Privacy policy

The controller is [JURIDISKT NAMN] (VanTastika), company reg. no. [ORG-NR], [ADRESS], Sweden.

Privacy questions: privacy@vantastika.se.

We store your e-mail address, how you sign in (e-mail, Google or Apple), language, and when you accepted the terms and this policy. Passwords are stored only as a hash. If you sign in with Google or Apple, we receive your name, e-mail and an ID from them. When you delete your account, we revoke the Apple sign-in.

Legal basis: contract (Art. 6(1)(b) GDPR). Proof that you accepted this policy is kept while the account exists (Art. 6(1)(c) and 7(1)).

Trips, stops, checklists, budget, expenses, fuel, saved places, wish lists, vehicle details, service, inspections, receipts and documents. Photos are stored privately. We remove GPS and camera data (EXIF) from vehicle and trip photos before they are stored.

Legal basis: contract (Art. 6(1)(b)). Kept until you remove it or delete your account.

Messages reach the person you write to. Posts, comments, reviews, VanMarket listings and trips you share are visible to the members you share them with. A shared trip is shown without its start and end point.

Your profile is private by default. Public profile, appearing in people search, country, vehicle type and trip status are your choice under Profile → Privacy (consent, Art. 6(1)(a)).

When you delete your account, your messages are removed. The recipient may keep a copy of a message you sent them, without a link to your account.

The app uses your location only when you use a feature that needs it, such as the map, a route, weather or nearby places, and only if you allowed it in your phone.

Your location is stored only when you save a place yourself, share your location (Friends nearby, live trip, SOS) or turn on the travel diary. The travel diary is off by default and keeps at most 120 days of track per trip. A shared location is kept until you stop sharing or delete your account.

Friends nearby is optional and off by default (consent, Art. 6(1)(a)). Your location is shared with your friends only while the switch under Profile → Privacy is on and you start sharing yourself. Pulse ("Europe right now") only shows combined areas with at least five people, never individual members.

The voice command "Tell me about this place" uses the built-in speech recognition of your phone (from Google on Android). The microphone listens only after you tap the microphone button, for at most ten seconds. We receive only the recognised text and do not store it.

When you use an AI feature yourself, such as a question, a trip suggestion or receipt reading, only what that feature needs is sent to OpenAI: your text and language or the receipt file. Under our agreement OpenAI does not use the data to train its models. AI makes no decisions with legal effect for you.

Photos you share with other members are checked automatically by OpenAI before they are published, to stop illegal and abusive content (legitimate interest, Art. 6(1)(f)). Only the cleaned photo and its caption are sent, without name or account ID. If a photo is stopped, you can contact us to have a person review it.

We record the number and cost of AI calls to set limits and stop abuse (legitimate interest, Art. 6(1)(f)). The log is kept for 12 months.

To send notifications we store a push token, an app device ID and the platform. Notifications go through Apple (iOS) or Google Firebase (Android). Account e-mails such as confirmation and password reset are sent through STRATO in Germany.

We send tips and news by e-mail or push only if you turned it on (consent, Art. 6(1)(a)). It is off by default.

Statistics on how the app is used (screens and events in the app, device type, country, app version, a cleaned referrer and a session ID) are collected only if you turned them on. They are off by default and are not shared with any analytics service. We do not use Google Analytics or advertising cookies.

If the app crashes, we store the error with your user ID, device and a cleaned path so we can fix it (legitimate interest, Art. 6(1)(f)). At sign-up, Cloudflare Turnstile checks that you are not a robot.

The app stores what it needs to work on your phone or in your browser: sign-in, language, country, your choices in this policy, offline maps and your current trip. This is necessary for the service and needs no consent. Statistics are stored only if you turned them on. We use no tracking or advertising cookies, so there is no cookie banner.

When you contact us or report content, we store the case. Closed support cases are deleted after 12 months. Live road reports are deleted after 24 hours.

VanTastika is not meant for children under 16. If we learn that a child has an account, we delete it.

If we change this text, the app tells you once the next time you open it. Optional choices are never changed unless you change them yourself.

We store data with Supabase in Ireland. The providers below receive only what the feature needs and have an agreement with us. For providers outside the EU/EEA, the EU Standard Contractual Clauses (SCC) apply and, where the provider is certified, the EU–US Data Privacy Framework (DPF).

We reply within 30 days and may need to confirm that it is you.

• Get a copy of your data (Art. 15 and 20): write to privacy@vantastika.se and we send it in a machine-readable format.
• Correct data (Art. 16): edit it directly in the app.
• Delete everything (Art. 17): Profile → Privacy → Delete account. If you cannot sign in, vantastika.se/en/delete-account explains how to request deletion by e-mail.
• Withdraw consent (Art. 7(3)): switch it off under Profile → Privacy. It applies from then on.
• Object and restrict (Art. 18 and 21): write to us.
• Complain to the Swedish Authority for Privacy Protection (IMY), imy.se, or the authority where you live.

Account, profile, trips, places, vehicles, receipts, documents, photos, messages, posts, listings, shares, push tokens and consents are deleted. Draft, pending and rejected place submissions are deleted completely.

We keep only proof that the account was deleted (ID, hash and time) and security logs as listed under Retention. Already approved public place facts may remain without any link to you, without photos, descriptions or contact details.

E-mail: privacy@vantastika.se (no sign-in needed).

Post: [JURIDISKT NAMN], [ADRESS], Sweden.