Privacy policy

Viamente is an AI travel assistant built by Lygge Studios ApS, based in Copenhagen, Denmark. Questions about this policy or your data: use our contact form.

Looking to delete your account? Account deletion instructions are available below, including a request option without the app.

Viamente stores the travel plans and flight-research threads you create and the messages you exchange with its assistants. You can also collaborate inside the app and choose to publish a revocable, unlisted, read-only link to a limited view of a journey. This policy covers those features and the additional capabilities — such as bookings and a mobile companion — as they ship.

• Account — your email address, an optional display name, and the identifiers we receive when you sign in via email, Google, or Apple. A session cookie (viamente_session, HttpOnly) keeps you logged in on the website and Android app. The iOS app instead stores its session credential in the iOS Keychain and sends it with authenticated requests.
• Plans, research, and conversations — the trip plans you create (destinations, dates, accommodation choices, notes), the flight-research threads you start, and the messages you send to our assistants. Your messages, together with the relevant profile context, are transmitted to our AI providers to interpret requests and generate replies (see §4).
• Connected calendars — if you connect Google Calendar, we receive your Google account identifier and email, store the refresh token encrypted, create a separate “Viamente Journeys” calendar, and write your dated Viamente events and travel bookings when you enable account-wide export. With read-only consent, we also retrieve the names and colours of calendars visible to you and live event titles, locations, times, and busy/free state for the date window currently shown or planned. We do not retrieve descriptions, attendees, or meeting details, and we do not store personal event history in Viamente. Relevant Journey-window events may be sent to our AI provider so Menta can identify overlaps and plan around them. We never write into your existing calendars. If you create a calendar subscription, its unguessable feed URL acts like a password: anyone who has it can read the dates, titles, locations, and details of your exported Viamente events and travel bookings until you replace or revoke the URL. Calendar exports are optional and enabled per account, including events without a journey. You can disable each export destination at any time.
• Public journey links — when a journey owner creates an unlisted share link, anyone who has that link can read the allowlisted journey summary until the owner revokes it. The shared view can include the journey title and dates, route and stops, itinerary, selected or saved travel options, prices or budget when the owner chooses to include them, and traveler initials with broad adult or child labels. It does not include assistant conversations, notes, full traveler names, contact or account identifiers, loyalty details, or booking confirmation codes. Opening the link does not disclose a visitor's account identity to the journey owner; copying it into a new editable journey requires the visitor to sign in.
• Profile context — your durable travel profile and traveler roster: preferences the assistant infers from your conversations (e.g. "travels with kids", "prefers boutique stays"), the people you add as travelers (names and relationships), and — only where you choose to provide them — details such as contact phone numbers, home addresses, dates of birth, gender, citizenship, passport or other travel-document details, loyalty-program numbers, and seating or dietary preferences. Dietary preferences and free-form planning messages can reveal health needs or religious beliefs when you provide them. Uploaded profile photos and travel documents are also stored when you add them. We also store reusable invoice details you provide: recipient name, billing address, optional company name, and tax identifier. This is what makes subsequent plans smarter for you specifically. You can ask for the contents of this profile or its deletion at any time (see §6).
• Journey collaboration — people you invite to a journey can access its shared planning content, including conversations, itinerary, notes, attachments, and booking details available in that journey. Their role controls whether they may edit it. Private traveler profiles remain owned by their account; a journey exposes only the traveler information allowed for that shared view, rather than every profile in the owner's roster.
• Imported Google Maps lists — if you connect Google Maps, we import the lists you authorize through Google's Data Portability service. We store list names and saved place titles, notes, Maps links, coordinates, and addresses when available, together with sync status and an encrypted refresh token. Google's consent screen determines whether access is one-time or time-based; a time-based grant can refresh the import daily. An uploaded Google Takeout archive uses the same import path. We can look up unresolved places with Google Maps Platform to obtain their coordinates. This imports your lists into Viamente; it does not write into your Google Maps lists.
