Privacy, wherever you go.
This notice describes the current Vayroza MVP. Public launch requires the deploying operator to add its legal identity, contact details, retention schedule, and processor agreements.
What we process
Account name, email, password hash, saved trips, favorites and preferences that you explicitly choose to save. Search records contain validated travel criteria rather than the original prompt. Avoid sharing sensitive personal details in travel requests.
How we use it
We use account and trip data to provide the features you request. Security controls protect the service. Aggregate first-party counters record page and referral activity without an analytics user identifier. Optional PostHog analytics require your consent.
AI and providers
If AI is configured, your request and current travel criteria are sent to the configured AI service to extract preferences. We set API storage to false. Vendor processing and retention are governed by the applicable provider contract. The demo uses fictional accommodation records and makes no live booking.
Cookies and retention
Authentication cookies last up to 7 days, the optional referral session cookie lasts 24 hours after analytics consent, language preference lasts one year, and the analytics consent choice lasts six months. The maintenance script removes search, AI and event records older than 90 days and referral records older than one year. The operator must schedule it. Payment records may be retained for legal accounting duties.
Your choices
You can edit your profile, delete trips or favorites, withdraw analytics consent on the Cookies page, and delete your account from Profile. Account deletion removes your profile and saved items, removes linked searches, and removes the account link from retained click and payment records; billing identifiers may remain for accounting duties. Export is available from the profile export endpoint.
Your rights
Depending on your circumstances, you may request access, correction, erasure, restriction or portability, object to processing, and complain to your data protection authority. The deploying operator must provide a working privacy contact before collecting public user data.