Privacy policy

Viamente is an AI travel planner built by Lygge Studios ApS, based in Copenhagen, Denmark. Questions about this policy or your data: use our contact form.

Looking to delete your account? Account deletion instructions are available below, including a request option without the app.

Viamente stores the travel plans and flight-research threads you create and the messages you exchange with its assistants. You can also collaborate inside the app and choose to publish a revocable, unlisted, read-only link to a limited view of a journey. This policy covers those features and the additional capabilities — such as bookings and a mobile companion — as they ship.

• Account — your email address, an optional display name, and the identifiers we receive when you sign in via email, Google, or Apple. A session cookie (viamente_session, HttpOnly) keeps you logged in.
• Plans, research, and conversations — the trip plans you create (destinations, dates, accommodation choices, notes), the flight-research threads you start, and the messages you send to our assistants. Your messages, together with the relevant profile context, are transmitted to our AI providers to interpret requests and generate replies (see §4).
• Connected calendars — if you connect Google Calendar, we receive your Google account identifier and email, store the refresh token encrypted, create a separate “Viamente Journeys” calendar, and write only the Journeys you switch on. With read-only consent, we also retrieve the names and colours of calendars visible to you and live event titles, locations, times, and busy/free state for the date window currently shown or planned. We do not retrieve descriptions, attendees, or meeting details, and we do not store personal event history in Viamente. Relevant Journey-window events may be sent to our AI provider so Menta can identify overlaps and plan around them. We never write into your existing calendars. If you create a calendar subscription, its unguessable feed URL acts like a password: anyone who has it can read the Journey dates, titles, locations, and details you selected until you replace or revoke the URL. Calendar exports are optional and can be disabled per Journey.
• Public journey links — when a journey owner creates an unlisted share link, anyone who has that link can read the allowlisted journey summary until the owner revokes it. The shared view can include the journey title and dates, route and stops, itinerary, selected or saved travel options, prices or budget when the owner chooses to include them, and traveler initials with broad adult or child labels. It does not include assistant conversations, notes, full traveler names, contact or account identifiers, loyalty details, or booking confirmation codes. Opening the link does not disclose a visitor's account identity to the journey owner; copying it into a new editable journey requires the visitor to sign in.
• Profile context — your durable travel profile and traveler roster: preferences the assistant infers from your conversations (e.g. "travels with kids", "prefers boutique stays"), the people you add as travelers (names and relationships), and — only where you choose to provide them — details such as citizenship, loyalty-program numbers, and seating or dietary preferences. This is what makes subsequent plans smarter for you specifically. You can ask for the contents of this profile or its deletion at any time (see §6).
• Raw planning input — the verbatim text you type during onboarding and to the assistant is also kept as an internal record so we can improve how the assistant understands trips and preferences. It is never shown to other users and is deleted with your account.
• Administrator access — authorized Viamente administrators may inspect your account and plan, and may make changes in your account when providing support or correcting data. These sessions are recorded in an internal audit trail and excluded from your usage statistics and API cost attribution.
• Bookings — when you book a hotel or flight through Viamente, the booking details, including the traveler details you enter for it, are shared with the travel supplier fulfilling that booking (see §4).
• Diagnostics — server logs (HTTP method, path, status code) are retained for roughly 30 days for debugging and abuse prevention. The bearer token in a public journey path is replaced with a redacted placeholder before that path is written to structured application logs.
• Maps and location searches — public country and local-guide pages load a static map image from Google Maps Platform, while public journey views load basemap tiles, labels, and map assets from OpenFreeMap. Those direct browser requests give the provider ordinary connection data such as your IP address and browser details. Public journey requests contain the map area needed for the view but not the secret share-link token. Google guide requests contain only the guide's public place names and coordinates, never your account or plan data. When you use location search, place details, geocoding, or route tools in the app, we send the place text, coordinates, or route endpoints needed to answer that request to Google Maps Platform. If you allow it, the Map uses your device's location to show where you are and as the centre of the searches you run there; it is not saved to your account, and the map's last view is remembered only on your device. Directions and Google Maps links open Google Maps itself, under Google's own terms.
• Error-recovery reports — when an error or map recovery screen lets you flag a bug, we collect your description and an automatically captured page screenshot when available, together with the app route, browser and viewport details, error details, and a timestamped link to a session replay when available.
• Acquisition and product analytics — page paths, standard campaign parameters (utm_source, utm_medium, utm_campaign, utm_content, and utm_term), the external referring domain, landing path, device type, and product actions. We keep bounded first- and latest-touch attribution in your browser for up to 90 days after your last visit so a campaign can still be connected after a landing-page CTA or sign-in link removes its query string. A passive page view remains in PostHog only. If you deliberately use a planning or sign-in call to action, we create a limited pseudonymous Lead in our internal CRM using a random browser ID and this bounded context. For that Lead, we also retain the first and latest coarse city, region, country, and timezone Cloudflare inferred when serving the request. Later page presence may refresh an existing Lead's latest attribution and coarse location, but never creates a Lead by itself. We do not add the visitor's IP address, precise coordinates, postal code, raw user-agent string, or full referring URL to that Lead. When you sign in, the Lead is merged into your account contact and the context is added to your PostHog person profile. On a public journey view, ordinary page analytics can record a redacted route, but never the share-link bearer token; session replay is disabled there.
• Help and bug reports — when you email Peter from the journey Help dialog or travel-professional contact form, we send your message, reply address, and page path to his inbox. Signed-in bug reports can include browser diagnostics, an automatically captured screenshot, and a session replay when available. If you ask Menta for help, your question and published website information are processed to produce an answer. These forms do not send new messages to Intercom.

