The controller within the meaning of the General Data Protection Regulation (GDPR), the Swiss Data Protection Act (DSG) and other data protection regulations is:
Joseph Duncan
Main Street 24
8280 Kreuzlingen
Switzerland
Email: privacy@vakantio.de
Website: https://vakantio.de
A separate data protection officer is not legally required. Inquiries regarding this statement or the exercise of the rights mentioned in point 15 should be directed to the email address provided above.
This statement applies to the Vakantio platform ( vakantio.de , all subdomains, mobile apps for iOS and Android) and describes which personal data we process, for what purpose, on what legal basis, how long we store it and to which recipients it is transferred.
Vakantio is a travel journal and blog service. We process:
The publicly accessible content can be used without registration and therefore without providing personal data, apart from the technical access data described under point 4 .
We use the terms of the GDPR. In particular:
Each time the platform is accessed, technical data is processed that the user's browser or app automatically transmits:
We process this data on the basis of our legitimate interest (Art. 6 para. 1 lit. f GDPR) for the delivery of the platform, to ensure stable operation, to prevent misuse and to defend against attacks.
Storage period: maximum 30 days; aggregated, non-personally identifiable statistics longer.
Currency by country: To display prices in the appropriate currency (Swiss francs for visitors from Switzerland and Liechtenstein, otherwise euros), we determine the country from the IP address. This query is performed exclusively on our own server using a locally stored country database; the IP address is neither stored nor transmitted to third parties for this purpose. For registered users, we also consider the country code of the email address (e.g., ".ch"). The legal basis for this is our legitimate interest in providing clear price information (Art. 6 para. 1 lit. f GDPR). IP country data: IP Geolocation by DB-IP (CC BY 4.0).
Hosting is provided by DigitalOcean LLC (a US-based company, servers located in Frankfurt am Main). No data is transferred to the USA during the server hosting process itself; data processing is contractually secured via a data processing agreement (DPA) in accordance with Article 28 of the GDPR.
Depending on the chosen registration method, we process the following during registration:
In addition, we store the date of registration, the last used login method, the time of the last login and — for the purpose of preventing misuse and securing evidence in case of dispute — the IP address during the login and registration process.
When logging in via email, we generate a one-time use, time-limited login token and send it to the registered email address via the email service provider AWS SES (see point 8 ).
When registering via Google, Apple, or Facebook, you will be redirected to the respective provider's login page. Vakantio only receives the profile data mentioned in section 5.1 from there. The data processed by the provider itself during the login process is governed by its privacy policy.
Contract initiation and performance (Art. 6 para. 1 lit. b GDPR). We additionally base the storage of IP addresses during login for the purpose of preventing misuse on Art. 6 para. 1 lit. f GDPR.
Account data is retained until the user deletes the account. IP addresses from login processes are deleted after 90 days.
When a user creates a blog or posts a blog, we process and publish the content they provide, in particular:
Uploaded images may contain EXIF metadata, specifically the capture date, device information, and GPS coordinates. We read this metadata during upload to automatically structure posts (e.g., displaying the capture location on a map). The published image file is re-encoded in user-visible sizes; technical metadata is removed by default. The extracted location and date information is stored in the post and is visible to others if the post is public.
Posts and images are publicly accessible by default. Users of the Explorer plan and higher can set blogs to private. Private blogs are only visible after explicit approval by the author.
Contract performance (Art. 6 para. 1 lit. b GDPR). Contributions remain stored until deleted by the user or by Vakantio as part of content moderation.
Users are obligated to ensure, before uploading, that they possess the necessary image and personality rights of all depicted persons (see Terms of Use § 8). If persons are recognizable in an image without their consent, they can request the deletion of the image via the channels mentioned in point 15 .
When a user leaves a comment, likes a post, or follows another blog, we store this action along with a timestamp, user ID, and IP address. The IP address is used solely for the purpose of preventing abuse and prosecuting in the event of damage and is deleted after 90 days.
Usernames and comment texts are publicly displayed on the platform, provided the associated post is public.
Legal basis: Contract performance (Art. 6 para. 1 lit. b GDPR), supplementary legitimate interest (Art. 6 para. 1 lit. f GDPR) for IP storage.
Vakantio sends the following emails to users:
The shipping provider is Amazon Web Services EMEA SARL (Amazon SES, Region eu-central-1, Frankfurt). A data processing agreement pursuant to Article 28 GDPR is in place. The data required for delivery (email address, content) is processed exclusively within the EU.
Legal basis: Contract performance (Art. 6 para. 1 lit. b GDPR).
Vakantio sends service-related emails to registered users, in particular notifications about new comments, new followers, newly published posts on subscribed blogs, and reminders about paused trips. This communication is part of using the platform.
Email address and timestamp of dispatch.
