The controller within the meaning of the General Data Protection Regulation (GDPR), the Swiss Data Protection Act (DSG) and other data protection regulations is:
Joseph Duncan
Main Street 24
8280 Kreuzlingen
Switzerland
Email: privacy@vakantio.de
Website: https://vakantio.de
A separate data protection officer is not legally required. Inquiries regarding this statement or the exercise of the rights mentioned in point 15 should be directed to the email address provided above.
This statement applies to the Vakantio platform ( vakantio.de , all subdomains, mobile apps for iOS and Android) and describes which personal data we process, for what purpose, on what legal basis, how long we store it and to which recipients it is transferred.
Vakantio is a travel journal and blog service. We process:
The publicly accessible content can be used without registration and therefore without providing personal data, apart from the technical access data described under point 4 .
We use the terms of the GDPR. In particular:
Each time the platform is accessed, technical data is processed that the user's browser or app automatically transmits:
We process this data on the basis of our legitimate interest (Art. 6 para. 1 lit. f GDPR) for the delivery of the platform, to ensure stable operation, to prevent misuse and to defend against attacks.
Storage period: maximum 30 days; aggregated, non-personally identifiable statistics longer.
Hosting is provided by DigitalOcean LLC (a US-based company, servers located in Frankfurt am Main). No data is transferred to the USA during the server hosting process itself; data processing is contractually secured via a data processing agreement (DPA) in accordance with Article 28 of the GDPR.
Depending on the chosen registration method, we process the following during registration:
In addition, we store the date of registration, the last used login method, the time of the last login and — for the purpose of preventing misuse and securing evidence in case of dispute — the IP address during the login and registration process.
When logging in via email, we generate a one-time use, time-limited login token and send it to the registered email address via the email service provider AWS SES (see point 8 ).
When registering via Google, Apple, or Facebook, you will be redirected to the respective provider's login page. Vakantio only receives the profile data mentioned in section 5.1 from there. The data processed by the provider itself during the login process is governed by its privacy policy.
Contract initiation and performance (Art. 6 para. 1 lit. b GDPR). We additionally base the storage of IP addresses during login for the purpose of preventing misuse on Art. 6 para. 1 lit. f GDPR.
Account data is retained until the user deletes the account. IP addresses from login processes are deleted after 90 days.
When a user creates a blog or posts a blog, we process and publish the content they provide, in particular:
Uploaded images may contain EXIF metadata, specifically the capture date, device information, and GPS coordinates. We read this metadata during upload to automatically structure posts (e.g., displaying the capture location on a map). The published image file is re-encoded in user-visible sizes; technical metadata is removed by default. The extracted location and date information is stored in the post and is visible to others if the post is public.
Posts and images are publicly accessible by default. Users of the Explorer plan and higher can set blogs to private. Private blogs are only visible after explicit approval by the author.
Contract performance (Art. 6 para. 1 lit. b GDPR). Contributions remain stored until deleted by the user or by Vakantio as part of content moderation.
Users are obligated to ensure, before uploading, that they possess the necessary image and personality rights of all depicted persons (see Terms of Use § 8). If persons are recognizable in an image without their consent, they can request the deletion of the image via the channels mentioned in point 15 .
When a user leaves a comment, likes a post, or follows another blog, we store this action along with a timestamp, user ID, and IP address. The IP address is used solely for the purpose of preventing abuse and prosecuting in the event of damage and is deleted after 90 days.
Usernames and comment texts are publicly displayed on the platform, provided the associated post is public.
Legal basis: Contract performance (Art. 6 para. 1 lit. b GDPR), supplementary legitimate interest (Art. 6 para. 1 lit. f GDPR) for IP storage.
Vakantio sends the following emails to users:
The shipping provider is Amazon Web Services EMEA SARL (Amazon SES, Region eu-central-1, Frankfurt). A data processing agreement pursuant to Article 28 GDPR is in place. The data required for delivery (email address, content) is processed exclusively within the EU.
Legal basis: Contract performance (Art. 6 para. 1 lit. b GDPR).
Vakantio sends service-related emails to registered users, in particular notifications about new comments, new followers, newly published posts on subscribed blogs, and reminders about paused trips. This communication is part of using the platform.
Email address and timestamp of dispatch.
You can unsubscribe from individual notification types in your account settings. To completely unsubscribe from all service emails, please send a request to privacy@vakantio.de .
Contract performance (Art. 6 para. 1 lit. b GDPR). The email address will be processed until the account is deleted.
Vakantio uses artificial intelligence in several areas of its platform. We are transparent about the extent of this processing here.
Published posts are automatically analyzed to extract metadata—especially visited locations, means of transport, points of interest, activities, and destinations. The resulting structural data is used on the platform for links and recommendations.
For this purpose, we transmit the text of the post (without the user's IP address or account details) to OpenAI Ireland Limited (based in Dublin, with data processing also taking place in the USA). OpenAI processes the transmitted content solely to answer the specific request and not for training its own models (contractually excluded via the Enterprise API). Standard Contractual Clauses (SCCs) and a data processing agreement pursuant to Article 28 GDPR are in place.
Published articles are automatically translated into other languages to make them accessible to readers in other language regions. Depending on the article, we use either the Google Cloud Translation API (Google Ireland Limited, Dublin) or the OpenAI API (see section 10.1) for this purpose. Only the text to be translated is transmitted; account or device information is not shared.
Newly published posts and comments are automatically checked for potential violations of our terms of service (e.g., spam, hate speech, copyright infringement). Based on the results, a post may be automatically flagged for manual review or held back.
This processing combines rule-based checks with the OpenAI API. A fully automated final decision with legal effect within the meaning of Article 22 GDPR does not take place —a person decides on the final hiding, blocking, or deletion of a post.