• Cloudflare, Inc. — Workers, D1 (SQLite), and Email Sending (outbound transactional email such as magic links). Cloudflare is our primary processor; data is stored in EU regions where Cloudflare supports it.
• PostHog Cloud EU (eu.i.posthog.com) — page and product analytics across public and signed-in customer pages, including campaign, referring-domain, landing-path, and device-type context. Session replay is limited to signed-in app sessions. Replays record rendered text, all form values (including password-type fields), and canvas content such as maps without general masking. Security-sensitive bearer values, including private calendar subscription links, are excluded. Console logs, request headers, and request or response bodies are not recorded. Replays begin only after sign-in and stop on logout. PostHog cookies (prefixed ph_) are first-party and used to stitch a single visitor's session together. Your distinct ID is bound to your Viamente user ID only after you sign in. Demo and other-account administrator app views are excluded from PostHog identification and session replay; an administrator's own app view behaves like their ordinary signed-in session. Public journey views can emit ordinary page and product analytics under a redacted route such as /share/[redacted], but the share-link bearer token is removed and session replay stays disabled even for a signed-in visitor. Automatic element capture is disabled inside public journey views; only explicit redacted product events are sent.
• Intercom, Inc. — an inactive support integration retained in our system. Current Help, bug report, and contact forms do not open Intercom or send new messages there. Earlier support conversations remain subject to Intercom's retention and deletion controls.
• Google Cloud (Vertex AI) — large-language-model inference for the planning assistant, Flight Research, attachment transcription, booking-document understanding, and internal structured extraction. The content needed for each feature — such as conversation or research messages, relevant profile context, and files you ask us to interpret — is transmitted to Google Vertex AI through Cloudflare's AI Gateway. Google does not originate or price the flight offers shown by Viamente.
• ElevenLabs (Scribe) — when you record a voice message, we send the audio through Cloudflare AI Gateway to ElevenLabs for speech-to-text. The returned transcript can be edited and submitted as planning input. We have disabled ElevenLabs' use of submitted data for model improvement. Provider processing and retention depend on the applicable service terms and workspace settings; we do not promise zero retention. You can type instead of recording audio.
• Google Maps Platform — static map images on public destination guides, and place search, place details, geocoding, and route calculations used by planning tools. Public guide images are requested directly by your browser from Google; the guide request contains only public destination data. App location requests send only the search text, coordinates, or route endpoints needed to provide the feature.
• OpenFreeMap — basemap tiles, labels, and map assets displayed in public journey views. These assets are requested directly by your browser using the visible map area; the secret share-link token is not sent with those requests.
• Google LLC (sign-in) — only if you choose “Continue with Google” to sign in. We request the openid email profile scopes solely to look up or create your Viamente account and to show your name and email in the app.
• Apple (sign-in) — if you choose Sign in with Apple, we receive your Apple account identifier and the name and email Apple provides, which may be a private relay address. We store available refresh tokens encrypted so we can revoke the authorization when you delete your account.
• Google LLC (connected calendars) — only if you separately connect Google Calendar. We request calendar.app.created, calendar.calendarlist.readonly, calendar.events.readonly, openid, and email. This lets Viamente create and manage its own secondary calendar, list calendars visible to the account, read bounded event windows, and identify the connected account. The read scopes do not let us change existing calendars. Selected Journey dates, titles, locations, notes, and Viamente links are sent to Google as private events. Disconnecting deletes the Viamente-created calendar and revokes the grant.
• Google Calendar and Google Meet (booking page) — only if you choose the 20-minute booking link. Google hosts the booking page and handles the appointment and any Meet details. This is separate from the optional calendar export above.
• LiteAPI, Duffel, and fulfilling travel suppliers — search requests include the itinerary, dates, occupancy or passenger ages needed to find offers. For a booking, we send the required traveler and contact details to the selected booking platform and fulfilling hotel or airline. Duffel also handles flight payment details through its embedded payment form; Viamente does not store card numbers. Providers keep records needed to deliver and account for reservations, even after you delete your Viamente account.
• Apple (App Store memberships) — memberships bought in the iOS app are paid through your Apple Account; Apple processes the payment and we never receive card details. Apple sends us signed purchase records, which we verify and use to provide membership access: Apple's subscription and transaction identifiers, the product bought, whether the purchase was made in Apple's test or live store, the subscription status, and its start and end dates. We link the subscription to your Viamente account and remove that link when you delete your account. Apple also notifies our servers of renewals, cancellations, refunds and billing problems. Apple keeps its own purchase records under its privacy policy.
• Google Play (Android memberships) — Google Play processes Android membership payments. When Play billing is available, Viamente verifies purchase tokens with Google and stores encrypted purchase tokens, product and base-plan identifiers, subscription state, and expiry to provide membership access and handle cancellation.
• Stripe, Inc. — payment processing for paid memberships. Checkout and the billing portal are Stripe-hosted pages; we store no card data ourselves. On our side we keep only a Stripe customer reference and your membership record: tier, subscription status, current allowance-period bounds, and the yearly price you locked in. Stripe holds the payment records, including invoices we are required to retain under Danish bookkeeping law.