You can unsubscribe from individual notification types in your account settings. To completely unsubscribe from all service emails, please send a request to privacy@vakantio.de .
Contract performance (Art. 6 para. 1 lit. b GDPR). The email address will be processed until the account is deleted.
Vakantio uses artificial intelligence in several areas of its platform. We are transparent about the extent of this processing here.
Published posts are automatically analyzed to extract metadata—especially visited locations, means of transport, points of interest, activities, and destinations. The resulting structural data is used on the platform for links and recommendations.
For this purpose, we transmit the text of the post (without the user's IP address or account details) to OpenAI Ireland Limited (based in Dublin, with data processing also taking place in the USA). OpenAI processes the transmitted content solely to answer the specific request and not for training its own models (contractually excluded via the Enterprise API). Standard Contractual Clauses (SCCs) and a data processing agreement pursuant to Article 28 GDPR are in place.
Published articles are automatically translated into other languages to make them accessible to readers in other language regions. Depending on the article, we use either the Google Cloud Translation API (Google Ireland Limited, Dublin) or the OpenAI API (see section 10.1) for this purpose. Only the text to be translated is transmitted; account or device information is not shared.
Newly published posts and comments are automatically checked for potential violations of our terms of service (e.g., spam, hate speech, copyright infringement). Based on the results, a post may be automatically flagged for manual review or held back.
This processing combines rule-based checks with the OpenAI API. A fully automated final decision with legal effect within the meaning of Article 22 GDPR does not take place —a person decides on the final hiding, blocking, or deletion of a post.
Users can voluntarily chat via WhatsApp with an AI-powered travel assistant that researches listings on Vakantio and provides travel recommendations. Chat messages are transmitted to the WhatsApp Cloud API of Meta Platforms Ireland Limited (Dublin) and to OpenAI. Use of this service is only possible after the user has actively initiated contact.
Contract performance and legitimate interest in a functional, secure service (Art. 6 para. 1 lit. b and f GDPR), for the WhatsApp assistant additionally consent (Art. 6 para. 1 lit. a GDPR).
OpenAI and Google may transfer personal data to third countries, particularly the USA. Transfers to OpenAI are based on Standard Contractual Clauses (SCCs); for Google Cloud, the EU-US Data Privacy Framework adequacy decision also applies.
Users can object to the AI-supported analysis of their posts at any time by contacting privacy@vakantio.de . In the event of an objection, we will prevent new posts from being processed by external AI systems; previously extracted metadata will also be removed upon request.
Posts are displayed on a map. We use the following for this:
When a page with a map view is accessed, the user's browser transmits their IP address directly to Google. We have no control over this; Google's data processing is governed by its privacy policy.
Legal basis: legitimate interest in a functional map display (Art. 6 para. 1 lit. f GDPR).
When booking a paid plan (Explorer, Adventurer), payment processing is handled by Stripe Payments Europe Ltd. (based in Dublin). Stripe receives the data required for payment (email address, name, selected plan, payment method).
We do not store complete payment information ourselves; our systems only contain:
Stripe is separately responsible for payment processing. Stripe's privacy policy also applies: stripe.com/de/privacy .
Legal basis: Contract performance (Art. 6 para. 1 lit. b GDPR); additionally, statutory retention obligations under tax and commercial law (Art. 6 para. 1 lit. c GDPR).
Storage period: Payment data is subject to commercial and tax law retention obligations of up to 10 years.
Authors can create a photo book from their travels or selected contributions, edit it, download it as a PDF (Premium and Pro plans) and order it as a printed book.
For the automatic design process, we transmit the texts, titles, location and date information, comments, and reduced-size versions of the photos from the selected entries to OpenAI Ireland Limited (see section 10 ). The AI evaluates photos, shortens texts, selects quotes and comments, and suggests a design. The same applies to instructions entered into the AI assistant of the photo book editor. Account or payment details are not transmitted. All results are suggestions that the user can review and modify before placing an order.
Comments from other users on the posts (display name and comment text) can be included in a photo book. The legal basis for this is the author's legitimate interest in a complete travel memory (Art. 6 para. 1 lit. f GDPR). Anyone who does not wish their comments to appear in photo books can object at any time by contacting privacy@vakantio.de .
For printable PDF files, we use the original photos uploaded in full resolution from our storage (see point 13 ). We only include the image content and a color profile in the print files; EXIF metadata such as location (GPS) or camera data are not included . Preview and print files are stored on our servers and are only accessible via time-limited, signed links.
Payment is processed via Stripe (see section 12 ); Stripe collects your name, email address, delivery address, and payment details. For production and shipping, we transmit the print files, along with your name, delivery address, email address, and, if applicable, telephone number, to our printing service provider , Prodigi Group (Cardiff, United Kingdom). Prodigi has the book produced at a partner printing company, usually in Germany or the Netherlands, and delivers it via a shipping provider (e.g., DHL), which receives your name and delivery address. The EU Commission has issued an adequacy decision for the United Kingdom. We receive the order status and shipment tracking information from Prodigi and display it in your account.