• Shared search caches — to reuse supplier results, we cache flight, rental-car, hotel and vacation-rental searches and their supplier responses, including accommodation details and reviews. These copies can include route, pickup/drop-off or stay locations, dates and times, cabin, passenger or room occupancy counts and child ages, nationality, filters, driver age and currency. They are keyed by the search rather than your account and can remain after account deletion until cache cleanup.
• Raw planning input — the verbatim text you type during onboarding and to the assistant is also kept as an internal record so we can improve how the assistant understands trips and preferences. It is never shown to other users and is deleted with your account.
• Administrator access — authorized Viamente administrators may inspect your account and plan, and may make changes in your account when providing support or correcting data. These sessions are recorded in an internal audit trail and excluded from your usage statistics and API cost attribution.
• Bookings — when you book a hotel or flight through Viamente, the booking details, including the traveler details you enter for it, are shared with the travel supplier fulfilling that booking (see §4).
• Diagnostics — server logs (HTTP method, path, status code and error diagnostics) are used for debugging and abuse prevention and retained according to the logging service's configured retention window. The bearer token in a public journey path is replaced with a redacted placeholder before that path is written to structured application logs.
• Maps and location searches — public country and local-guide pages load a static map image from Google Maps Platform, while app and public journey maps load basemap tiles, labels, and map assets from OpenFreeMap. When you choose Satellite, map imagery is loaded from Esri (ArcGIS Online). Those direct browser requests give the provider ordinary connection data such as your IP address and browser details. Map tile and imagery requests contain the visible map area; public journey requests do not contain the secret share-link token. Google guide requests contain only the guide's public place names and coordinates, never your account or plan data. When you use location search, place details, geocoding, or route tools in the app, we send the place text, coordinates, or route endpoints needed to answer that request to Google Maps Platform. If you allow it, the Map uses your device's location to show where you are and as the centre of the searches you run there; it is not saved to your account, and the map's last view is remembered only on your device. In-app road directions send the route origin and destination through Viamente to the OSRM road router operated by FOSSGIS; public transport and fallback routes may use Google. Android navigation and Android Auto use precise location while you have explicitly started guidance, including with the phone locked. GPS matching and spoken guidance run on your phone; route calculations and reroutes send the current origin and destination to our road router. We do not save a live location history to your account. Stop or arrival ends native guidance and location updates. The selected destination is remembered locally for up to six hours for reconnection and is cleared from saved storage when guidance stops. Native navigation storage is excluded from Android backups. During active guidance, fixed-camera lookups send a rounded nearby area through Viamente to OpenStreetMap's Overpass service. These lookups contain no account identifier or destination and are cached by area for up to one day; coverage is incomplete.
• Error-recovery reports — when an error or map recovery screen lets you flag a bug, we collect your description and an automatically captured page screenshot when available, together with the app route, browser and viewport details, error details, and a timestamped link to a session replay when available.
• Acquisition and product analytics — page paths, standard campaign parameters (utm_source, utm_medium, utm_campaign, utm_content, and utm_term), the external referring domain, landing path, device type, and product actions. We keep bounded first- and latest-touch attribution in your browser for up to 90 days after your last visit so a campaign can still be connected after a landing-page CTA or sign-in link removes its query string. A passive page view remains in PostHog only. If you deliberately use a planning or sign-in call to action, we create a limited pseudonymous Lead in our internal CRM using a random browser ID and this bounded context. For that Lead, we also retain the first and latest coarse city, region, country, and timezone Cloudflare inferred when serving the request. Later page presence may refresh an existing Lead's latest attribution and coarse location, but never creates a Lead by itself. We do not add the visitor's IP address, precise coordinates, postal code, raw user-agent string, or full referring URL to that Lead. When you sign in, the Lead is merged into your account contact and the context is added to your PostHog person profile. On a public journey view, ordinary page analytics can record a redacted route, but never the share-link bearer token; session replay is disabled there.
• Help and bug reports — when you email Peter from the journey Help dialog or travel-professional contact form, we send your message, reply address, and page path to his inbox. Signed-in bug reports can include browser diagnostics, an automatically captured screenshot, and a session replay when available. If you ask Menta for help, your question and published website information are processed to produce an answer. These forms do not send new messages to Intercom.

