Privacy policy
Product: Vanari, a motorhome travel-planning app and website (vanari.ie).
1. Data controller
Cuandeoro Ltd, CRO 813028, 17 Green Acre Court, Templeogue, Dublin, D16 PF54, Ireland. Data protection contact: privacy@vanari.ie.
2. Data we process
- Account and session. Email address and password to log in, and a session cookie that keeps you logged in and protects access. Your password is handled by Firebase Authentication (Google) and our server does not store it. The session lasts 30 days.
- Pre-trip form. Vehicle details, origin, destination and route, number of travellers and children, pets, budget, dates, departure and arrival times and connectivity preferences. You enter them yourself to generate your notebook.
- Location and routes. Only with your consent and for planning and navigation features. You can withdraw the permission in your device settings.
- Voice ("Talk to her" feature). When you turn it on, you can speak or type. If you speak, the audio is sent to Google Gemini, which understands it and prepares the reply in the same request; the audio is neither stored nor written to our logs. The reply is turned into speech with Google Text-to-Speech and, if that fails, with a Microsoft voice (edge-tts); both receive only the text of the reply.
- eSIM and satellite wifi orders. Name, email, delivery or activation details and order details.
- Subscription. Payment for Vanari+ and Founder is handled through Google Play (and, on iPhone, the App Store). Cuandeoro Ltd does not receive your card details.
- Technical data. IP address and activity logs for security and diagnostics.
We do not need special categories of data (health, beliefs, religion). Please do not mention them to the voice assistant or in the forms.
3. Purposes and legal basis
| Purpose | Basis (GDPR) |
|---|---|
| Providing the planning service and managing your account | Performance of a contract (Art. 6(1)(b)) |
| Voice feature | Explicit consent when you turn it on (Art. 6(1)(a)) |
| Precise location | Consent (Art. 6(1)(a)), which can be withdrawn |
| Managing subscriptions, orders and tax obligations | Contract and legal obligation (Art. 6(1)(b) and 6(1)(c)) |
| Security, fraud prevention and technical improvement | Legitimate interest (Art. 6(1)(f)) |
| Commercial communications | Consent (Art. 6(1)(a)), which can be withdrawn |
4. Recipients and processors
Third parties that receive data so that each feature works. Google and Brevo act under a data processing agreement (Art. 28 GDPR):
- Google (Gemini): understands what you say or type to the assistant and writes the reply; it receives your text or audio and the parts of your trip it needs.
- Google (Text-to-Speech): turns the reply into speech; it receives the text of the reply.
- Microsoft (edge-tts): backup voice if Google's fails; it receives the text of the reply.
- Google (Firebase Authentication): login; it receives your email address and password.
- HERE: route calculation, place search and map; it receives coordinates and names of origin, destination and stops.
- OpenStreetMap (Nominatim and Overpass), OSRM and OpenRouteService (HeiGIT gGmbH, Germany): place search, nearby services and backup routing; they receive place names and coordinates, not your name or email.
- Open-Meteo, MET Norway and NASA POWER: weather and climate along your route; they receive coordinates and dates.
- Meteoalarm: official weather warnings by country; we only download the country's warning, it receives no data about you.
- Brevo: sending service emails; it receives your email address.
- Google Play (and App Store): subscription payment, as the store's seller.
- Public authorities where there is a legal obligation.
We do not sell your data or pass it to third parties for advertising purposes.
5. International transfers
Google, Microsoft and Brevo may process data outside the European Economic Area, in particular in the United States. The transfer relies on European Commission adequacy decisions, including the EU-US Data Privacy Framework where the provider is certified, or on standard contractual clauses with supplementary measures.
6. Retention periods
- Travel notebook: 7 days from the last time you open or edit it; it is then deleted automatically. You can download the PDF and GPX file beforehand.
- Pre-trip form: 12 months from submission, on the basis of legitimate interest (understanding request patterns and correcting errors). You can ask for it to be deleted or object to it.
- Account: until you ask for it to be deleted, with a maximum of 24 months of inactivity.
- Voice: we do not store the audio or what you say or type to the assistant; we only note that you used the feature, to apply the daily limits.
- Orders and invoicing: the period required by tax law.
- Technical logs: 12 months.
7. Shared roadbook
If you share the link to your notebook, anyone who receives it will see the route, the dates and the budget. Sharing is your decision.
8. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw your consent at any time, at privacy@vanari.ie or through Delete my data. You can lodge a complaint with the supervisory authority; as Cuandeoro Ltd is an Irish entity, this is the Data Protection Commission (DPC) of Ireland.
9. Voice and audio
Your voice is captured only if you turn on "Talk to her", which is available on Vanari+ and Founder. Consent is given when you turn it on and you can turn it off whenever you like: if you do not turn it on, no audio is captured. Your voice and its transcript are not used to train artificial intelligence models.
10. Automated decisions
AI recommendations are aids to your own decision and have no legal effect on you. You always stay in control of your trip.
11. Children
Vanari is not aimed at children. The account must belong to an adult. The number of children is only a piece of information about the travelling party.
12. Changes
If we change this policy in a material way, we will tell you before it takes effect.