• viamente_session — essential, HttpOnly, keeps you signed in.
• viamente_calendar_oauth_* — essential, HttpOnly, and kept for at most ten minutes while you complete the separate Google Calendar connection.
• ph_* — set by PostHog for analytics (see §4).
• intercom-* — cookies and local storage from earlier Intercom support conversations. The Messenger is currently inactive.
• vmt_marketing_attribution_v1 — first- and latest-touch campaign, referring-domain, landing-path, and device-type context in local storage. It expires 90 days after the last customer-page visit.

We do not set advertising cookies. Earlier Intercom support cookies or local storage may remain in browsers that used the Messenger. Visitors in the EU / EEA / UK / Switzerland see a banner explaining these practices. Accepting it stores a single acknowledgement in your browser's local storage.

Your journeys persist until you permanently erase them or delete your account. Cancellation or downgrade does not remove a retained journey: it remains readable and editable, and editing it does not create a new allowance entry. Journey erasure permanently removes its Viamente-owned structure, conversation, notes, files, and saved reservation copies. It cannot be undone and does not cancel a reservation held by an airline, hotel, or other provider.

Calendar connections and subscription tokens persist until you disconnect, revoke them, or delete your account. Personal Google event history is read live for the requested planning window and is not retained in Viamente's database or conversation history. Disconnecting Google Calendar deletes the dedicated Viamente calendar before revoking its grant; revoking a subscription URL makes that URL stop working immediately. Account deletion revokes stored Google Calendar access; it does not delete externally held calendar events. Copies already written into an external calendar are also held by that calendar provider. To ensure those copies are removed, use Disconnect before deleting your Viamente account, or delete them in the external calendar.

