Privacy Policy

The controller responsible for data processing on this website is: WhyNot Digital Marcel Gorgolewski und Tobias Meyer GbR Graf-Bernhard-Ring 19A 21481 Lauenburg Germany Email: info@homeiswhereyourbagis.com Privacy contact: info@homeiswhereyourbagis.com Website: https://triplio.co

No data protection officer has been appointed because there is no legal obligation to do so.

We process personal data only to the extent necessary to operate this website, provide our features, secure the application, communicate with users, or based on consent.

The legal bases include Art. 6(1)(b) GDPR for account and feature use, Art. 6(1)(f) GDPR for legitimate interests such as security, troubleshooting and abuse prevention, and Art. 6(1)(a) GDPR for consent-based services such as analytics cookies, external media or marketing.

This website is hosted by ALL-INKL.COM - Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. We have concluded a data processing agreement with the hosting provider.

When you access the website, the server processes technically necessary data, including IP address, date and time of access, requested URL, referrer URL, browser type, operating system, user agent and transferred data volume. This data is required to deliver the website, ensure stability and security, and analyze errors. The retention period depends on the technical and security requirements of the hosting; log data is not stored longer than necessary for these purposes.

This website is provided via SSL/TLS encryption. You can recognize an encrypted connection by “https://” in your browser address bar. This helps protect data transmitted to us from being read by third parties during transmission.

We use cookies and similar technologies. Some cookies are technically necessary; others are only set or loaded after your consent. Your selection is stored in the cookie “triplio_cookie_consent” for up to 180 days.

Currently relevant cookies and similar technologies: - Session/security cookies: technically required for login, session handling, CSRF protection and form security; sessions expire by default after 120 minutes of inactivity. - “triplio_cookie_consent”: stores your cookie choice for up to 180 days. - “route_rating_visitor_id”: optional anonymous visitor identifier for route ratings, only after consent to Functional, lifetime up to 365 days. - Google Analytics 4: only after consent to Analytics. - External map service (Google Maps or Geoapify): only after consent to External media or actively loading the map. - Stay22 LetMeAllez/Nova: third-party script, cookies, local storage technologies, identifiers and similar tracking or fingerprinting technologies only after consent to Marketing.

Consent management is implemented as a custom-built solution. Non-essential scripts are technically blocked until the corresponding consent has been granted.

You can change your cookie selection at any time via “Cookie settings” in the footer.

For an account, we store your first name, email address, email verification timestamp and technical account data. Login is available via magic link or optionally through your Google account. Magic link tokens are stored only in hashed form, are valid for 15 minutes and are regularly deleted after expiry.

If you use Google Login, authentication is handled through Google OAuth/OpenID Connect. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We receive in particular your Google account ID, name or first name, email address, email verification status and, where available, your profile picture. In Triplio, we store the Google account ID, the profile image URL if available, and the time the Google account was connected. We do not store Google access or refresh tokens and do not access other Google services such as Drive, Gmail or Calendar.

We use SMTP via ALL-INKL to send magic links and verification or double opt-in emails. The data required for email delivery is processed, including email address, email content and technical delivery data.

You can delete your account. Your account data will then be deleted unless statutory retention obligations apply. Publicly created itineraries and city trips may continue to exist because they are not intended to publish personal data.

Generated itineraries and city trips contain travel parameters such as country or city, duration, month, budget, pace, travel style and interests. These trips are publicly visible and are not intended to contain personal data. In the database, they may be assigned to an account for management purposes; first name and email address are not displayed publicly.

If you save favorites, this relation is stored with your account. If you use private notes for an itinerary or city trip, those notes are stored in your account and are not publicly displayed. Please do not enter sensitive personal data there.

For itinerary and city trip ratings, we store the rating. For logged-in users, the rating may be assigned to the account. For guests, hash values derived from technical identifiers such as visitor ID, IP address or user agent may be used to limit duplicate ratings. The underlying values are not stored in plain text as part of the rating.

In the code, IP address and user agent are stored only as hash values for ratings. Technical sessions may contain IP address and user agent during session handling; server log files may be created technically by the hosting provider.

We use the OpenAI API to automatically generate itineraries and city trips. For users in the European Economic Area, the provider under OpenAI’s terms is OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland.

For trip generation, the selected travel parameters and the context required for generation are transmitted to OpenAI. There are no free-text fields where you need to enter personal data. Please nevertheless avoid entering personal data into travel parameters.

We use the OpenAI API with response storage disabled where technically possible (“store=false”). In the system, this is intended for itinerary and city trip generation as well as the related trip chats. According to OpenAI, API content is not used for training unless this is explicitly enabled. OpenAI may also process data for abuse and security monitoring for a limited time, currently by default up to 30 days.

A data processing agreement or Data Processing Addendum with OpenAI will be concluded.

Logged-in users can use an AI chat for an itinerary or city trip. Your chat message, a limited amount of recent chat history and the context of the respective trip are transmitted to OpenAI to generate the answer.

Chat messages and answers are stored in your account for the respective trip so the conversation can be displayed and continued. You can delete the chat history yourself via the “Clear chat history” function. In addition, we regularly delete stored chat messages within 180 days.

Please do not enter sensitive or unnecessary personal data in the chat. We do not automatically block personal data.

Where Google Analytics 4 is integrated now or in the future, we use it for audience measurement only if you consent to the “Analytics” category in the cookie banner. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The Google Analytics property or measurement ID is: G-8WLQKJRZKY.

