This is a translation provided for convenience. In case of any discrepancy, the Ukrainian version prevails.
Privacy Policy
Version of 30 September 2026
1. Who processes the data
1.1. The personal data controller is individual entrepreneur Nikita Serhiiovych Karetnikov, RNOKPP 3734801952, 3b Hrushevskoho St., Brovary, Kyiv Oblast, Ukraine, hello@valizka.com.
1.2. Data is processed in accordance with the Law of Ukraine "On Personal Data Protection" and, for users in the EU, the General Data Protection Regulation (GDPR).
2. What data we collect
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Account | Email for link-based sign-in; when you sign in with Google — your Google account ID, name and profile photo address; when you sign in with Apple — your Apple ID identifier, email (possibly a hidden Apple relay address) and your name if you shared it on the first sign-in, plus a technical Apple token we use to revoke the sign-in when you delete your account | Sign-in, saving trips | Performance of contract |
| Trip data | Cities, dates, budget, number of travellers, interests, citizenship (passport country) | Building the itinerary and searching offers | Performance of contract |
| Travel profile | Settings derived from your forms and choices | Personalising future plans | Legitimate interest |
| Booking requests | Name, email, phone, selected tickets and accommodation | Processing of the request by staff | Performance of contract |
| Payment | Amount, status, last 4 digits of the card | Payment records, refunds | Performance of contract, law |
| Ticket data (only when online ticket sales are open; currently closed) | Full name, date of birth, sex, passport number and expiry date, phone number of each passenger | Issuing the ticket with the carrier | Performance of contract |
| Technical data | IP address, device type, device identifier (the X-Valizka-Device header), error logs, records of model calls without their content | Security and stability | Legitimate interest |
| Location (only if you turned sharing on) | Last point (precise or approximate — as you allowed), its accuracy and time, phone battery, "I'm here" mark | Showing you to the friends or shared-trip members you chose | Your consent |
| Friends and shared trips | Name or the first part of the email, friend connections and blocks, reports, trip members, notes and packing list, trip expenses (amount, category, who paid and who shares it) and votes on options | Running the friends map and shared trips | Performance of contract |
| Reports | Reason, comment, the trip and what the report is about (an assistant answer, the plan, a member, note or list item of a shared trip), plus an excerpt of the assistant answer if you added it yourself | Review of the report by an operator | Legitimate interest |
2.1. We do not collect full payment card details — they are processed by a payment provider: WayForPay for the Trip Pass (payments are not connected yet) and Stripe for tickets (only when online ticket sales are open; currently closed).
2.2. Your location is seen only by those you chose to show it to: mutual friends according to the sharing mode you selected, a friend you shared it with temporarily, or members of a shared trip who also turned sharing on — and only on the trip dates. Ghost mode hides you from everyone. There is no background tracking: the point is updated only while the map is open. We do not keep a movement history — only the last point. Members of a shared trip see each other's names but not email; friends see both names and email in the friends list. Members of a shared trip see its plan, including the route from your departure city, airports and tickets. They do not see your form answers (except the dates, mode of transport and number of travellers), notes for families, mobility data, budget, the description of your mandatory event (only that this time is taken) or what your card gives you (lounges). They see free text the model wrote in the plan as it is — and it may mention any of these. Members' names are the ones they set themselves; anyone who hasn't set a name appears as "Member" with a number. Members of a shared trip also see the expenses entered in it (amount, currency, category, note, who paid and who it was split between), the “who owes whom” summary and the options the group is voting on, with the names of who voted for what — names only, no email. Every member can enter an expense; only the trip owner can change or remove someone else's.
2.3. The "Add to calendar" button builds a file (.ics) with the trip days, check-in and check-out dates, reminders for when Ukrzaliznytsia ticket sales open and the day plan; for the trip owner it also includes the title, time and place of the mandatory event and tickets issued through Valizka (without the booking reference or passenger details). Members of a shared trip and anyone who opened its public link get the file without the owner's event and tickets. The file is built at your request and is not stored on the server.
3. Sensitive data
3.1. If you indicate reduced mobility, an event such as a doctor's appointment, or travel with children, this information may relate to health or to minors.
3.2. We process it only to build your itinerary and only with your explicit consent, which you give via a separate checkbox before entering it. You can withdraw consent by removing this data from the trip or by deleting your account.