An unlisted journey link remains usable until its owner revokes it or the underlying journey or account is deleted. Revocation makes the public view unavailable immediately. The minimal share-link record and its revoked status remain with the journey until that journey is erased, so the same bearer link cannot become active again by accident.

Bug-report screenshots and diagnostic evidence are retained while the report is under review and are accessible only to Viamente administrators. Account deletion removes those screenshots and report evidence, deletes associated PostHog recordings, and removes replay links from retained roadmap records.

Account deletion requests removal of support profiles linked to your account from Intercom, including associated support data under Intercom's deletion controls. Provider-side removal can take longer than removal from Viamente. Intercom documents a seven-day recovery period; satisfaction ratings/comments and reporting records may remain and require separate review. Tell us about any anonymous or separately identified support conversations so we can locate and review them for erasure.

Delete your Viamente account

Without the app: use the contact form and write “Delete my Viamente account” in your message. Enter your account email address so we can verify the request. You do not need to reinstall the app or buy anything. We verify ownership before erasure; if you cannot access that email, contact us for help. Do not send passwords or identity documents. We respond within 30 days and explain any necessary delay or records that must be retained. You can also request deletion of specific data without closing your account.

In the app or on the website: sign in at Account, choose “Delete account”, and complete the three confirmation steps. We first email you a permanent record of what will be removed, including your flight and hotel reservation history. After you confirm that record, we send a separate six-digit deletion code. Use the contact form if you cannot use the self-service flow. Erasure normally completes within minutes and is retried automatically if a processor is unavailable. Your account is disabled after final confirmation. Pending cleanup keeps the records and encrypted credentials needed to retry; persistent failures are flagged for manual attention. Erasure removes:

• Your plans, messages, and profile context from our database;
• Your PostHog person profile and all associated events;
• Bug-report screenshots, evidence, and session recordings;
• Any session, magic-link, or API tokens tied to your account;
• Your account record after the cleanup above, plus linked Intercom support profiles and stored calendar and Apple authorizations where tokens are available.

What survives an erasure. We do not retain a hidden identifier to carry journey usage into a later account. For memberships purchased through Google Play when available, we retain an unlinked hash of the purchase token after account deletion solely to prevent the same purchase being claimed by another account. The original token, account link, and purchase metadata are removed; this hash does not carry journey usage into a later account. For memberships purchased through Apple's App Store, our record linking the subscription to your account is deleted with the account; deleting your account does not cancel the subscription with Apple, which you manage in your Apple Account settings. Records we are legally required to keep — such as invoices under Danish bookkeeping law, held at our payment processor — are retained for their statutory period. External booking providers separately keep the records they need to deliver and account for reservations.

Account deletion ends a paid membership immediately. It does not cancel hotel or flight reservations: the booking platform, hotel, airline, and other fulfilling suppliers retain the records they need to deliver and account for those services. The first deletion email is your copy of their confirmation details before Viamente removes its local booking records.

Logging out calls posthog.reset() so subsequent activity on the same browser is not associated with your account.

Under the GDPR and equivalent data-protection laws, you have the right to access, rectify, erase, restrict the processing of, port, and object to the processing of your personal data. Use our contact form and we will respond within 30 days. You also have the right to lodge a complaint with your local data-protection supervisory authority.

Viamente accounts are for adults aged 18 and over. Children must not create an account. Adults may add child travelers when planning a family journey, including names, ages or dates of birth, relationships, and travel or booking details. The adult must be authorized to provide these details and should only enter what is needed. Child traveler information is processed for the same planning and booking purposes and can be removed through the adult's account or an erasure request. Contact us if a child has created an account.

Cloudflare, PostHog, Google, Apple, ElevenLabs, and Intercom are US-headquartered companies. We use EU infrastructure where the configured service supports it; Vertex AI requests may be processed outside the EEA. Earlier Intercom support conversations and user-attached files may have been processed and stored in its US data region. Where transfers outside the EEA occur, they rely on the EU Standard Contractual Clauses or an equivalent transfer mechanism.

We will update this page when our practices change. Material changes will re-prompt the cookie notice in your browser so you see them on your next visit.