Privacy Policy
This page is provided in English only as the single authoritative version.
1. Who we are
voyageons is operated by Dash Systems, a French micro-enterprise (sole proprietorship) run by Sébastien Aglaé, acting as data controller. This Privacy Policy explains what personal data we process, why, and the rights you have. It is written to be consistent with how the app actually works and with the EU GDPR and French data-protection law.
2. Data we collect
Account data: your email, display name, password (stored only as a salted hash), preferred language, default currency and, if you enable it, two-factor-authentication settings.
Trip content you create: trips, itinerary items and locations, maps, budgets and expenses, checklists, notes, polls, comments and the people you invite. This content is shared with the collaborators you choose.
Technical data: basic logs needed to run and secure the Service (for example timestamps and error logs). We also process IP addresses to operate, secure and rate-limit the Service. An IP address is only recorded against an abuse counter when it triggers a rate-limit rejection or a failed sign-in, so we can detect brute-force and abusive traffic; these abuse records are kept no longer than needed for security and are never used for advertising or profiling. Aggregated, privacy-preserving counts are computed server-side and do not require your consent.
Optional analytics: client-side product analytics run ONLY after you accept them in the cookie banner. There are two separate, independently optional categories: first-party anonymous analytics (a feature name and a random session id, no third-party cookies), and Google Analytics (a third-party service that sets cookies and may transfer data outside the EU). Both are off by default and you can change either choice at any time from the footer.
4. How we use your data
We process your data to provide the Service (create and sync trips, enable collaboration, authenticate you), to send transactional emails (welcome and email verification, password reset, security and account notifications, trip invitations, and the digest if you opt in), to keep the Service secure and prevent abuse (including rate limiting and IP-based detection of brute-force or abusive traffic), and to improve the product.
5. Legal bases (GDPR)
We rely on: performance of our contract with you (to run your account and trips); your consent (optional analytics, the email digest); our legitimate interests (security, abuse prevention, product improvement); and legal obligations where applicable. You can withdraw consent at any time.
6. Third parties and processors
Analytics: if you accept the "Google Analytics" category, we use Google Analytics 4 (provided by Google Ireland Limited, with Google LLC in the United States) to measure traffic and usage trends. Google sets cookies and processes pseudonymous identifiers and technical data (such as device, browser and a truncated IP address); we do not store your IP for this purpose. The legal basis is your consent, and the script is never loaded until you give it. You can withdraw at any time via the "Cookies" link, which stops further collection. See Google’s own privacy information for details, and note that data may be transferred to the United States (see "International transfers").
Maps and directions: Google Maps / Places provide map tiles, place details and routing. We load the Google Maps script only after you allow the "Maps" category (asked just in time the first time you open the map). If you decline, voyageons falls back to an offline basemap and sends no request to Google.
AI assistant: optional AI features send the content you submit to a large-language-model provider (such as Google Gemini) to generate a response.
Email delivery: transactional emails are sent through an email/SMTP provider.
Hosting and infrastructure: we use reputable hosting providers to run the database and services. These providers act as processors under appropriate agreements and may not use your data for their own purposes.
7. Data sharing
We do not sell your personal data. Trip content is shared only with the collaborators you invite, and with anyone holding a public share link you create. We may disclose data if required by law or to protect the Service and its users.
8. Retention
We keep your personal data while your account is active. When you delete your account, your personal data is removed. To preserve shared trips for the other collaborators, your contributions there (such as expenses, comments and balances) are anonymised rather than deleted: your name is replaced with a neutral label ("Former member") and the link to your identity is removed. Some records may be retained where required by law or for security.
9. International transfers
Some processors may operate outside the EEA, including Google (for Google Analytics and AI features) in the United States. Where that happens, we rely on appropriate safeguards, such as the EU-US Data Privacy Framework and the European Commission’s standard contractual clauses, to protect your data.
10. Your rights
Subject to applicable law, you can access, correct, export, restrict or delete your personal data, object to certain processing, and withdraw consent.
You can exercise the main rights yourself from your profile under Data & privacy: Export my data downloads a complete, machine-readable JSON file (right to portability) containing your profile, the trips you own and your own contributions to shared trips; manage your cookie choice per category at any time; and Delete my account permanently erases your account after a password confirmation (trips you own with other members are transferred to them, trips only you are in are deleted).
To exercise any other right, email [email protected]. You may also lodge a complaint with the French supervisory authority (CNIL).
11. Security
We use technical and organisational measures to protect your data, including password hashing, optional two-factor authentication, encrypted transport (HTTPS), and access controls. No system is perfectly secure, but we work to keep your data safe and to notify you of incidents where required.
12. Children
voyageons is not directed to children under the age of digital consent. If you believe a child has provided us personal data, contact us so we can remove it.
13. Changes and contact
We may update this Policy; we will update the "last updated" date and, for material changes, notify you where appropriate. For any privacy question or request, email [email protected]. Company details are on the Legal notice page. If you do not hear back quickly, please check your spam folder.