Privacy Policy

NextEraPro Ltd. ("WayGenie", "we", "us", "our") operates the WayGenie travel-planning service at https://web.waygenie.app and the marketing site at https://waygenie.app. We are the data controller for the personal data described in this policy. You can reach us at team@waygenie.app for any privacy question or to exercise your rights.

1. Who This Policy Applies To

This policy applies to anyone who:

• creates a WayGenie account;
• is invited as a collaborator on someone else's trip;
• subscribes to a paid plan;
• contacts us by email; or
• visits the marketing site or web app.

If you are visiting the marketing site only and have not consented to non-essential cookies, very little data is collected; see the Cookie Policy for the specifics.

2. Data We Collect

We collect personal data in the following categories:

2.1 Account data (via Clerk)

When you create an account we collect: your name, email address, profile photo (if you upload one), password hash (we never see your plaintext password), and Clerk's authentication metadata including sign-in timestamps, device fingerprints, and the IP address of each sign-in. If you sign in using Google or Apple, we also receive your verified email address from those providers.
Lawful basis: performance of a contract (Art. 6(1)(b) UK GDPR).

2.2 Payment data (via Stripe)

When you purchase the Trip one-off plan or subscribe to Pro, Stripe collects your card last-4, card brand, billing address, and billing country on our behalf. We never see or store your full card number. We receive a Stripe customer ID, the plan you bought, and the invoice history.
Lawful basis: performance of a contract (Art. 6(1)(b)) and legal obligation for tax record-keeping (Art. 6(1)(c)).

2.3 Trip content

Anything you put into a trip: destinations, travel dates, budgets, notes, per-day activities, expense entries, photos uploaded to object storage, collaborator email addresses, and public-share preferences.
Lawful basis: performance of a contract (Art. 6(1)(b)).

2.4 AI generation prompts

When you use AI itinerary or image-generation features, we send the prompt to our AI providers, typically the destination, dates, traveller count, interests, and budget. We do not include your name, email, or account ID in the prompt. See section 6 for more.
Lawful basis: performance of a contract (Art. 6(1)(b)).

2.5 Geocoding, weather, and image-search lookups

To render maps, weather forecasts, and destination imagery we send place names or coordinates to Mapbox (geocoding), Open-Meteo (weather), and Pexels (stock photography). These providers receive only the search query plus the request IP, not your account identifiers.
Lawful basis: legitimate interests (Art. 6(1)(f)), providing the features you have asked for.

2.6 Behavioural analytics

With your consent (collected via the cookie banner) we collect: page views, feature usage events, referring URL, device and browser info, approximate location derived from IP, and a sampled session replay (25% of sessions, with input masking on form fields). Processed by Mixpanel and Google Analytics 4.
Lawful basis: consent (Art. 6(1)(a)). You can withdraw at any time from the cookie settings.

2.7 Support correspondence

If you email us, we keep the message and your reply chain in our inbox so we can answer and reference past tickets.
Lawful basis: legitimate interests (Art. 6(1)(f)), handling user support.

3. How We Use Your Data

We use your data to:

• create and authenticate your account;
• generate, store, and display your trip itineraries;
• process payments and issue receipts;
• send transactional email (booking confirmations, password resets, billing receipts, the goodbye email when you delete your account);
• keep the service running (debugging, performance monitoring, fraud prevention);
• (with consent) understand how the product is used so we can improve it; and
• comply with legal obligations (tax records, responding to lawful requests).

We do not sell your personal data and we do not use your data to train any AI model.

4. Marketing Email

We do not send marketing email by default. If we ever introduce a product newsletter, it will be opt-in only and every message will contain an unsubscribe link.

5. Subprocessors and Recipients

We share personal data with the following subprocessors. The full, dated list (with jurisdiction, purpose, data shared, and transfer safeguard) is maintained at the Subprocessor List page.

We will only share data with a third party outside this list where we are legally compelled to do so (court order, tax authority request, or regulator's lawful request).

6. AI Processing

What we send. The prompt sent to Anthropic for itinerary generation, and to OpenAI for image generation, includes the destination, dates, party size, interests, and budget you have entered. We do not include your name, email address, account ID, or any other identifier.

Training. Both providers contractually undertake not to train their models on data submitted via their commercial APIs:

• Anthropic: anthropic.com/legal/commercial-terms
• OpenAI: openai.com/policies/api-data-usage-policies

Retention by the provider. Each provider applies its own short-term retention for abuse-monitoring purposes (typically 30 days).

