price less the cancellation fee that applies. We never cancel a booking for you. A free-cancellation deadline reminder is an on-device notification that you can switch off.

The legal basis is the contract you enter when you book (Art. 6(1)(b)); keeping the booking and payment records afterwards is a legal obligation under Slovenian accounting and tax rules (Art. 6(1)(c)); see §3 and §7.

---

2.13 Planning together

You can invite people to a private plan you own (Terms §4.9).

Invitations. You can add a person directly or share an invite link. The link contains a random code; anyone who opens it before it expires (30 days) or is revoked sees the plan's title, dates and length, the role on offer, and your handle and display name, and can join. We record each member, their role (view, suggest or edit), who invited them and when they joined, left or were removed.

What members see of each other. Members see each other's handle, display name, avatar and profile colour — never each other's email address — and everything added to the plan: notes (with their author), ideas and votes, photos (with who added them), costs, how they are split and who has settled, any payment link a member chooses to add (for example a revolut.me link), who booked a ticket or transfer for the trip ("booked by Miha"), and bookings made for the plan without the guests' contact details (§2.12).

Shared cars. A member who drives can offer seats for getting there or getting home. Members then see the driver, where the car starts and ends, the day and time it leaves and the free seats; a rider's seat shows who rides and where they are picked up — a town on the way or an exact meeting point such as a car park, with its address line — and the time. Choose a meeting point you are comfortable sharing with the plan's members. You can withdraw a car or give up a seat at any time; your cars and seats are removed when you leave the plan or are removed from it, and deleted with the plan.

Your own ski part (§2.3) is not shared: other members do not see it.

Activity and undo. Every change to a shared plan is recorded — who made it, when, and what changed — so members can see recent activity and undo a change. This history is deleted after 90 days.

Notifications. Members are notified of invitations, new members, changes, new ideas and costs, settlements and bookings (§2.2).

Photos you share on a trip. Photos you add to a stop of a shared trip are seen by every member of the trip. If the plan's owner publishes a guide made from the trip, the photos members shared appear in that guide and become public (§2.1): anyone who can read the guide sees them, credited to the guide. From publishing, the guide's author carries their storage. The first time you share a photo on a trip, the app tells you: "Everyone on this trip will see these photos, and so will the guide's readers if the trip's owner publishes a guide." While you're on the trip you can remove your own photos at any time, whatever your role; removing one also removes it from a published guide. After you leave, a photo already in a published guide stays there — ask the guide's author or write to [email protected] and we'll remove it.

When you leave or are removed, you lose access to the plan and are no longer notified. What you added stays in the plan for its other members and is shown as coming from a former member, except your photos that are not in a published guide, which leave the trip with you.

The legal basis is the contract (Art. 6(1)(b)): showing a shared plan to the people you invited is the service you asked for.

2.14 AI trip planning

When you ask Traulo to draft a trip plan or to improve one, our server sends Anthropic (Claude) what the request needs, and nothing that identifies you:

• For a draft: the destinations, dates, number of nights, pace and trip types you choose, and the free text you type (up to 800 characters); your home — its name and location — so the plan can start and end there. We also send places from the community index (§2.15) and titles of published guides as candidates.

• Your trip history, unless you switch it off. So the plan suits you and does not send you back where you have already been, every draft also carries a short summary of your own trips: the countries and up to 40 towns of your newest vlogs (including private ones), the destinations of up to 15 of your own plans (past and upcoming, including private ones) and of up to 15 of your published guides, how many of your vlogs, plans and guides are of each trip type, and the titles of up to 10 published guides you saved or copied. Only names and counts are sent — never dates, photos, captions, coordinates or anything from other people's accounts — and the drafted plan never mentions this history. You can turn it off at any time in Settings → Use my trips to personalise plans, in the app or on the website (the setting belongs to your account); when it is off, nothing from your history is sent.

• To improve a plan: its title, summary and notes, its days and nights, and for each stop its name, category, time, description and links, plus the name of your home. For a private plan no photos are sent; when you improve a guide you are preparing to publish, small previews of the photos you attached to its stops may be sent so the suggestions can describe them.

• Never sent: your name, email, account identifier, the members of the plan, or anything from other members' accounts.

Do not type health, religious, political or other sensitive details — or other people's personal details — into a request; the text goes to Anthropic as written. Anthropic processes requests as our processor under its commercial terms, does not use them to train its models, and keeps them only for a limited period for safety and abuse monitoring. Place names that come back are matched to map positions by a geocoding service that receives only the place names (§5).

