Privacy Policy
This notice explains what personal data Sybilla Travel collects, why, who we share it with and what you can do about it. It is written to be read, not to be survived.
1.Who is responsible
The data controller is Filippo Leonelli, acting as a natural person. Sybilla Travel is currently a private, invitation-only beta provided free of charge.
For any request about your data, write to privacy@sybilla.app. Our full postal address is available on request to any data subject who asks for it, and to any supervisory authority. We have not appointed a Data Protection Officer, as we are not required to.
2.What we collect and why
We only process what the Service needs in order to work. The table below is the complete picture.
| Data | Why | Legal basis |
|---|---|---|
| Name, email address and account identifier from your Google sign-in | To create your account, identify you and let others share projects with you | Performance of the contract |
| Your projects: places, notes, itineraries, icons, images you upload | To provide the core function of the Service and to sync your work across devices | Performance of the contract |
| Messages you send to the AI assistant | To generate the itineraries and answers you ask for | Performance of the contract |
| Searches for places and addresses | To find locations and calculate routes on the map | Performance of the contract |
| Usage limits and credit balance | To keep the running costs of the beta under control and prevent abuse | Performance of the contract |
| Date of your last access, technical logs | To keep the Service secure, diagnose faults and prevent abuse | Our legitimate interest in a working, secure service |
| Record of your consent: date, document version, IP address, browser | To prove that consent was given or withdrawn, as the law requires us to | Legal obligation |
| Your email address, if you opt in to marketing | To send you product news and offers | Your consent — optional, revocable at any time |
Only marketing is based on consent. Everything else is what the Service needs to exist. Turning marketing off — or never turning it on — changes nothing about your account or the features available to you. As things stand we send no marketing at all: the switch records your preference for the day we do, and if we ever use an external service to send those emails, we will name it here first.
3.The AI assistant, and where your words go
When you use the assistant, the text of your request and the relevant parts of your project are sent to OpenRouter, which processes them on our behalf and routes them to the language model that produces the answer. The model we currently use is DeepSeek, developed and operated by a company based in the People's Republic of China.
Your prompts are processed in China. China is not covered by a European Commission adequacy decision, and its legal framework may allow public authorities to access data held by companies subject to its jurisdiction, on terms that differ from those of European law. We want you to know this plainly before you type anything into the assistant.
We have put in place the following measures to limit what that transfer exposes:
- No identity travels with your request. We do not send your name, email address, account identifier or any other identifier to OpenRouter or to the model. The request contains only the conversation and the parts of the project needed to answer it.
- No training on your data. Our OpenRouter account is configured to exclude providers that reserve the right to train on submitted data.
- Contractual safeguards. The transfer is governed by our data processing terms with OpenRouter, which incorporate the European Commission's Standard Contractual Clauses and bind the providers it routes to.
- The assistant is optional. Every other feature — maps, places, notes, images, KMZ export — works without it. If you would rather no content of yours ever left the European Economic Area, simply do not use the assistant.
Because the assistant is used only on your initiative and can be avoided entirely, choosing to send a request is also your informed and explicit agreement to that specific transfer.
What you write to the assistant leaves our systems. That is how it produces an answer. Avoid putting into a prompt anything you would not want processed abroad — passport or document numbers, health details, payment data, or other people's personal information.
If we change the model or the provider we rely on, we will update this notice and tell you before the change takes effect, as described in section 12.
4.Places, maps and location
Sybilla Travel does not track your device location in the background. Addresses and place names you search for are sent to our mapping provider to be resolved into coordinates and routes.
Bear in mind that the places you save can say a lot about you — where you go, when, and with whom. Treat a project as you would a travel diary, and think twice before sharing a link to one publicly.
The mobile app requests no location, camera or photo-library permission: it only needs network access.
5.Images you upload
Photographs carry more than what is visible in them. A picture taken with a phone normally embeds the exact GPS coordinates of the place it was taken, the date and time, and the device used.
When you upload an image, we strip this embedded metadata before storing it, so that the coordinates and timestamps of your photographs are not retained or passed on. The picture keeps the position you give it on the map, and nothing more.
Uploaded images are stored privately: they are never publicly accessible by URL, and can only be retrieved through short-lived signed links issued to people who have access to the project.
6.Who else processes your data
We rely on a small number of providers, each acting as a processor on our instructions and bound by a data processing agreement. Where data leaves the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses. One of these providers is located in a country without an adequacy decision; section 3 explains which, why, and what you can do about it.
| Provider | What it handles | Where |
|---|---|---|
| Google (Firebase Authentication) | Sign-in and account identity | EU / United States |
| Cloudflare | Hosting, application database, content delivery | EU / global network |
| Cloudinary | Storage and delivery of the images you upload | EU / United States |
| MapTiler | Map tiles, address lookup and routing | EU / Switzerland |
| OpenRouter | Routing of assistant requests to the language model | United States |
| DeepSeek | The language model that generates itineraries and assistant replies | China — see section 3 |
We do not sell your personal data, and we do not share it with third parties for their own marketing purposes. We may disclose data where the law requires it, or to establish or defend a legal claim.
7.How long we keep it
- Account and projects — for as long as your account exists.
- After you delete your account — your projects, images, conversations and itineraries are removed within 30 days. This grace period exists so that an accidental or unauthorised deletion can still be undone; after it, removal is final and we cannot recover anything.
- Consent records — kept after deletion for as long as needed to demonstrate that consent was validly obtained or withdrawn, and in any case no longer than the applicable limitation period.
- Security and technical logs — 12 months, then deleted.
- Accounting records — none. The Service is free of charge, so we hold no payment or billing data about you.
Where we must keep a record but no longer need to identify you, we remove or anonymise the personal data it contains.
8.Your rights
Under the GDPR you can ask us to:
- Access the personal data we hold about you, and receive a copy;
- Correct data that is inaccurate or incomplete;
- Delete your data, by closing your account or by asking us;
- Restrict or object to processing based on our legitimate interest;
- Receive your data in a portable, machine-readable format;
- Withdraw consent to marketing at any time, without giving a reason and without any consequence for your account.
Marketing: one switch, no questions. Open your profile, go to Privacy & legal and turn off email marketing. It takes effect immediately. Withdrawing consent does not affect the lawfulness of what we sent before.
To exercise any of these rights, write to privacy@sybilla.app. We will reply within one month. If you believe we have mishandled your data, you can lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali, or with the authority of the country where you live.
9.Cookies and local storage
Sybilla Travel does not use advertising or analytics cookies, and does not profile you.
We store data on your device only to make the Service work: your sign-in session, so you are not asked to log in on every visit, and a local copy of your projects, so the map keeps working when the connection drops. This is strictly necessary for a service you asked for, which is why you are not shown a cookie banner. Clearing your browser storage removes it and signs you out.
10.Security
Data is transmitted over encrypted connections and stored on infrastructure operated by the providers listed above. Access to production data is limited to the people who need it to operate the Service. No system is perfectly secure: if a breach occurs that is likely to put your rights at risk, we will inform you and the supervisory authority as required by law.
11.Children
The Service is not intended for children under 14. We do not knowingly collect their data. If you believe a child has created an account, write to us and we will delete it.
12.Changes to this notice
We may update this notice, for example when we add a feature or change provider. Every version has its own date and remains available at a permanent address.
If a change is significant — a new purpose, a new category of recipient — we will tell you inside the app or by email before it takes effect. If a new purpose requires your consent, we will ask for it separately and specifically: silence is never taken as agreement.