Privacy Policy

1. Data Controller

TripBoard (“we”, “us”, “our”) is the data controller responsible for your personal data. You can contact us regarding privacy matters at privacy@tripboard.app.

2. Data We Collect

When you sign in with Google or Apple, we receive your name, email address, and profile picture from your chosen provider. We also store content you create within TripBoard (trips, expenses, tasks, and associated data).

3. Purpose and Legal Basis for Processing

We process your personal data for the following purposes and on the following legal bases (GDPR Art. 6):

• Account and service delivery — to provide TripBoard features and authenticate you (legal basis: performance of a contract, Art. 6(1)(b)).
• Security and fraud prevention — to detect abuse and protect users (legal basis: legitimate interests, Art. 6(1)(f)).
• Legal compliance — to meet applicable legal obligations (legal basis: legal obligation, Art. 6(1)(c)).

4. Data Sharing and Recipients

We do not sell your personal data. We share data only with infrastructure providers (hosting, database, authentication) that process data on our behalf under appropriate data processing agreements. We may disclose data when required by law.

5. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will delete or anonymise your personal data within 30 days, except where retention is required by law. Trip data you have shared with others may remain visible to those collaborators in anonymised form.

6. International Transfers

Your data is stored on servers located in the European Economic Area or in countries that the European Commission has determined to provide an adequate level of data protection. Where transfers outside the EEA occur, we rely on Standard Contractual Clauses.

7. Your Rights

Under the GDPR you have the following rights regarding your personal data:

• Right to access — request a copy of the data we hold about you.
• Right to rectification — ask us to correct inaccurate data.
• Right to erasure — ask us to delete your data (“right to be forgotten”).
• Right to restriction — ask us to limit how we use your data.
• Right to data portability — receive your data in a structured format.
• Right to object — object to processing based on legitimate interests.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at privacy@tripboard.app.

8. Supervisory Authority

You have the right to lodge a complaint with a supervisory authority if you believe we are processing your personal data in violation of applicable law. You may contact the supervisory authority in your country of residence, place of work, or the location of the alleged infringement.

9. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email or an in-app notice before they take effect.