We will send emails regarding the order (order confirmation, shipping, and any production issues) to the email address provided during payment.
Legal basis: Contract performance (Art. 6 para. 1 lit. b GDPR); for invoice and order data, additionally statutory retention obligations (Art. 6 para. 1 lit. c GDPR).
Storage period: We store photo book projects and their preview and print files until they are deleted or the account is deleted. We retain order and invoice data for up to 10 years (commercial and tax law obligations). The printing service provider deletes the print files after production according to its own guidelines.
Images and videos are delivered via Cloudflare R2 / img2.vakantio.de (Cloudflare Inc., EU branch). When accessing the content, the user's browser transmits their IP address to Cloudflare; this is processed solely for delivery and DDoS protection. A data processing agreement (DPA) exists with Cloudflare; processing is carried out under the EU Standard Contractual Clauses and supplementary technical and organizational measures.
We use a session cookie to maintain your login, as well as minimal cookies to store your language preference and acceptance of the cookie notice. These cookies are technically necessary (Section 25 Paragraph 2 No. 2 TTDSG) and do not require your consent.
If you have given your consent, we use the web analytics service Google Analytics 4 (Google Ireland Limited) to measure reach and user behavior. The following data is collected in particular:
The data is aggregated into pseudonymized statistics. It is not linked to any specific person.
Legal basis: Consent (§ 25 para. 1 TTDSG in conjunction with Art. 6 para. 1 lit. a GDPR). Consent can be withdrawn at any time via the cookie settings in the footer.
Third-country transfers to the USA are based on the EU-US Data Privacy Framework and SCCs.
You have the right to the following from us at any time:
Please send inquiries to privacy@vakantio.de . For security reasons, we reserve the right to verify your identity before processing a request.
You have the right to lodge a complaint with a data protection supervisory authority—in particular in the EU member state of your habitual residence, your place of work, or the place of the alleged infringement. In Germany, the respective state data protection commissioners are responsible (overview: bfdi.bund.de ). For Switzerland, the Federal Data Protection and Information Commissioner (FDPIC) is responsible ( edoeb.admin.ch ).
| Data type | Storage duration |
|---|---|
| Server logs | 30 days |
| Login IP addresses | 90 days |
| Account and profile data | until the account is deleted |
| Published posts | until deletion by the user or due to Vakantio |
| Email address for service notifications | until the account is deleted |
| Stripe payment data | up to 10 years (commercial/tax law) |
| Photobook projects, preview and print files | until the project or account is deleted |
| Photobook order and delivery information | up to 10 years (commercial/tax law) |
| Moderation decisions | 3 years |
We use the following data processors. We have contracts with all providers in accordance with Article 28 GDPR; for transfers to third countries, we also have standard contractual clauses and/or adequacy decisions in place.
| Provider | Purpose | Location / Processing site | Third country transfer |
|---|---|---|---|
| DigitalOcean LLC | Hosting (server) | EU (Frankfurt) | No (corporation in the US) |
| Cloudflare Inc. | Image CDN, DDoS protection | worldwide | Yes, SCCs |
| Amazon Web Services EMEA SARL | Email sending (SES) | EU (Frankfurt) | No |
| Stripe Payments Europe Ltd. | Payment processing | EU (Dublin) | Yes, SCCs |
| Prodigi Group | Printing and shipping of photo books (including partner printing companies and shipping service providers) | United Kingdom (Cardiff); pressure in the EU | Yes, adequacy decision (UK) |
| OpenAI Ireland Limited | AI analysis, translation, moderation, photo book design | EU (Dublin), USA | Yes, SCCs |
| Google Ireland Limited | Maps, geocoding, translation, analytics | EU (Dublin), USA | Yes, DPF + SCCs |
| Meta Platforms Ireland Limited | WhatsApp assistant, Facebook login | EU (Dublin), USA | Yes, DPF + SCCs |
| Apple Distribution International Ltd. | Apple Sign In | EU (Cork) | No |
No legally binding decision based solely on automated processing within the meaning of Article 22 GDPR takes place. In particular, decisions regarding the blocking or deletion of content or accounts are ultimately made by a person.
The AI-supported processing described in point 10 serves exclusively for the content enrichment, translation and pre-evaluation of contributions and does not constitute profiling of users.
We implement technical and organizational measures to protect the processed data from loss, manipulation, and unauthorized access. These include, among other things, TLS-encrypted transmission, restrictive access rights, regular backups, and database access that is exclusively on the server infrastructure (not publicly accessible).
We will update this privacy policy if the underlying data processing activities or the legal situation change. The current version can be accessed at vakantio.de/datenschutz .
As of October 9, 2026