• Cloudflare, Inc. — Workers, D1 (SQLite), and Email Sending (outbound transactional email such as magic links). Cloudflare also provides private R2 storage for uploaded files, photos, and diagnostic evidence, and Durable Objects for assistant sessions. We use EU infrastructure where the configured service supports it; this is not a promise that every request or stored copy remains in the EU.
• Oracle Cloud — our configured Autonomous Database endpoint is in Zurich, Switzerland. When configured, Oracle holds mirrored flight and rental-car search caches, including the search inputs and offer snapshots described in §3, and public hotel, place, review, and transport-reference caches. Nearest-station lookups can send the planning coordinates and point identifiers needed for that query. These paths supplement Cloudflare's database; the reviewed integration does not replace the account and planning database with Oracle.
• PostHog Cloud EU (eu.i.posthog.com) — page and product analytics across public and signed-in customer pages, including campaign, referring-domain, landing-path, and device-type context. Session replay is limited to signed-in app sessions, including the iOS and Android apps. Replays record rendered text, all form values (including password-type fields), and canvas content such as maps without general masking. Security-sensitive bearer values, including private calendar subscription links, are excluded. Console logs, request headers, and request or response bodies are not recorded. Replays begin only after sign-in and stop on logout. PostHog cookies (prefixed ph_) are first-party and used to stitch a single visitor's session together. Your distinct ID is bound to your Viamente user ID only after you sign in. Demo and other-account administrator app views are excluded from PostHog identification and session replay; an administrator's own app view behaves like their ordinary signed-in session. Public journey views can emit ordinary page and product analytics under a redacted route such as /share/[redacted], but the share-link bearer token is removed and session replay stays disabled even for a signed-in visitor. Automatic element capture is disabled inside public journey views; only explicit redacted product events are sent.
• Intercom, Inc. — an inactive support integration retained in our system. Current Help, bug report, and contact forms do not open Intercom or send new messages there. Earlier support conversations remain subject to Intercom's retention and deletion controls.
• Google Cloud (Vertex AI) — large-language-model inference for the travel assistant, Flight Research, attachment transcription, booking-document understanding, and internal structured extraction. The content needed for each feature — such as conversation or research messages, relevant profile context, and files you ask us to interpret — is transmitted to Google Vertex AI through Cloudflare's AI Gateway. Cloudflare records provider request and response content for debugging, including prompts and model answers. Gateway caching is disabled. This does not set Google's or another AI provider's retention rules. Google does not originate or price the flight offers shown by Viamente.
• ElevenLabs (Scribe) — when you record a voice message, we send the audio through Cloudflare AI Gateway to ElevenLabs for speech-to-text. The returned transcript can be edited and submitted as planning input. Gateway request and response logging also applies to voice transcription. We have disabled ElevenLabs' use of submitted data for model improvement. Provider processing and retention depend on the applicable service terms and workspace settings; we do not promise zero retention. You can type instead of recording audio.
• Google Maps Platform — static map images on public destination guides, and place search, place details, geocoding, and route calculations used by planning tools. Public guide images are requested directly by your browser from Google; the guide request contains only public destination data. App location requests send only the search text, coordinates, or route endpoints needed to provide the feature.
• OpenFreeMap — basemap tiles, labels, and map assets displayed in the app, public journey views and native Android navigation. These assets are requested directly by your browser or phone using the visible map area; the secret share-link token is not sent with those requests.
• Esri (ArcGIS Online) — satellite imagery when you choose the Satellite map view. Your browser requests imagery tiles for the visible map area directly from Esri, providing ordinary connection data such as your IP address and browser details. These tile requests do not include your account profile or the public journey share-link token.
• OpenWeather — coordinates and requested dates for journey weather forecasts and historical climate information. Those requests go through our server; they do not include your account profile or conversations.
• SerpApi — accommodation and vacation-rental searches can send the destination query, arrival/departure dates, adult count, currency, and requested property, amenity, or price filters to retrieve search results. They do not send your traveler names or assistant conversation.
