Privacy Policy

PROFILE, AGE AND PERSONAL RECOMMENDATIONS

Account registration is for people aged 18 and over, based on self-reported age. The profile stores your name, age as of the date entered, country of residence and selected gender, including Prefer not to say. You can edit these details in account settings. Supabase processes your password; GLERI does not store it in profile fields.

Personalizing partner recommendations using age, country and gender is a separate optional choice, off by default. Currently only this preference is stored: personalized advertising based on these details is not active and these fields are not sent to advertising networks. You can withdraw this choice in profile settings. If the purpose or recipients change, GLERI must update the notice and obtain an appropriate choice before use.

DATA AND PURPOSES

• Email, name and profile data provided by the selected sign-in method. They are needed to create and protect an account, sign in and synchronise it. Legal basis: performance of the service contract, Article 6(1)(b) GDPR.
• Routes, dates, budgets, packing lists, stays, transport, itinerary and checklist that you create may be stored in your account so GLERI can operate, synchronise, share and delete them at your request.
• A guest trip copy may remain in the browser until you delete it, clear site data or move it into an account. Site language and theme are also stored locally without a fixed expiry.
• Precise location is requested only after a user action for nearby search or when using Map with GPS. While GPS is active, the position may update; you can stop it. Coordinates are sent through GLERI to Mapbox for search, route building or rerouting and are not stored by the application in browser storage.

EXTERNAL PROVIDERS AND TRANSFERS

GLERI sends the data needed for a requested action to Mapbox (maps, routes and nearby places), Photon (address search), Transitous (timetables), OpenStreetMap/Overpass (catalogues), Wikipedia/Wikimedia (reference descriptions and photos), the Booking.com Demand API when enabled, and Supabase (accounts, databases and sharing). These providers may receive an IP address or other network technical data and the request parameters, so this data should not be described as fully anonymous.

When you sign in with Google or Apple, the selected authentication provider receives the data needed for its sign-in flow. Raw Wikimedia/Wikipedia photos may load directly in the browser, so those providers may see the browser’s IP address.

When you open an external seller or map, that site receives browser data and link parameters under its own policies. Partner attribution may be separate from GLERI.

Hosting regions, international transfers and provider agreements still require operational confirmation. This document does not promise EU-only hosting or processing.

LEGAL BASES AND SECURITY

Article 6(1)(b) GDPR applies to operating the service and account. Necessary security, abuse prevention and infrastructure protection may rely on legitimate interests under Article 6(1)(f) GDPR.

With consent (Article 6(1)(a) GDPR), GLERI may send limited technical events to improve performance: only a path template with the sharing key removed, general Web Vitals and generic error messages without trip data, queries or raw messages. Refusal does not limit the core service; consent can be withdrawn in settings.

GLERI does not sell personal data or create an advertising profile. Operational logs, backups and provider records may have their own retention periods; the periods and procedures are being prepared for confirmation.

SHARING AND EXPIRY

An active shared-trip link works as a secret access key: anyone who receives it may view the shared content. A link may have no expiry unless its owner sets one; the owner can turn it off. Editing requires an account and is controlled through member permissions.

YOUR RIGHTS AND REQUESTS

You may request access, rectification, erasure, restriction, data portability or object to processing based on legitimate interests. Consent can be withdrawn at any time; this does not affect the lawfulness of earlier processing. As a general rule, we respond within one month; the law may permit an extension or provide an exception.

You may also complain to a competent supervisory authority. Where relevant to your situation, you may contact the Czech ÚOOÚ; supervisory competence depends on the circumstances and is not determined by this draft.

OPERATOR CONTACT

The operator’s verified contact details and postal address are being prepared for publication. Do not send confidential data until the official channel is confirmed.