Legal
Last updated: October 2026
When you create an account, we collect your email address and a hashed password. When you generate or save a journey, we store the feeling you described, your selected filters, and the resulting itinerary data. If you join the Pro waitlist, we store your email address so we can tell you when Pro launches. If you subscribe to our newsletter, Wish You Were Here, your email address is stored by beehiiv, our newsletter provider, so we can send it to you; every issue has an unsubscribe link. If you choose a Local or International trip, your browser asks for your location; we turn it into your city and country (sending coordinates rounded to about 1 km to MapTiler, our map provider) and use only that city and country to plan the trip. We never store your location. Your IP address is held briefly in server memory to limit how many journeys can be generated per hour; it is not stored in our database. We do not collect payment information directly; any future billing will be handled by Stripe, which has its own privacy policy.
Your data is used solely to provide the VITRAL service — authenticating your account, saving your journeys, and improving generation quality. We do not sell your data. We do not share it with third parties except as necessary to run the service (Supabase for database and auth, Resend for account emails, OpenAI for journey generation, MapTiler for maps and finding your city and country when you ask for it, Vercel for hosting and analytics, PostHog for product analytics, beehiiv for the newsletter).
The feelings and prompts you type are sent to OpenAI's API to generate your itinerary. OpenAI may retain this data according to their own retention policies. We recommend not including personally identifiable information in your feeling prompts.
We use Vercel Analytics and PostHog to understand how VITRAL is used: page views, country, device type, and product events such as a journey being generated or saved, an account being created, or the waitlist being joined. Vercel Analytics uses no cookies. PostHog waits for your answer to the cookie banner: if you accept, it works as described below; if you decline, it counts your visit without cookies or storage and records no replays. You can change your answer at any time with "Cookie settings" at the bottom of the home page. With your consent, PostHog also records session replays (clicks, scrolls and page changes) so we can see where people get stuck. Everything you type into a form is hidden from these recordings, and so is your email address. PostHog keeps an identifier in a cookie and in your browser's local storage to recognise returning visitors. If you're signed in, events are linked to your account ID, never your email. To tell new visits from returning ones, we also keep a small marker of the month you first visited in local storage. PostHog stores this data in the EU. We do not use advertising cookies, and we never sell or share analytics data with advertisers.
Some journeys may include links to booking partners such as hotels, tours and activities, for example through Travelpayouts, GetYourGuide or Viator. If you click one and book, we may earn a commission at no extra cost to you. Once you leave VITRAL, the partner's own privacy policy applies to anything you share with them.
Your account and saved journeys are retained for as long as your account is active. You can delete your account at any time from Your journeys → Account → Delete account: your account, saved journeys and Pro waitlist entry are removed immediately. Analytics events linked to your account ID are kept without your email; email us and we'll delete them within 30 days. To leave the newsletter, use the unsubscribe link in any issue.
Passwords are never stored in plain text. All data is encrypted in transit via HTTPS. Our database uses row-level security so users can only access their own data. We are a small team and take a practical, responsible approach to security.
Questions about your data? Reach us at hello@vitral.world. We'll respond within 5 business days.
This policy will be updated as VITRAL evolves. Significant changes will be communicated by email.