Product: Vanari — motorhome travel planning application (web and mobile app), domain vanari.ie. Last updated: 14 July 2026
1. Data controller
Cuandeoro Ltd, CRO 813028, with registered office in Dublin (Ireland), is the controller of the personal data collected through Vanari.
- Data protection contact:
privacy@cuandeoro.ie. - Owner of the Vanari service: Cuandeoro Ltd.
2. Data we process
Vanari processes the following categories of data, mostly provided directly by the user:
- Pre-trip form data (planning): vehicle/motorhome data, origin, destination and route, number of people and children travelling, pets, budget, trip dates, day and time of departure and arrival, and connectivity/eSIM preferences. These are data that the user enters voluntarily so that the application can generate their plan.
- Contact and account data: email address (waiting list, registration and future access/login system).
- Location and routes: the user's location and travel routes, used to provide the planning and navigation functions. Precise location is only processed with the user's consent and can be disabled from the device settings.
- Voice and audio (data sensitive by its nature — see section 9): when the user uses the voice assistant, the browser captures their voice. Speech-to-text transcription is performed by the user's own browser via the Web Speech API; in Chromium-based browsers (such as Chrome), that audio is processed by Google. Vanari does not receive or store the audio. The resulting text is processed with artificial intelligence models to generate the response, which may be converted into voice via external text-to-speech (TTS) providers (see sections 4 and 9).
- Technical data: IP address, activity records (logs) and identifiers derived from cookies and equivalent technologies (see Cookie Policy).
We do not request or need special categories of data under Article 9 GDPR to provide the service. We ask the user not to provide health, ideology, religion or other sensitive data to the voice assistant or in the forms (see section 9 on the processing of voice).
3. Purposes and legal basis
- Providing the travel planning service (processing the pre-trip form, generating routes, offering recommendations) → performance of a contract / pre-contractual measures (Article 6(1)(b) GDPR).
- Managing the waiting list, registration and access (login) → performance of a contract (Article 6(1)(b)) and, for the waiting list prior to sign-up, consent (Article 6(1)(a)).
- Voice assistant (capture and processing of audio, transcription and AI response) → the user's explicit consent (Article 6(1)(a)), given when the voice function is activated. Without that consent the voice assistant is not activated.
- Processing of precise location and routes → consent (Article 6(1)(a)), revocable from the device settings, or performance of a contract where it is essential for the requested function.
- Security, fraud prevention, diagnostics and technical improvement of the service → legitimate interest (Article 6(1)(f)).
- Commercial communications and product news → consent (Article 6(1)(a)), revocable at any time.
4. Recipients and processors
To provide the service, Vanari discloses data, with the safeguards of Article 28 GDPR (data processing agreement), to the following processors and third parties:
- Cloud artificial intelligence engine: Google (Gemini / Vertex AI), for natural language processing and the generation of the assistant's responses.
- Voice synthesis (TTS, text→voice): ElevenLabs, Inc. (USA) as the primary provider and Microsoft (
edge-tts service) as an alternative, to convert the assistant's responses into voice. The text of the response is transmitted to them. As this involves processing outside the EEA, the transfer is covered by Standard Contractual Clauses (SCCs) (see section 6). - Voice transcription (STT, voice→text): performed by the user's browser via the Web Speech API; in Chromium-based browsers (Chrome) the audio is processed by Google. Vanari does not take part in that transcription nor store the audio.
- Route calculation and geocoding: to trace the trip route and convert place names into coordinates, Vanari discloses the origin and destination coordinates and the place names to the following providers, all of which process data in the European Union / EEA (they do not require Standard Contractual Clauses):
- OpenRouteService, operated by HeiGIT gGmbH (Heidelberg, Germany): calculation of the safe route for the vehicle. It receives the origin and destination coordinates.
- OSRM (
project-osrm.org): fallback routing when the primary provider is unavailable. It receives the same coordinates. - Nominatim / OpenStreetMap: geocoding and reverse geocoding of the trip's places (name ↔ coordinates).
- Email provider: Brevo (Sendinblue), for sending waiting list, registration and communication emails.
- Public authorities where there is a legal obligation.
We do not sell or transfer personal data to third parties for advertising purposes.
5. Processing of location and routes
Location is used solely for the planning, route calculation and geographical recommendation functions. The user may grant or revoke the location permission at any time from their device's operating system settings. Revocation may limit functions of the application, but does not prevent its general use.