Limitations. AI output may be inaccurate, incomplete, or out of date. See the standalone AI Disclaimer.

7. How Long We Keep Your Data

When you delete your account we cascade-delete trips, activities, expenses, collaborator entries, reviews, notification preferences, and uploaded photos in our database and object storage immediately. Stripe will retain historic invoices for 7 years, a legal obligation we cannot waive.

8. Your Rights

Under UK GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• rectify inaccurate data (Art. 16);
• erase your account and personal data (Art. 17);
• restrict processing in certain circumstances (Art. 18);
• port your data to another service in a machine-readable format (Art. 20);
• object to processing based on legitimate interests (Art. 21); and
• withdraw consent at any time for analytics cookies and other consent-based processing.

The fastest way to exercise the access and erasure rights is in the app:

• Go to Settings → Privacy & Data to download a JSON file containing all your data.
• Go to Settings → Account ("Danger zone") to delete your account. Deletion is immediate and cascades through Clerk, Stripe, our database, and object storage.

If you would rather email us, write to team@waygenie.app and we will respond within one calendar month. You can also complain to the UK Information Commissioner's Office (ICO) if you believe we have mishandled your data.

9. Cookies and Similar Technologies

We describe cookies in detail in our separate Cookie Policy. In short: only strictly-necessary cookies are set before you give consent. Analytics and session replay are loaded only after you accept them in the cookie banner.

10. Children

WayGenie is not directed to children under 13 and we do not knowingly create accounts for them. If you are a parent or guardian planning a family trip and you include children's names, dates, or interests in the trip data, you are the controller of that information for the purposes of UK GDPR. You decide what to include, you can edit or remove it at any time, and you can delete the entire trip or your account at any time using the in-app controls.

If you become aware that a child under 13 has somehow created their own WayGenie account, please email team@waygenie.app and we will delete it.

11. Changes to This Policy

We will post the updated version on this page and update the "Last updated" date. For material changes we will also display an in-app banner for at least 14 days before the change takes effect. If the change concerns a new subprocessor, see section 15.

12. Contact

NextEraPro Ltd.
Email: team@waygenie.app

13. Automated Decision-Making and Profiling

We do not make any decision that produces a legal or similarly significant effect on you using purely automated means. AI itinerary suggestions are recommendations only; you are always the one who decides what to do.

14. Right to Object to Legitimate-Interests Processing

Where we rely on legitimate interests as the lawful basis (geocoding/weather/image lookups, support handling), you have the right to object. Email team@waygenie.app with a brief description and we will stop the processing unless we have a compelling legitimate ground that overrides yours.

15. Changes to Our Subprocessors

Before we add a new subprocessor, or move data to a meaningfully different category of subprocessor, we will:

• update the Subprocessor List page and bump its "Last updated" date; and
• show an in-app banner notifying signed-in users at least 30 days in advance.

If you object to the new subprocessor you may close your account using the in-app self-service deletion before the change takes effect.

16. International Data Transfers

Most of the subprocessors listed in section 5 are based in the United States. We rely on the following safeguards:

• EU–US Data Privacy Framework certification, where the processor holds it. Current certification status can be verified at dataprivacyframework.gov.
• UK International Data Transfer Addendum to the EU Standard Contractual Clauses, executed with each processor as a fallback safeguard.

The Subprocessor List maps each processor row-by-row to the specific safeguard relied on. You have the right to ask us for a copy of the relevant safeguard; email team@waygenie.app with the processor name.

Pexels, Open-Meteo, and Tally are EU-based; no transfer mechanism is required for those.

17. Security and Breach Notification

We protect your data with:

• TLS 1.2+ for all data in transit;
• encryption at rest for the Postgres database (Neon) and object storage;
• scoped, signed URLs for object-storage downloads, so trip photos are not publicly enumerable;
• password hashing handled by Clerk (we never receive plaintext passwords); and
• least-privilege access within the engineering team, with audit logging of administrative actions.

If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours (Art. 33 UK GDPR) and notify affected users within 72 hours using the email address on your account, unless a regulator instructs us in writing to delay.

18. Governing Law

This Privacy Policy is governed by the laws of England and Wales. Nothing in this policy removes any statutory right you have under UK or EU consumer law.