3.3. Such data is not used to train models and is not shared with transport or accommodation suppliers, unless you include it in a booking request yourself.
3.4. The title of the mandatory event (for example, a doctor's appointment) reaches your calendar only if you export the trip file yourself (clause 2.3). From then on, your calendar's rules apply (Google, Apple, Microsoft or another provider), and only you can delete the event there.
4. Artificial intelligence
4.1. To build an itinerary, your trip data is sent to AI providers: Google (Gemini) and DeepSeek; Anthropic (Claude) may also be used. Their answers are merged into one plan.
4.2. DeepSeek processes data on servers in China. For users in the EU, DeepSeek is not used: the itinerary is built by the other providers.
4.3. We store "request — agreed plan" pairs to train Valizka's own model. These records do not contain email, name, phone or the sensitive data described in section 3. You can opt out in your account settings (on the website: account menu → "Settings", switch "Don't use my trips to train the Valizka model") or by emailing hello@valizka.com from your account's address. As soon as you opt out, existing records from your trips are deleted and no new ones are stored.
4.4. The “Ask Valizka” assistant. When you write to the assistant, your message, the earlier messages of that conversation and the data of the trip being discussed (plan, dates, route, passport citizenship, entry requirements) are sent to Google (Gemini) to get an answer; assistant messages are not passed to other AI providers. The information described in section 3 is not sent to the assistant unless you write it in a message yourself. We do not store the conversation text on our servers and do not use it to train models: the conversation history is kept only in your browser and is deleted when you sign out or delete the trip. On the server we record only technical details of each call — the model, number of tokens, duration and whether it succeeded — without any text. A plan change suggested by the assistant is made only after you confirm it and is built the same way as the itinerary (section 4.1). The exception is a report about an assistant answer: an excerpt of that answer (up to 2,000 characters) that you added to the report yourself is stored together with the report (section 6.5). You can attach a photo to a message to the assistant (for example, a sign, a menu or a board at a station): it is sent to Google (Gemini) together with the message to get an answer, and we do not store it — not on our servers, not in logs and not for training models. The assistant is set up not to identify people in photos. To answer more precisely, the assistant may look up Valizka data (entry requirements, bus timetables, border queues, Ukrzaliznytsia ticket sales) and passes only what the lookup needs — for example, cities, a date or the passport country; for places to eat along the trip’s road, the road coordinates, as in the “Where to eat on the way” block (section 5).
4.5. Ticket import. If you add a photo, screenshot or PDF of a ticket to bring it into a trip, the file is sent to Google (Gemini) for recognition. A ticket may contain your name, booking code and other data printed on it — these are sent to Google together with the file. We do not store the file itself; only the ticket details you have reviewed and confirmed are added to the trip.
4.6. Voice. Speech recognition for voice input and reading answers aloud are performed by the built-in tools of your browser or phone under their maker’s rules (for example, in the Chrome browser recognition may happen on Google’s servers). Valizka receives only the recognised text — as an ordinary message to the assistant (section 4.4); we do not receive or store audio.
4.7. Generated images. A trip cover may be generated by Google (Gemini): for this, Google receives an image description based on the trip destination, without your contact details. Such an image is labelled “AI illustration” and is not a photo of the place.