• air-routes.com — origin airport codes to retrieve public flight-connection catalogues. We do not send your profile or conversation for these lookups.
• FOSSGIS (OSRM road routing) — driving, walking and cycling route calculations. Viamente sends only the route endpoints required for that calculation, including a new origin when native Android navigation needs to reroute. Android car guidance uses only road routes, without Google fallback or straight-line estimates.
• OpenStreetMap Overpass — mapped parking, posted speed-limit and fixed-camera data during active Android navigation. Viamente sends only a rounded area coordinate to the public Overpass service; it receives neither your complete route nor your account identity. Mapped results are cached by area for up to one day. Your phone contacts Viamente, rather than Overpass directly, for these lookups.
• Google LLC (sign-in) — only if you choose “Continue with Google” to sign in. We request the openid email profile scopes solely to look up or create your Viamente account and to show your name and email in the app.
• Apple (sign-in) — if you choose Sign in with Apple, we receive your Apple account identifier and the name and email Apple provides, which may be a private relay address. We store available refresh tokens encrypted so we can revoke the authorization when you delete your account.
• Google LLC (connected calendars) — only if you separately connect Google Calendar. We request calendar.app.created, calendar.calendarlist.readonly, calendar.events.readonly, openid, and email. This lets Viamente create and manage its own secondary calendar, list calendars visible to the account, read bounded event windows, and identify the connected account. The read scopes do not let us change existing calendars. Selected Journey dates, titles, locations, notes, and Viamente links are sent to Google as private events. Disconnecting deletes the Viamente-created calendar and revokes the grant.
• Google LLC (Maps list imports) — only if you connect Google Maps or supply an export. We request thedataportability.maps.starred_places anddataportability.saved.collections scopes separately from sign-in and calendar access. Google provides the authorized exports; Viamente stores the imported lists and places described in §3. Google determines account eligibility and grant duration.
• Google LLC (support correspondence) — when our team connects a Gmail mailbox to the internal customer-support system, relevant support emails and replies are read or sent through Gmail and copies are associated with the corresponding contact in that system. This is our team's mailbox connection; signing in to Viamente does not grant access to your Gmail inbox.
• Google Calendar and Google Meet (booking page) — only if you choose the 20-minute booking link. Google hosts the booking page and handles the appointment and any Meet details. This is separate from the optional calendar export above.
• LiteAPI, Duffel, and fulfilling travel suppliers — search requests include the itinerary, dates, occupancy or passenger ages needed to find offers. For a booking, we send the required traveler and contact details to the selected booking platform and fulfilling hotel or airline. Duffel also handles flight payment details through its embedded payment form; Viamente does not store card numbers. Providers keep records needed to deliver and account for reservations, even after you delete your Viamente account.
• Discover Cars — rental-car searches send the pickup/drop-off location, dates and times, driver age, and pricing context needed to obtain offers. Booking links open Discover Cars; information you then enter there is handled by Discover Cars and the rental supplier under their own policies. Viamente does not complete those rental reservations itself.
• Apple (App Store memberships) — memberships bought in the iOS app are paid through your Apple Account; Apple processes the payment and we never receive card details. Apple sends us signed purchase records, which we verify and use to provide membership access: Apple's subscription and transaction identifiers, the product bought, whether the purchase was made in Apple's test or live store, the subscription status, and its start and end dates. We link the subscription to your Viamente account and remove that link when you delete your account. Apple also notifies our servers of renewals, cancellations, refunds and billing problems. Apple keeps its own purchase records under its privacy policy.
• Google Play (Android memberships) — Google Play processes Android membership payments. When Play billing is available, Viamente verifies purchase tokens with Google and stores encrypted purchase tokens, product and base-plan identifiers, subscription state, and expiry to provide membership access and handle cancellation.
• Stripe, Inc. — payment processing for paid memberships. Checkout and the billing portal are Stripe-hosted pages; we store no card data ourselves. On our side we keep only a Stripe customer reference and your membership record: tier, subscription status, current allowance-period bounds, and the yearly price you locked in. Stripe holds the payment records, including invoices we are required to retain under Danish bookkeeping law.