Each request uses AI credits from your plan's monthly allowance and is logged as described in §2.4 (the model, token counts and cost — not the request text); a usable answer is kept for a short time so a lost answer can be opened again without a second charge (§2.4, "Saved AI results"). The legal basis is the contract (Art. 6(1)(b)) for the request itself, and our legitimate interest in better-suited plans (Art. 6(1)(f)) for the trip-history summary, which you can switch off. A drafted plan is a suggestion you review and edit; see §4.

How we check the planner's work. To find and fix mistakes in the plans our AI drafts or changes — a hike that does not reach its summit, a night in the wrong place, a time that cannot work — authorised Traulo staff look at statistics and computed checks across plans: how many plans were made and how, how each hike was judged (for example "ready" or "route to confirm"), what the AI calls cost, and which kinds of edits people made afterwards. These views show plan titles and numbers only, never the text you typed, your stops, notes or nights. Opening the full content of a specific private plan is staff access to private content and follows the strict rules in §5: only for one of the reasons listed there, and every opening is recorded.

2.15 Community places

When you plan a trip, Traulo can show that a place is popular with travellers — for example "12 travellers went here" — and list the published guides that stop there. Once a night we count, for each place, the published guides and the public, available vlogs that include it. Private plans, private vlogs and unpublished guides are never counted. Tapping a place can show the published guides behind the count with their authors' handle, display name and avatar — only for authors whose profile is public and who have not blocked you. The counts contain nothing about who viewed or planned a place.

The legal basis is our legitimate interest in helping travellers find good places from content its authors chose to publish (Art. 6(1)(f)). If you do not want a guide or vlog to count, unpublish it or make it private.

2.16 Credit for guide creators

Traulo intends to reward travellers whose published guides bring others to Traulo or lead to a booking. To do that fairly later, we already keep a record now; nothing is paid out yet.

The guide you arrived through. When you create an account from a link to someone's published guide — or, failing that, when the first guide by someone else that you copy into a plan of your own is copied within 30 days of creating your account — we record on your account that guide, its author and the date. It is recorded once and never changed. If you open a guide link in the app before signing in, the app keeps only that guide's identifier on your phone, for up to 30 days, and sends it once when you create your account. The author is not told who arrived through their guide.

What is credited to the author. When an account that arrived through a guide later buys a subscription or an AI credit pack, and when a stay booked in the app (§2.12) or a partner booking reported to us with a guide's attribution code (§2.10) earns us money, we write one record: what kind of revenue it was, our revenue from it and the currency, the guide's author, the guide or plan, the account whose purchase or booking it was, the date, and whether it was later refunded or cancelled (a refund or cancellation reverses the record). A subscription or credit pack counts only if it is bought within a limited period after the arrival (12 months unless the programme's terms set another period). Test purchases and test bookings are marked and never count.

Who sees it. Only authorised Traulo staff, for accounting and to run the programme. The author does not see who bought or booked; if and when payouts start, an author will see the totals credited to them, never the people behind them. We store our own revenue, not a share — what an author is paid will be set by the programme's terms, from a start date announced in advance, and only events from that date count.

How long. The arrival stays on your account for as long as the account exists. The revenue records are financial records and are kept for the accounting period in §7; after your account is erased they keep only pseudonymous identifiers.

The legal basis is our legitimate interest in rewarding the creators whose guides bring travellers and bookings to Traulo, and in paying them correctly (Art. 6(1)(f)); keeping the revenue records afterwards is also a legal obligation under accounting and tax rules (Art. 6(1)(c)). You can object (§8); the record contains no content of yours and is never used to decide anything about you.

---

3. Why we process your data and on what legal basis

Where we rely on legitimate interests, we have weighed them against your fundamental rights and freedoms. You can object to that processing at any time (see Section 8).

---

4. Automated decision-making

Traulo uses artificial intelligence (Anthropic's Claude model, via our backend) to suggest an editorial composition for your vlog — which clips to feature, in what order, and with what tone. These suggestions are not solely automated decisions within the meaning of GDPR Article 22(1): you can always preview, edit, override or discard them before exporting your vlog. They produce no legal or similarly significant effect on you. We do not profile you for credit, employment or other consequential purposes.

We also use the same AI to draft and enrich trip-guide text — titles, descriptions and tips — and to draft and improve trip plans (§2.14). A drafted or improved plan is likewise a non-binding suggestion you can edit, accept or discard; it decides nothing about you and produces no legal or similarly significant effect.

We also rank content automatically. Your feed is ordered by an algorithm using the feed and viewing activity in §2.4, who you follow, where you have travelled, and how each post performs with viewers generally. Explore rankings and the weekly Editor's-choice selection run on aggregate signals across all viewers: a deterministic score built from how completely a post is watched, how often it is re-watched, its hearts, saves and comments over the previous seven days, whether it carries a title and description, its length, and whether a trip guide is attached — with per-creator, per-country and per-region diversity limits applied afterwards. Once a set is chosen we ask Claude to write a one-line blurb for each featured guide, from that guide's title, description and country only. An administrator can override or remove any selection by hand.