Users can voluntarily chat via WhatsApp with an AI-powered travel assistant that researches listings on Vakantio and provides travel recommendations. Chat messages are transmitted to the WhatsApp Cloud API of Meta Platforms Ireland Limited (Dublin) and to OpenAI. Use of this service is only possible after the user has actively initiated contact.
Contract performance and legitimate interest in a functional, secure service (Art. 6 para. 1 lit. b and f GDPR), for the WhatsApp assistant additionally consent (Art. 6 para. 1 lit. a GDPR).
OpenAI and Google may transfer personal data to third countries, particularly the USA. Transfers to OpenAI are based on Standard Contractual Clauses (SCCs); for Google Cloud, the EU-US Data Privacy Framework adequacy decision also applies.
Users can object to the AI-supported analysis of their posts at any time by contacting privacy@vakantio.de . In the event of an objection, we will prevent new posts from being processed by external AI systems; previously extracted metadata will also be removed upon request.
Posts are displayed on a map. We use the following for this:
When a page with a map view is accessed, the user's browser transmits their IP address directly to Google. We have no control over this; Google's data processing is governed by its privacy policy.
Legal basis: legitimate interest in a functional map display (Art. 6 para. 1 lit. f GDPR).
When booking a paid plan (Explorer, Adventurer), payment processing is handled by Stripe Payments Europe Ltd. (based in Dublin). Stripe receives the data required for payment (email address, name, selected plan, payment method).
We do not store complete payment information ourselves; our systems only contain:
Stripe is separately responsible for payment processing. Stripe's privacy policy also applies: stripe.com/de/privacy .
Legal basis: Contract performance (Art. 6 para. 1 lit. b GDPR); additionally, statutory retention obligations under tax and commercial law (Art. 6 para. 1 lit. c GDPR).
Storage period: Payment data is subject to commercial and tax law retention obligations of up to 10 years.
Images and videos are delivered via Cloudflare R2 / img2.vakantio.de (Cloudflare Inc., EU branch). When accessing the content, the user's browser transmits their IP address to Cloudflare; this is processed solely for delivery and DDoS protection. A data processing agreement (DPA) exists with Cloudflare; processing is carried out under the EU Standard Contractual Clauses and supplementary technical and organizational measures.
We use a session cookie to maintain your login, as well as minimal cookies to store your language preference and acceptance of the cookie notice. These cookies are technically necessary (Section 25 Paragraph 2 No. 2 TTDSG) and do not require your consent.
If you have given your consent, we use the web analytics service Google Analytics 4 (Google Ireland Limited) to measure reach and user behavior. The following data is collected in particular:
The data is aggregated into pseudonymized statistics. It is not linked to any specific person.
Legal basis: Consent (§ 25 para. 1 TTDSG in conjunction with Art. 6 para. 1 lit. a GDPR). Consent can be withdrawn at any time via the cookie settings in the footer.
Third-country transfers to the USA are based on the EU-US Data Privacy Framework and SCCs.
You have the right to the following from us at any time:
Please send inquiries to privacy@vakantio.de . For security reasons, we reserve the right to verify your identity before processing a request.
You have the right to lodge a complaint with a data protection supervisory authority—in particular in the EU member state of your habitual residence, your place of work, or the place of the alleged infringement. In Germany, the respective state data protection commissioners are responsible (overview: bfdi.bund.de ). For Switzerland, the Federal Data Protection and Information Commissioner (FDPIC) is responsible ( edoeb.admin.ch ).
| Data type | Storage duration |
|---|---|
| Server logs | 30 days |
| Login IP addresses | 90 days |
| Account and profile data | until the account is deleted |
| Published posts | until deletion by the user or due to Vakantio |
| Email address for service notifications | until the account is deleted |
| Stripe payment data | up to 10 years (commercial/tax law) |
| Moderation decisions | 3 years |
We use the following data processors. We have contracts with all providers in accordance with Article 28 GDPR; for transfers to third countries, we also have standard contractual clauses and/or adequacy decisions in place.
| Provider | Purpose | Location / Processing site | Third country transfer |
|---|---|---|---|
| DigitalOcean LLC | Hosting (server) | EU (Frankfurt) | No (corporation in the US) |
| Cloudflare Inc. | Image CDN, DDoS protection | worldwide | Yes, SCCs |
| Amazon Web Services EMEA SARL | Email sending (SES) | EU (Frankfurt) | No |
| Stripe Payments Europe Ltd. | Payment processing | EU (Dublin) | Yes, SCCs |
| OpenAI Ireland Limited | AI analysis, translation, moderation | EU (Dublin), USA | Yes, SCCs |
| Google Ireland Limited | Maps, geocoding, translation, analytics | EU (Dublin), USA | Yes, DPF + SCCs |
| Meta Platforms Ireland Limited | WhatsApp assistant, Facebook login | EU (Dublin), USA | Yes, DPF + SCCs |
| Apple Distribution International Ltd. | Apple Sign In | EU (Cork) | No |
No legally binding decision based solely on automated processing within the meaning of Article 22 GDPR takes place. In particular, decisions regarding the blocking or deletion of content or accounts are ultimately made by a person.
The AI-supported processing described in point 10 serves exclusively for the content enrichment, translation and pre-evaluation of contributions and does not constitute profiling of users.
We implement technical and organizational measures to protect the processed data from loss, manipulation, and unauthorized access. These include, among other things, TLS-encrypted transmission, restrictive access rights, regular backups, and database access that is exclusively on the server infrastructure (not publicly accessible).
We will update this privacy policy if the underlying data processing activities or the legal situation change. The current version can be accessed at vakantio.de/datenschutz .
As of May 24, 2026