After signing in to the iOS or Android app, you see an introduction before the existing setup and app features. It names Google Cloud Vertex AI, Cloudflare AI Gateway, and optional ElevenLabs voice transcription, and explains the messages, relevant profile and journey details, files, photos, and voice recordings involved. Choosing “Enable Menta” gives explicit permission for that AI processing in the apps. Signing in or reading this policy alone does not give it.

We save the disclosure version and acceptance time with your account, so the choice follows you across app sign-ins and devices. Existing accounts also see the introduction if they have not accepted this version. You can withdraw permission in Account, which blocks new AI requests in the apps and returns you to the introduction. Withdrawal cannot recall data already sent or stop work already underway, and it does not change AI use on the website. You can sign out without enabling Menta; account deletion remains accessible. This choice does not grant permission for analytics or session replay, whose practices are described separately.

• viamente_session — essential, HttpOnly, keeps you signed in.
• viamente_calendar_oauth_* — essential, HttpOnly, and kept for at most ten minutes while you complete the separate Google Calendar connection.
• ph_* — set by PostHog for analytics (see §4).
• intercom-* — cookies and local storage from earlier Intercom support conversations. The Messenger is currently inactive.
• vmt_marketing_attribution_v1 — first- and latest-touch campaign, referring-domain, landing-path, and device-type context in local storage. It expires 90 days after the last customer-page visit.

We do not set advertising cookies. Earlier Intercom support cookies or local storage may remain in browsers that used the Messenger. Visitors in the EU / EEA / UK / Switzerland see a banner explaining these practices. Accepting it stores a single acknowledgement in your browser's local storage. Analytics is enabled before that acknowledgement; the notice does not offer an analytics opt-out or act as a separate permission step for AI processing or signed-in session replay.

Cloudflare AI Gateway diagnostic logs can contain provider inputs and outputs, including messages, relevant profile context and submitted files or voice content. They are retained for debugging until explicitly deleted or until the configured storage cap evicts the oldest logs; there is no automatic time-based expiry. These diagnostic copies require separate cleanup and their erasure is not currently verified by the automated account-deletion process.

Your journeys persist until you permanently erase them or delete your account. Cancellation or downgrade does not remove a retained journey: it remains readable and editable, and editing it does not create a new allowance entry. Journey erasure permanently removes its Viamente-owned structure, conversation, notes, files, and saved reservation copies. It cannot be undone and does not cancel a reservation held by an airline, hotel, or other provider.

Calendar connections and subscription tokens persist until you disconnect, revoke them, or delete your account. Personal Google event history is read live for the requested planning window and is not retained in Viamente's database or conversation history. Disconnecting Google Calendar deletes the dedicated Viamente calendar before revoking its grant; revoking a subscription URL makes that URL stop working immediately. Account deletion revokes stored Google Calendar access; it does not delete externally held calendar events. Copies already written into an external calendar are also held by that calendar provider. To ensure those copies are removed, use Disconnect before deleting your Viamente account, or delete them in the external calendar.

An unlisted journey link remains usable until its owner revokes it or the underlying journey or account is deleted. Revocation makes the public view unavailable immediately. The minimal share-link record and its revoked status remain with the journey until that journey is erased, so the same bearer link cannot become active again by accident.

Shared flight-search snapshots normally have a 30-minute freshness window; rental-car search snapshots have a 14-day window. Expired snapshots become eligible for bounded maintenance cleanup after an additional day. Cleanup failures or a backlog can extend retention. Hotel and vacation-rental discovery and selected supplier details and reviews normally have a 24-hour freshness window; successful empty discovery is reused for at most one hour. Hotel list-rate caches normally use 10 minutes for positive results and five minutes for empty results; hotel property-detail caches use up to 30 days for static facts, with a separate 24-hour edge cache. Current hotel detail rates and booking checks are fetched live. Stay-cache freshness can change with configuration. Expired stay entries are removed in bounded batches after successful cache writes, so old or inactive entries and cleanup backlogs can remain beyond the freshness window. These shared caches are not immediately cleared by an individual account deletion. Contact us if a search contains information that identifies you and needs review for erasure.

Imported Maps lists remain until you clear the imports or delete your account. Disconnecting stops future sync and removes the stored grant but keeps existing imported lists. Clearing imports removes their lists, places, and sync history; disconnect first if you also want to stop a time-based grant from importing them again. Account deletion stops Maps sync and retries revocation of the stored grant if Google is unavailable.

Bug-report screenshots and diagnostic evidence are retained while the report is under review and are accessible only to Viamente administrators. Account deletion removes those screenshots and report evidence, deletes associated PostHog recordings, and removes replay links from retained roadmap records.

Help and contact emails can remain in the support mailbox and external email copies after account deletion; that flow does not automatically erase the mailbox messages. Contact us to request review and removal of identifiable support correspondence, subject to records needed for an outstanding request or legal obligation.

Account deletion requests removal of support profiles linked to your account from Intercom, including associated support data under Intercom's deletion controls. Provider-side removal can take longer than removal from Viamente. Intercom documents a seven-day recovery period; satisfaction ratings/comments and reporting records may remain and require separate review. Tell us about any anonymous or separately identified support conversations so we can locate and review them for erasure.

