Last updated 23 August 2026
Vayako cares about protecting your data. This policy explains what data we collect, why, who it is shared with and what your rights are, in line with the General Data Protection Regulation (GDPR).
The publisher of the Vayako app is Julien Casino, Avinguda del Ensegur, Casa C7, Bloc 2, Arans, AD300 Ordino, Andorra, NRT F370721G.
For any question about your data: [email protected].
Account identifier: when you open the app, an account is created automatically (an anonymous “guest” account) to save your trips and preferences. No email address or name is required.
Travel preferences: your first name (if you give it), styles, pace, budget and the notes you share with the Vayako concierge, to personalise your itineraries.
Conversations: the messages exchanged with the concierge and the itineraries generated.
Approximate location: only if you turn on “Near you” or navigation, to show places around you. It is not kept for advertising purposes.
Technical data: the minimum information needed for the app to work (app language, display preferences).
Providing the service (creating and saving your itineraries, keeping your trips): performance of the service, and legitimate interest.
Personalising your recommendations based on your preferences: your consent, which you can withdraw at any time.
Showing nearby places: your consent to location access, which you can withdraw in your phone’s settings.
We do not sell your data. It is processed by technical service providers acting on our behalf:
Supabase (database hosting and authentication), within the European Union.
Anthropic (the Claude AI model), to generate your itineraries from your preferences and messages.
Mapbox and OpenFreeMap (base maps): displaying a map means downloading its tiles, which sends these services your IP address and the area you are looking at.
unpkg and flagcdn (delivery of the mapping library and of country flags): the same technical data – your IP address only.
When you open a place in Google Maps or Apple Maps, it is your phone that contacts that service, at your request, outside Vayako.
These providers are required to ensure an equivalent level of protection. Where data is transferred outside the EU, the transfer is covered by appropriate safeguards (standard contractual clauses).
Your data is kept for as long as your account exists. You can delete your account and all your data at any time from Profile → Delete my account: deletion is immediate and permanent.
Under the GDPR, you have the right to access, rectify and erase your data, the right to data portability, the right to restrict processing and the right to object, as well as the right to withdraw your consent.
Erasure: Profile → Delete my account (immediate, permanent deletion).
Portability: write to [email protected] and we will send you your data within 30 days, as the GDPR provides. Self-service export from the app will follow.
To exercise your other rights or ask a question: [email protected].
You can also lodge a complaint with the data protection authority in your country of residence – in the United Kingdom the ICO (ico.org.uk), in Spain the AEPD (www.aepd.es), in Italy the Garante per la protezione dei dati personali (www.garanteprivacy.it), in Germany the authority for your Land (www.bfdi.bund.de), in France the CNIL (www.cnil.fr), in Andorra the APDA (www.apda.ad).
Data is encrypted in transit and stored on secure infrastructure. Access is restricted to the processing the service needs.
Vayako is aimed at adults and is not intended for anyone under 16. We do not knowingly collect data about minors.
This policy may change. The date of the last update is shown at the top. If there is a significant change, we will let you know in the app.
This policy is written in French. Versions in other languages are provided for your convenience. If the versions differ, the French version prevails.