The generated roadbook is hosted at a web address with a non-guessable link. If the user decides to share that link (/r/...), its content —route, dates, budget and other trip data— becomes accessible to anyone who receives the link. Sharing is a voluntary action of the user.
6. International transfers
The cloud AI engine (Google Gemini / Vertex AI), the voice synthesis provider ElevenLabs, Inc. (USA), Microsoft (edge-tts) and, in browser voice transcription, Google, as well as, where applicable, the email provider (Brevo), may process data outside the European Economic Area (EEA), in particular in the United States. In such cases, the transfer is covered by:
- adequacy decisions of the European Commission, including the EU-US Data Privacy Framework where the provider is certified; or
- the EU Standard Contractual Clauses (SCCs), together with the supplementary technical and organisational measures as appropriate.
The specific list of processors and the location of their processing are detailed in Cuandeoro Ltd's record of processing activities.
7. Retention periods
- Pre-trip form and account data: retained until the user requests its erasure, with a maximum of 24 months of inactivity, after which it is erased; without prejudice to the applicable legal periods for as long as the user maintains the relationship with the service.
- Email (waiting list): until the user unsubscribes or withdraws consent.
- Voice audio: see section 9. Vanari does not receive or store the voice audio: transcription is performed by the user's browser and Vanari only processes the resulting text.
- Location and routes: retained for the time necessary to provide the requested function and to compile the user's trip history, if the user activates it.
- Technical logs: retained for 12 months for security and diagnostics.
8. Rights
The data subject may exercise their rights of access, rectification, erasure, objection, restriction and portability, as well as withdraw consent at any time (without retroactive effect), by writing to privacy@cuandeoro.ie.
They may also lodge a complaint with the supervisory authority. As Cuandeoro Ltd is an Irish entity, the lead authority is the Irish Data Protection Commission (DPC) (GDPR one-stop-shop mechanism).
9. Processing of voice and audio (detail)
This section details Vanari's most sensitive processing.
- What is captured: when the user activates the voice assistant, the browser captures the audio of their voice while they speak to the assistant.
- How it is processed: the voice-to-text conversion is performed by the user's browser via the Web Speech API (in Chromium-based browsers, such as Chrome, the audio is processed by Google); Vanari does not receive or store the audio. The text is sent to the AI engine (Google Gemini / Vertex AI) to generate a response, which may be returned by voice via external text-to-speech (TTS) providers: ElevenLabs, Inc. (USA) and, as an alternative, Microsoft (edge-tts). These transfers to the USA are covered by Standard Contractual Clauses (SCCs) — see section 6.
- Legal basis: explicit consent (Article 6(1)(a)), given when the function is activated. The user may disable the voice assistant at any time; if it is not activated, no audio is captured or processed.
- What is stored and what is not: the audio is not retained: Vanari does not receive it —it is transcribed by the user's own browser— and does not store it at any time. The text transcription is ephemeral: it is processed only during the ongoing conversation or the generation of the roadbook and is then discarded; no history of the voice conversations is retained. Voice and its transcription are not used to train or retrain artificial intelligence models.
- Special categories (Article 9 GDPR): voice, by its content, could contain special personal data if the user verbalises it (health, beliefs, etc.). Vanari does not seek to process special categories and asks the user not to provide them. If, notwithstanding, the user voluntarily communicates them, the processing is covered by their explicit consent (Article 9(2)(a)) and reinforced minimisation and deletion safeguards apply.
10. Automated decision-making (Article 22 GDPR)
The recommendations and plans generated by Vanari's AI are suggestions to support the user's decision and do not produce legal effects or significantly affect them in a similar way; the user always retains control of their trip. To the extent that any automated decision with significant effects exists, the data subject has the right to human intervention, to express their point of view and to contest the decision (Article 22 GDPR).
11. Minors
The pre-trip form may include the number of children travelling as group data, but Vanari is not directed at minors nor does it create profiles of them. The account must be held by an adult.
12. Changes to this policy
Cuandeoro Ltd may update this policy. Substantial changes will be communicated through the usual channels of the service before they take effect.
LOCATION ON THE WEBSITE
Footer of vanari.ie, permanent link /privacidad. It must also be linked in: the pre-trip form, the waiting list sign-up / registration, and at the moment of activating the voice assistant (layered information + collection of the explicit voice consent).