None of this is a solely automated decision within the meaning of GDPR Article 22(1). It decides the order in which public content is displayed — not whether you may use the Service, what you are charged, or what you are entitled to — and produces no legal or similarly significant effect on you. Being featured is editorial: it is not a benefit you are entitled to and carries no payment.

In line with EU AI Act Article 50 (transparency obligation for AI systems generating content), this Privacy Policy is the place where we tell you that AI is used to suggest editorial choices for your own vlogs and guides, to draft and improve trip plans, and to write the one-line blurb shown with an Editor's-choice pick.

---

5. Who we share your data with

We share personal data with the processors listed below, who act on our instructions under data-processing terms that meet GDPR Article 28, and — where the table says so — with independent recipients that decide for themselves how they handle what they receive. We never sell your data.

Staff access to private content. Your cloud-saved vlogs are encrypted at rest, and neither your vlogs nor your private trip plans are browsed by staff in the ordinary course of business. An authorised administrator may open the content of a specific vlog or private plan only in the following circumstances: (a) investigating a credible report of illegal or harmful content submitted through the in-app reporting flow or by a competent authority; (b) responding to a valid legal order or binding request from a law-enforcement or judicial authority; (c) diagnosing a technical fault or helping you at your express request to [email protected]; or (d) for a private plan only, checking the quality of a plan our AI drafted or changed, to find and fix faults in the planner (§2.14) — the plan is looked at for that purpose only and nothing in it is changed, shared or used for anything else. Before opening, the administrator must record which of these reasons applies; every opening is recorded in an audit log — which staff member, which vlog or plan, the timestamp and the reason. You may request a copy of the audit log relating to your own content at any time by writing to [email protected].

We may also disclose personal data (a) to comply with a legally binding request from a competent authority, (b) to protect our or others' rights, property or safety, (c) in connection with a corporate transaction (merger, acquisition or sale of assets), in which case the recipient will be bound by privacy commitments at least as protective as these.

Booking partners you are redirected to. When you tap a booking suggestion you may be sent to an independent travel provider — for example Booking.com, Agoda, Klook, Tiqets or Airalo. Once you leave Traulo these providers are not our processors: they act as independent controllers under their own privacy policies. We do not pass identifying information about you to them; any data they hold about you results from your own interaction with their website or app.

---

6. International transfers

Some of our processors are based outside the European Economic Area, primarily in the United States. When we send personal data there we rely on the Standard Contractual Clauses approved by the European Commission (Decision 2021/914) under GDPR Chapter V, supplemented by additional safeguards where appropriate. You can ask us for a copy of these clauses by writing to [email protected].

For the United States specifically, we additionally rely on the EU–US Data Privacy Framework where the recipient is certified.

When you book a stay at a hotel outside the European Economic Area, your booking details must go to that hotel for it to host you. That transfer is necessary for the contract you asked for, and we rely on GDPR Article 49(1)(b). The hotel then handles your details under the law where it is.

---

7. How long we keep your data

When you delete your account it is closed at once and your content is no longer shown to anyone in Traulo (§9). Data we are legally required to keep (for example, billing records under Slovenian tax law) is kept only for that period and that purpose.

Private cloud backup is a paid feature. If a paid plan lapses, is cancelled and then expires, or is downgraded, we keep your public vlogs up to the free 1 GB as described in the table above and in Terms §8.7; the rest — public vlogs above that allowance and all private vlogs — are soft-deleted (hidden from your feed but recoverable) and permanently erased 30 days later. Resubscribing within those 30 days restores them. Vlogs saved on your device are never affected, and you can download your cloud vlogs to your device at any time before the 30 days elapse.

---

8. Your rights

Under the GDPR you have the rights to:

• Access the personal data we hold about you (Art. 15) — in-app at Settings → Account → Export my data, or by emailing [email protected]. The in-app export does not yet include your trip plans, plan memberships and bookings; ask us at [email protected] and we will send them to you within the time below
• Rectify inaccurate or incomplete data (Art. 16) — most fields are editable in Settings → Account; for the rest, email us
• Erase your data, the "right to be forgotten" (Art. 17) — in-app at Settings → Account → Delete my account, or by email
• Restrict processing while a dispute is being resolved (Art. 18)
• Receive a portable copy in a structured, machine-readable format (Art. 20) — same export as above
• Object to processing based on legitimate interests, including profiling (Art. 21)
• Withdraw consent at any time, where processing is based on your consent (Art. 7(3)) — without affecting lawfulness of processing before withdrawal
• Not be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects (Art. 22) — see Section 4
• Lodge a complaint with a supervisory authority (Art. 77)

To exercise any right, write to [email protected]. We will respond within one month of receiving your request (extendable by two further months for complex requests, in which case we will tell you why). Most requests are free; we may charge a reasonable fee or refuse to act on manifestly unfounded or excessive requests as permitted by GDPR Article 12(5).

