Privacy Policy

1. Controller

Avamundo, Patrick Kieber, Heiligwies 6, 9486 Schaanwald, Liechtenstein
Email: legal@avamundo.com

2. Data We Collect

Account registration

When you create an account we collect your email address and a hashed password. Optionally you may provide a first and last name. The legal basis is the performance of a contract (Art. 6 para. 1 lit. b GDPR).

Authentication tokens

After login we issue short-lived JWT access tokens and a refresh token, stored in your browser's localStorage. These are used solely to authenticate subsequent requests and are never shared with third parties.

Trip planner

When you generate an AI trip itinerary we store your preferences (duration, difficulty, interests, region, start date) and the resulting itinerary text. This data is linked to your account and visible only to you. You can delete individual trips at any time from your account page, or delete all data by deleting your account.

Guide downloads

We log which guides you download and when, to enforce monthly download quotas. This data is linked to your account.

AI personalisation (optional)

If you explicitly consent, we use your usage patterns to personalise recommendations via Mistral AI (EU-based). This consent is optional, can be withdrawn at any time from your account settings, and has no effect on core functionality.

Payments

Pass purchases are handled entirely by Stripe. We do not store your card number, CVV, or full payment details. Stripe shares only the pass type and payment status with us via webhook. See Stripe's Privacy Policy.

Newsletter waitlist

If you joined our earlier waitlist, we stored only your email address. Waitlist addresses are not linked to user accounts. You may remove yourself via the unsubscribe page.

Server logs

Our hosting provider automatically records standard access logs (IP address, browser type, pages visited, date/time). These logs are retained for a maximum of 7 days for security purposes and are not linked to your identity.

3. Infrastructure & Data Processors

Your data is processed by the following third-party services:

• Hetzner Online GmbH (server hosting) — Industriestr. 25, 91710 Gunzenhausen, Germany. Data stored in Germany (EU). Privacy Policy
• Infomaniak Network AG (transactional email) — Rue Eugène-Marziano 25, 1227 Geneva, Switzerland. Privacy Policy
• Stripe, Inc. (payment processing) — 510 Townsend Street, San Francisco, CA 94103, USA. Data transfer to the USA under Standard Contractual Clauses. Privacy Policy
• Mistral AI SAS (AI trip generation, optional personalisation) — 15 rue des Halles, 75001 Paris, France (EU). Terms & Privacy
• OpenWeatherMap (weather data) — API calls include only geographic coordinates; no personal data is transmitted. Privacy Policy

We do not use advertising networks, social media tracking pixels, or Google Analytics.

4. Data Retention

• Account data — retained until you delete your account.
• Trip itineraries — retained until you delete the trip or your account.
• Download logs — retained for 12 months for quota enforcement, then deleted.
• Payment records — retained for 10 years as required by Liechtenstein and EU financial law.
• Waitlist emails — retained until unsubscribed; deletion on request.
• Server logs — 7-day rolling retention.

5. Your Rights

Under GDPR (applicable in Liechtenstein as an EEA member state), you have the right to:

• Access — download all data we hold via Account → Export my data
• Rectification — update your name and email in account settings
• Erasure — delete your account and all data via Account → Delete Account
• Withdraw AI consent — toggle off in account settings at any time
• Portability — download all data we hold via Account → Export my data
• Object — to processing based on legitimate interests at any time (Art. 21 GDPR); contact us to exercise this right
• Unsubscribe — from the waitlist via unsubscribe page
• Lodge a complaint — with the Liechtenstein Datenschutzstelle (DSS) at datenschutzstelle.li or your local supervisory authority

For requests that cannot be fulfilled self-service, contact legal@avamundo.com. We respond within 30 days.

6. Cookies & Local Storage

AlpineSpot does not use tracking or advertising cookies. We use browser localStorage for:

• Authentication tokens (JWT access & refresh tokens)
• Your saved article bookmarks
• Your language preference

This data is stored only on your device and is never transmitted to analytics services.

7. Security

All data is transmitted over HTTPS (TLS 1.2+). Passwords are hashed using Django's PBKDF2-SHA256 algorithm. JWT tokens are short-lived (access: 15 minutes; refresh: 7 days). The backend runs on an isolated Hetzner VPS with no public SSH access.

8. Changes to This Policy

We may update this policy as the service evolves. We will note the date of the last update at the top of this page. Continued use of the service after a material change constitutes acceptance of the updated policy.