Privacy Policy
This policy explains what personal data Iterdex (“we”, “us”, “our”) collects when you use the Iterdex app or website (together, the “Service”), why we collect it, who we share it with, and the rights you have.
It should be read together with our Terms of Service and Disclaimer. For any privacy matter, contact us at support@iterdex.com.
1. Who we are
Iterdex is the data controller for personal data processed through the Service.
2. Scope
This policy applies to all personal data we process in connection with the Service.
3. Personal data we collect
Data you provide:
- Account information — your email address and password, and your name, username, and profile photo if you add them.
- Content you create or upload — your trips, including destinations, places, dates, interests, travel preferences, notes, and prices, the photos and files you add (such as tickets and booking confirmations), and the people you share trips with.
- Communications — messages, feedback, and reports you send us.
- Subscription status — if you subscribe, we receive your subscription status from the app store so we can unlock paid features. We do not receive your card or bank details; payment is handled by Apple or Google.
- Waitlist — if you join our waitlist on the website before the app is available to you, your email address, so we can let you know when you can sign up.
Data we collect automatically:
- Diagnostics — crash and error reports, which may be associated with your account so that a fault can be traced and fixed.
- Device information — device type, operating system, and app version.
- IP address — when you connect to the website or our servers, your IP address is processed by our hosting, content-delivery, and security providers to deliver the Service and to detect and prevent abuse. We do not use it to build a profile of you or to track you across other sites.
Data from third parties:
- Sign in with Apple or Google — a sign-in identifier and, depending on your settings, the email address they provide, used to create and secure your account.
Device permissions. Some features ask for access to your location, photos, or calendar. What they access stays on your device unless you choose to add it to the Service, for example by uploading a photo. Your precise location is not collected.
4. How we use your data, and our legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and manage your account; sign you in | Art. 6(1)(b) — performance of a contract |
| Build your itineraries and sync them across devices | Art. 6(1)(b) — contract |
| Provide, maintain, and support the Service | Art. 6(1)(b) — contract |
| Manage your subscription and unlock paid features | Art. 6(1)(b) — contract |
| Keep records of transactions (tax, accounting) | Art. 6(1)(c) — legal obligation |
| Send account, sign-in, and support messages | Art. 6(1)(b) — contract |
| Send trip notifications, such as when someone shares a trip with you (you can turn these off in the app) | Art. 6(1)(f) — legitimate interests |
| Improve and develop the Service; understand usage | Art. 6(1)(f) — legitimate interests |
| Keep the Service safe, including reviewing reports and preventing fraud, abuse, and overuse | Art. 6(1)(f) — legitimate interests |
| Send product-update or marketing emails, where offered | Art. 6(1)(a) — consent |
| Comply with legal obligations and lawful requests | Art. 6(1)(c) — legal obligation |
Where we rely on legitimate interests, we have assessed that they are not overridden by your rights and freedoms. You may object at any time (see section 10).
5. Sharing and publishing trips
Your trips are private unless you choose to share them:
- Invitation — people you invite can see the whole trip, including your notes, prices, photos, and files, and can add photos of their own.
- Link — anyone with the link can see the itinerary, but not your notes, prices, photos, or files.
- Public — anyone can see the trip, and it may be indexed by search engines. You choose whether your notes, prices, and photos are included.
Photos you add to someone else’s trip are visible to the people that trip is shared with.
Your name, username, and profile photo may be visible to other users. Your email address is not.
You can change who can see a trip at any time. This stops new access but cannot recall what others have already seen, copied, or saved, or remove search-engine caches of a previously public trip.
6. Recipients of personal data
We do not sell your personal data. We use a limited number of service providers to operate the Service, in the following categories:
- hosting, database, and authentication;
- backend compute for building itineraries;
- content delivery, security, and bot detection (for example, to protect the website’s forms from abuse);
- email delivery;
- error monitoring and diagnostics;
- app-store payment processing for subscriptions (Apple, Google);
- maps, place data, and route calculation; and
- activity and tour suggestions.
Providers act only on our instructions and receive only the data needed for their function. We can provide the current list of providers on request. We may also disclose personal data to professional advisers or authorities where required by law, or to a successor entity in a merger or acquisition under confidentiality safeguards.
7. Cookies and similar technologies
The mobile app does not use advertising cookies. The website uses cookies and similar technologies that are strictly necessary for it to function, such as sign-in sessions and security. Our waitlist and other forms use an anti-bot check that is strictly necessary to protect the Service from abuse; it may set a token and process your IP address for that purpose only.
8. International data transfers
Some providers operate outside your country or the European Economic Area, for example in the United States. Where we transfer personal data across borders, we rely on appropriate safeguards, including the European Commission’s Standard Contractual Clauses and the EU–US Data Privacy Framework where a provider is certified. You can request details at support@iterdex.com.
9. Data retention
We retain personal data only for as long as necessary for the purposes in this policy, or as required by law.
| Data | Retention |
|---|---|
| Account information and content | Until you delete it or your account (see section 12) |
| Email delivery logs, support messages, feedback, and reports | Up to 90 days, then deleted |
| Email addresses we must not contact (bounces, spam complaints) | Kept so we do not email them again, including after account deletion |
| Crash, error, and diagnostic data | Per our monitoring provider’s retention configuration (up to 90 days) |
| Subscription and transaction records | For the period required by applicable tax and accounting law, even after account deletion |
| First-party server logs | A limited period for security and operations, then deleted or aggregated |
10. Your rights
Subject to applicable law, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data; to data portability; and to withdraw consent at any time without affecting prior processing. You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects.
To exercise any of these, contact support@iterdex.com. We respond within one month, extendable for complex requests with notice. If you are in the EEA, UK, or Switzerland, you may also lodge a complaint with your local supervisory authority. Our lead supervisory authority is the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL, cnil.fr).
11. US state privacy rights
If you reside in a US state with a privacy law, you may have rights to access, correct, and delete your personal information and to opt out of its sale or sharing for cross-context behavioural advertising. We do not sell personal information or share it for cross-context behavioural advertising, and we do not discriminate against you for exercising your rights. To make a request, contact support@iterdex.com.
12. Deleting your account
You can delete your account and its data at any time. In the app, go to Account → Delete account and confirm. This permanently removes your profile, your trips and everything in them, and the photos you added to other people’s trips.
If you cannot sign in, email support@iterdex.com from the email address on your account and ask us to delete it. We will verify the request and delete your account within 30 days. Some records are kept after deletion, as described in section 9: operational records such as email delivery logs and support messages for up to 90 days, and addresses we must not email. We retain other information longer only where the law requires it.
13. Children
The Service is intended for adults, and we do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact support@iterdex.com and we will delete it.
14. Changes to this policy
We may update this policy from time to time. If a change is material, we will make reasonable efforts to notify you by email or in the Service before it takes effect. The “Last updated” date below reflects the current version.
15. Contact
For any question or request relating to this policy, contact support@iterdex.com.
Last updated 20 October 2026.