Delete your Viamente account

Without the app: use the contact form and write “Delete my Viamente account” in your message. Enter your account email address so we can verify the request. You do not need to reinstall the app or buy anything. We verify ownership before erasure; if you cannot access that email, contact us for help. Do not send passwords or identity documents. We respond within 30 days and explain any necessary delay or records that must be retained. You can also request deletion of specific data without closing your account.

In the app or on the website: sign in at Account, choose “Delete account”, and complete the three confirmation steps. We first email you a permanent record of what will be removed, including your flight and hotel reservation history. After you confirm that record, we send a separate six-digit deletion code. Use the contact form if you cannot use the self-service flow. Erasure normally completes within minutes when cleanup can be verified, and is retried automatically if a processor is unavailable. Older diagnostic copies that require manual cleanup can keep erasure pending until that cleanup is verified; we do not mark the account erased while required cleanup remains unfinished. Your account is disabled after final confirmation. Pending cleanup keeps the records and encrypted credentials needed to retry; persistent failures are flagged for manual attention. Erasure removes:

• Your plans, messages, and profile context from our database;
• Your PostHog person profile and all associated events;
• Original and derivative uploads, including assistant attachments, travel documents, photos, booking copies, and bug-report evidence; associated session recordings;
• Any session, magic-link, or API tokens tied to your account;
• Your account record after the cleanup above, plus linked Intercom support profiles and stored calendar and Apple authorizations where tokens are available.

What survives an erasure. We retain restricted deletion markers and an erasure inventory containing opaque account, journey, session-scope, and storage-object identifiers and the deletion-request time. These records contain no message content, uploaded files, email address, or integration credentials. They remain outside the database restore boundary to prevent a backup restore or late upload from restoring deleted access or files. They have no automatic expiry and must remain while a restorable backup can contain those identities. They do not carry journey usage into a newly created account. For memberships purchased through Google Play when available, we retain an unlinked hash of the purchase token after account deletion solely to prevent the same purchase being claimed by another account. The original token, account link, and purchase metadata are removed; this hash does not carry journey usage into a later account. For memberships purchased through Apple's App Store, our record linking the subscription to your account is deleted with the account; deleting your account does not cancel the subscription with Apple, which you manage in your Apple Account settings. Records we are legally required to keep — such as invoices under Danish bookkeeping law, held at our payment processor — are retained for their statutory period. External booking providers separately keep the records they need to deliver and account for reservations.

Account deletion ends your Viamente membership access immediately. It does not cancel hotel or flight reservations: the booking platform, hotel, airline, and other fulfilling suppliers retain the records they need to deliver and account for those services. The first deletion email is your copy of their confirmation details before Viamente removes its local booking records.

Database backups can contain older data until their recovery window expires. Restored data is subject to the deletion safeguards above. Deletion cannot remove copies you or another person downloaded, external calendar copies, or storage on an offline device; revoked sessions can no longer access the service.

Logging out calls posthog.reset() so subsequent activity on the same browser is not associated with your account.

Under the GDPR and equivalent data-protection laws, you have the right to access, rectify, erase, restrict the processing of, port, and object to the processing of your personal data. Use our contact form and we will respond within 30 days. You also have the right to lodge a complaint with your local data-protection supervisory authority.

Our Terms require account holders to be at least 16 years old. The service is not directed at children under 16. Adults may add child travelers when planning a family journey, including names, ages or dates of birth, relationships, and travel or booking details. The adult must be authorized to provide these details and should only enter what is needed. Child traveler information is processed for the same planning and booking purposes and can be removed through the adult's account or an erasure request. Contact us if someone under 16 has created an account.

Cloudflare, Oracle, PostHog, Google, Apple, ElevenLabs, and Intercom are US-headquartered companies. We use EU infrastructure where the configured service supports it; Vertex AI requests may be processed outside the EEA. Earlier Intercom support conversations and user-attached files may have been processed and stored in its US data region. Where transfers outside the EEA occur, they rely on the EU Standard Contractual Clauses or an equivalent transfer mechanism.

We will update this page when our practices change. Material changes will re-prompt the cookie notice in your browser so you see them on your next visit.