1. Who we are
Plan Your Road Trips (“PYRT”, “we”) is a road-trip planning service for web, iOS and Android. This policy explains what personal data we collect, why, and what you can do about it.
PYRT is currently run by an individual sole operator based in the United Kingdom, who is the data controller for the purposes of the UK GDPR. You can reach the controller at [email protected].
2. What we collect
Account details
Your name, email address and profile photo, from you directly, or from Google if you sign in with Google. Optionally a bio, phone number and cover photo.
Your trips
The trips you build: names and dates, stops and destinations, day plans, notes, checklists, bookings (hotels, ferries, transport), expenses and budgets, uploaded documents and photos, and any comments or suggestions you post.
Location data: optional, off by default
If, and only if. You switch on Location sharing in Settings, and while a trip is actively running, the mobile app records your precise GPS location in the background. We use it to show your live position to the travel companions on that trip, and to save the route you actually drove so it can be drawn on the trip map afterwards.
- It is off by default and never starts without you turning it on.
- It only records while a trip has been started. Not all the time.
- You can switch it off at any moment in Settings; recording stops immediately.
- Only people on that trip can see your position or your trail.
- GPS breadcrumbs older than 12 months are deleted automatically.
Connected accounts
If you connect Gmail, Outlook, Google Calendar or Splitwise, we store access tokens (encrypted) so we can read booking confirmations or sync events: strictly for the features you enabled. Disconnecting deletes the tokens.
Payment data
Payments are handled by Stripe. We never see or store your full card details: only a customer reference and subscription status.
Technical data
IP address, browser and device type, and basic usage analytics, used to keep the service running and secure.
3. Why we use it, and our lawful basis
- Providing the service: building and sharing trips, collaboration, bookings: performance of a contract.
- Location sharing and drive tracking, your consent, given by switching it on and withdrawable at any time.
- Marketing emails: your consent; opt-in only and unsubscribable.
- Security, fraud prevention and improving the service, legitimate interests.
- Tax and accounting records: legal obligation.
We do not sell your personal data, and we do not use it to train AI models. Where AI features process your content (trip suggestions, document analysis, receipt scanning), it is sent to AWS Bedrock purely to generate your result.
4. Who we share it with
- People you invite to a trip, and, for a public trip, anyone with the link.
- Service providers running the platform on our behalf: AWS (hosting, storage, AI), Neon (database), Stripe (payments), and mapping/geocoding providers.
- Authorities, only where the law requires it.
Note that if you make a trip public, its name, stops, dates and the names and profile photos of everyone on it become visible to anyone with the link.
5. Security
- Encrypted in transit (HTTPS) and at rest.
- Sensitive fields, including your email address and connected-account tokens: are additionally encrypted at the application layer.
- Access to production data is restricted, and administrator access to a user's trips is logged.
No system is perfectly secure, but if a breach affects your rights we will notify the ICO within 72 hours and tell you where required.
6. How long we keep it
- Account and trip data: until you delete your account.
- GPS breadcrumbs: deleted automatically after 12 months.
- Payment and tax records, up to 7 years, as UK law requires.
- Backups: deleted data may persist in encrypted backups for a short period before being overwritten.
7. Your rights
Under the UK GDPR you have the right to:
- Access: Settings → Account → Download my data gives you everything we hold, as a JSON file, instantly.
- Erasure: Settings → Account → Delete Account permanently deletes your account and all associated data, including any recorded trails.
- Rectification: correct anything inaccurate in your profile settings.
- Withdraw consent: turn off location sharing or marketing emails at any time.
- Portability: the export is machine-readable JSON you can take elsewhere.
- Object or restrict: contact us and we'll act on it.
We aim to respond to any request within 30 days. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office (ICO).
8. Children
PYRT isn't intended for children under 13, and we don't knowingly collect their data. If you believe a child has given us personal data, contact us and we'll delete it.
9. International transfers
Our infrastructure is hosted in the UK and EU (London and Frankfurt regions). Where a provider processes data outside the UK, transfers are covered by UK-approved safeguards such as Standard Contractual Clauses.
10. Changes
We'll update this page when our practices change and revise the date at the top. For significant changes affecting your rights, we'll tell you directly.
11. Contact
Questions, requests or complaints: [email protected]