If you believe we have not handled your data correctly, you can complain to the Slovenian supervisory authority:

Informacijski pooblaščenec RS Dunajska cesta 22, 1000 Ljubljana, Slovenia Phone: +386 (0)1 230 9730 Web: https://www.ip-rs.si

You may also contact the supervisory authority of your EU country of residence.

---

9. How to delete your account

You can delete your account at any time:

• In the app: Settings → Account → Delete my account. We will ask you to confirm.
• By email: write to [email protected] from the address on your account.

After confirmation, your account is closed at once: you are signed out everywhere, your sign-in methods are removed, and your name, handle, photo and email are taken off your profile. From that moment your content — your vlogs, photos, comments, likes and follows — is no longer shown to anyone in Traulo, with two exceptions. A deleted account cannot be reopened from the app; write to [email protected] if you need help. A published trip guide you have not deleted stays published (§7; Terms §8.8), with everything it shows: its vlog, photos, cover and map pictures. If you do not want it to remain, delete the guide before you delete your account. Content that is the subject of a report or a moderation decision is kept as evidence for as long as that matter requires. That includes the private plans you own that have no other members. A plan you own that still has other members is not erased: when you delete your account it passes to one of them (a member with the edit role first), so the trip they planned with you is not lost; what you added stays in it, shown as coming from a former member. A plan with a booking that is still live is kept until the booking is over. Your membership of other people's plans ends, what you added there stays shown as coming from a former member, and your own ski parts are deleted. Booking records are kept for the accounting period in §7 with only pseudonymous references; deleting your account does not cancel a booking — cancel it first if you no longer need it. Some data may be retained beyond that window when we are legally required to keep it (for example, billing records under Slovenian tax law) — those records are kept only for the legally required period and only for the legally required purpose.

---

10. Children

Traulo is not directed at users under 15 years of age, which is the digital-consent age in Slovenia under ZVOP-2 (implementing GDPR Art. 8). We do not knowingly collect personal data from anyone under 15. If you believe a child under 15 has provided us with personal data, please contact us at [email protected] and we will delete it.

For users under the age of 18 (the age of majority in Slovenia), parental authorisation may also be required for in-app purchases under the Slovenian Civil Code (OZ).

---

11. Security

We protect your personal data using:

• Encryption in transit — HTTPS / TLS 1.2 or higher for all client–server traffic
• Encryption at rest — Postgres data encryption and Cloudflare R2 object encryption
• Authentication — Sign in with Apple, Google Sign-In, or passkey-based two-factor authentication for high-risk actions
• Access control — admin access requires passkeys, an IP allow-list, and full audit logging
• Operational hardening — least-privilege roles, dependency scanning, and regular review of our security posture

No system is perfectly secure. We continually work to improve our defences and to detect, contain and notify in the event of an incident.

---

12. Data breach notification

If we become aware of a personal data breach within the meaning of GDPR Article 4(12), we will:

• Notify the Slovenian Information Commissioner (Informacijski pooblaščenec RS) within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to your rights and freedoms (GDPR Art. 33).
• Notify affected users without undue delay when the breach is likely to result in a high risk to their rights and freedoms (GDPR Art. 34), describing the nature of the breach, the likely consequences and the measures taken or proposed.

---

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we publish the new version on www.traulo.com/privacy together with the new effective date and an archive of all previous versions.

For material changes — for example, a new processor receiving sensitive data, a new processing purpose, or a change to your rights — we will ask you to review and accept the updated Policy in the app before you can continue using Traulo. For non-material changes (typo fixes, clarifications) we publish the new version without asking for re-acceptance, but you can always read the current text and the change log on the website.

We keep a permanent record of which version of this Policy you accepted and when, so we can demonstrate compliance.

---

14. Contact

For any privacy question or to exercise any of your rights:

• Email: [email protected]
• Post: Računalniške storitve REK, Mihael Rek s.p., Ulica heroja Jevtiča 5, 2000 Maribor, Slovenia

For complaints you cannot resolve with us, please contact the Informacijski pooblaščenec RS as described in Section 8.

---

This Privacy Policy is also available in Slovenian at https://www.traulo.com/privacy?locale=sl. In case of any discrepancy between the English and Slovenian versions, the Slovenian version prevails for users domiciled in Slovenia.