Privacy policy

Who is responsible

Grusian is run by Lehannes.nl in the Netherlands. We are the controller of the personal data described here.

Questions, requests or complaints: info@grusian.eu.

What we store

• Your account: your email address, your name if you give one, and which way you sign in (email code, Google or Microsoft).
• Your trips: trips, flights, stays, trains, places, notes, GPS tracks and photos, whether you typed them in, imported them or forwarded them.
• Files you give us: tickets and documents you upload, and the emails you forward to trips@grusian.eu.
• Your settings: units, theme, feed colours, and which outside services you have switched off.
• The credentials of sources you connect, such as a calendar feed link. These are stored encrypted and used only to fetch your trips.

We do not run ads, we do not sell your data, and we do not build advertising profiles.

Why we use it

We use your data to run the service you asked for: to show your trips, read your bookings, keep your maps and statistics, and let you share a trip. We also use technical data, such as error logs, to keep the service secure and working. We do not use your trips for anything else.

Signing in with Google or Microsoft

If you sign in with Google or Microsoft, we receive your name and email address, and nothing else. We do not read your Google or Microsoft mail, calendar, contacts or files.

Who helps us run Grusian

We use these services to run Grusian. Each receives only what it needs for its task.

• Supabase: our database, file storage and sign-in. Your data is stored in the EU (Ireland).
• Vercel: hosting of the website, with servers in Ireland. Vercel Analytics counts page views without cookies and without personal data.
• Cloudflare: receives the emails you forward to us and the mail sent to our info@ address, and hands them on.
• Resend: sends the emails Grusian sends you, such as a confirmation link for a sender address.
• OpenAI: when a forwarded email or an uploaded document has no booking data in a standard format, its content is sent to OpenAI's API to be read into bookings. We use the paid API, where OpenAI does not train its models on your data. OpenAI may keep API requests for a short period to check for abuse.

Some of these companies are based outside the EU. Where that is the case, we rely on the safeguards the GDPR allows, such as the EU standard contractual clauses.

Outside services you can turn off

To enrich your trips, Grusian asks other services for things you did not type in. Each can be switched off in Settings.

• Schiphol and AeroDataBox: live flight status. They receive the flight number and date.
• Open-Meteo: weather for a trip's places. It receives the coordinates of those places.
• Unsplash: a cover photo for a trip. It receives the name of the destination.

Two more services work when you use a feature, and have no switch: Photon (komoot) suggests places as you type in a location field, so it receives what you typed; and the map tiles come from OpenFreeMap, which sees your IP address and the area you look at.

Share links

A share link shows one trip, read-only, to anyone who has the link, until you revoke it or it expires. It never shows booking references, seats or documents unless you choose to include the flight and stay details. Treat a link as you would a photo you post: do not send it to people you do not want to see the trip.

Cookies and storage on your device

We use only what the service needs: a sign-in cookie, and small settings for your theme, units and the map. Trips you save for offline use stay on your device until you remove them or sign out. We use no tracking or advertising cookies.

How long we keep your data

We keep your data until you delete it or your account. When you delete your account in Settings, your trips, files, connected sources and share links are removed from our systems straight away. Copies in our database provider's backups are removed as those backups expire.

Your rights

Under the GDPR you can ask to see your data, correct it, delete it, receive a copy, restrict how we use it, or object to its use.

• Copy: Settings, then Your data, then Download your data. You get everything in one zip, with your files.
• Correct: edit your trips and bookings in the app.
• Delete: Settings, then Your data, then Delete account.

For anything else, write to info@grusian.eu. We reply within a month. If you are not happy with our answer, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or to the authority in your own country.

Changes

If we change this policy in a way that matters, we tell you in the app or by email before it takes effect. The date at the top shows when it last changed.