Google Analytics 4 processes usage data such as page views, interactions, technical browser and device data, and approximate location data. According to Google, Google Analytics 4 does not log or store IP addresses; IP data from EU users is discarded before storage. We do not use Google Signals, remarketing or demographic advertising features.

The data retention period in Google Analytics will be set to 14 months where this setting is available. The legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw your consent at any time via the cookie settings.

If Google Tag Manager is used, it serves to technically manage website tags. Tags for analytics or external services are only triggered according to your cookie selection.

Depending on the active technical configuration, itinerary and city trip pages may include an interactive map from Google Maps (Google Ireland Limited) or Geoapify (KEPTAGO LTD, Paphos, Cyprus). The browser map is only loaded after you consent to the “External media” category or actively load the map.

To prepare the map feature, itinerary stops and city trip places may be converted into coordinates server-side via the Google Maps Geocoding API or the Geoapify Geocoding API. Under the current implementation, only place/country information from the trip and technical server data are transmitted to the selected map provider, not your email address or first name.

When the interactive map is loaded in your browser, personal data such as IP address, browser data, device information and location/map usage data may be transferred to the selected map provider and its technical service providers. The legal basis for loading the map is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. The legal basis for server-side geocoding is our legitimate interest in a functional route display under Art. 6(1)(f) GDPR.

Our website contains partner links, including links to Booking.com and Stay22. These links are marked as advertising or affiliate links where they appear in context.

For accommodation recommendations, we generate ordinary external affiliate links server-side through Stay22 Allez. The provider is Stay22 Technologies Inc., 917 Mont-Royal Ave E, Montreal, Québec H2J 1X3, Canada. Without Marketing consent, merely viewing a page does not load a Stay22 script or establish a connection to Stay22. The visible accommodation links remain available regardless of your Marketing choice.

If you click such a link, you will be redirected through Stay22 or directly to a participating booking provider such as Booking.com. From that point onward, Stay22, the respective booking provider or participating partners may process technical data such as IP address, browser and device data, viewed page, referrer, link clicks, location inferences, language/currency information and affiliate or campaign parameters, set cookies or use similar technologies. The legal basis for linking and marking these links is our legitimate interest in financing and improving our service under Art. 6(1)(f) GDPR. Where providers use cookies or tracking technologies after the click, those providers are responsible for their respective processing.

Only if you consent to the “Marketing and personalized hotel offers” category and visit the homepage or another enabled public travel, country, itinerary or city trip page do we load the Stay22 LetMeAllez script with the Nova feature from scripts.stay22.com. The script is not loaded on login, registration, account, billing, administration or legal pages.

Once enabled, Stay22 may process in particular the page URL, referrer, page title and page content, detected destinations and travel dates, clicks and other interactions, IP address, approximate location information, and browser, device, operating-system, language and screen characteristics. The script may use cookies, Local Storage, Session Storage, identifiers and fingerprinting characteristics. Its purposes include detecting travel and booking intent, personalizing and optimizing affiliate links and hotel offers, attributing clicks and bookings, measuring reach and performance, and limiting how often offers are shown.

After an interaction assessed as relevant, Nova may automatically open a hotel or booking offer in another browser tab while continuing the original page or navigation content in a different tab. This feature is part of your Marketing consent and is not activated without that consent.

The legal bases for loading the script, accessing your device and subsequent processing are your consent under § 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future through “Cookie settings”. Following withdrawal, a page on which the Stay22 script is already active is reloaded so that no further script actions take place. Processing carried out before withdrawal remains lawful.

Stay22 processes data in Canada and may use technical service providers in other countries. Information on processing, recipients, retention, international transfers and your data subject rights is available at https://www.stay22.com/privacy and https://www.stay22.com/cookies.

The share function uses normal links or a copy function. Merely viewing the page does not transmit data to social networks. If you actively click a share link, for example to WhatsApp, Telegram, Facebook or email, the respective service or your email program opens; from that point onward, the privacy terms of the respective provider apply.

Itinerary and city trip pages may show Pinterest pin images served locally by Triplio and a link for saving them on Pinterest. Merely loading the trip page does not establish a connection to Pinterest. Pinterest opens only after you actively click the “Save to Pinterest” button. The trip URL and the URL of the selected image are then passed to Pinterest; from that point onward, Pinterest may process in particular your IP address as well as browser and device data and may use its own cookies or similar technologies. For users in the European Economic Area, Pinterest Europe Ltd., Waterloo Exchange, 3rd Floor, Waterloo Road, Dublin 4, Ireland, and Pinterest, Inc., 651 Brannan St., San Francisco, CA 94107, USA, are joint controllers of the data processing. The link is provided on the basis of our legitimate interest in enabling the voluntary sharing of our travel content under Art. 6(1)(f) GDPR.

The web fonts used by this website are hosted locally. No connection to Google Fonts is established when loading these fonts.

Some static media, such as logos or images, may be loaded through Bunny.net/BunnyCDN domains or related blog/media domains such as homeiswhereyourbagis.com. Technically necessary access data such as your IP address may be transmitted to the respective provider. Where possible, we reduce external media to what is necessary.

Under the GDPR, you have in particular the right of access, rectification, erasure, restriction of processing, data portability and objection to certain processing activities. Where processing is based on consent, you can withdraw that consent at any time with effect for the future.

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority may be the authority of your place of residence, workplace or the place of the alleged infringement.

This privacy policy will be updated when features, service providers or legal requirements change. Last updated: August 26, 2026.