5. Who we share data with
| Recipient | What they receive | Purpose |
|---|---|---|
| Google, Anthropic, DeepSeek | Trip parameters | Itinerary generation |
| Assistant messages, photos you attach to them and data of the trip being discussed | “Ask Valizka” assistant answers | |
| Photo, screenshot or PDF of a ticket you import | Recognising the ticket to import it into a trip | |
| Image description based on the trip destination | Trip cover (AI illustration) | |
| Google sign-in request | Signing in with Google, when you choose it | |
| Apple | Sign in with Apple request; when you delete your account, a request to revoke the sign-in | Signing in with Apple, when you choose it |
| Kiwi.com, FlixBus, SerpAPI (Google Flights, Google Hotels), Airbnb | Cities, dates, number of travellers | Searching tickets and accommodation |
| Booking.com (Demand API) | City, dates, number of adults, country of the departure city and language — no name, email or phone | Searching accommodation and car rental with live prices; you book on Booking.com via the link |
| LiteAPI (Nuitée Travel Limited, Nuitee Connect) | Accommodation: city or the coordinates of its centre, dates, number of adults, country of the departure city and language; flights (when enabled): airports, dates, number of adults and cabin class — no name, email or phone | Searching accommodation and flights with live prices; you book on the LiteAPI booking site via the link, when there is one |
| LiteAPI (Nuitée Travel Limited) and Stripe as its payment service | Only when you book a stay through Valizka: first name, last name, email and phone (if given) of the person checking in, the hotel, dates and number of adults. You enter your card in LiteAPI’s Stripe form — it never reaches us. We keep the hotel, dates, amount, status and booking number | Booking accommodation and payment (for now — test only, with no real booking or charge) |
| Geoapify, Open Charge Map | Coordinates and route; for the departure city — coordinates rounded on the device to about 1 km | Maps, departure city from your location, walking segments, charging stations |
| OpenStreetMap (map tiles), Overpass servers, Wikimedia, Unsplash | IP address and request data (map area, place); tiles and some requests go directly from your phone or browser | Map background (until tiles go through Geoapify), fuel stations and places along the road, photos of cities and places |
| Resend | Email, message text | Sending emails and sign-in links |
| WayForPay | Payment data | Accepting Trip Pass payments (not connected yet) |
| Duffel, Stripe | Ticket data, payment data | Issuing and paying for tickets — only when online ticket sales are open; currently closed |
| Railway | All Service data | Server and database hosting |
| Backup storage | Encrypted database backups | Recovery after a failure |
5.1. We do not sell personal data and do not share it for advertising.
5.2. Some recipients are located outside Ukraine and the EU (including the USA and China). Transfers from the EU rely on standard contractual clauses or your consent.
6. Retention
6.1. Account and trip data are kept for as long as the account exists. An anonymous profile without sign-in (the device's travel profile and guest trips) is deleted after 12 months of inactivity: its trips the same way as a trip you delete, completely within 30 days. A trip you delete disappears immediately. Reduced mobility, the mandatory event, children, budget, passport, departure city, notes, tickets and accommodation are also removed from it immediately. So that support can restore the trip, until it is permanently erased we keep its destination, dates, mode of transport, the route's cities with the number of nights, the day-by-day schedule of places to visit, language, its link to your account or device, internal flags (access terms, whether the link was public), creation and modification times, and related technical records that contain none of its content. All of this is erased permanently within 30 days of deletion. Previous versions of a trip plan (up to the last 10, for “Version history” and “Restore”) are copies of the plan and questionnaire at the time of the change; only the trip owner can see them, they are kept for as long as the trip exists, and they are deleted immediately when the trip is deleted, the account is deleted or a shared trip is handed over to another member. Tickets a member added from their own bookings are also removed from the versions when they leave the trip. A previewed but not applied plan edit is kept for up to 30 minutes.
6.2. Booking requests (with email, phone and name) are kept while the account exists and are deleted together with it — as are requests sent without signing in from the same email. Bookings that no money touched are erased when the account is deleted. If there was a payment or a hold, or a ticket was issued, a record of the money movement remains without personal data — amount, currency, statuses, payment and order numbers, booking code and ticket numbers: accounting and protection against payment disputes require it, so we do not erase it automatically. Stay bookings through LiteAPI: unfinished ones (not paid), ones LiteAPI declined and test bookings are erased when the account is deleted; real paid bookings remain as a record without personal data — hotel, dates, amount, status and the LiteAPI booking number (we don’t hold the guest’s name, email or phone: they go only to LiteAPI).
6.3. The last location point is not shown once it is older than 24 hours and is deleted after 72 hours; immediately when you turn sharing off, go into ghost mode or sign out of your last session; a point that no one can see any more (a temporary share or the trip dates have ended) is deleted within 6 hours. Requests to share location disappear after a day; friend and trip invitations, a week after they expire. If you delete your account, a shared trip of yours with other members passes to one of them. Your form answers are removed from it (the destination, dates, mode of transport and route cities stay), along with the separate plan fields that came from them: the mandatory event, notes for families, mobility and event statuses, budget notes, checklist tips and what your card gave you (lounges). Free text the model wrote in the plan (day titles, overview, notes on places) stays as it is and may mention the same things — to remove it too, delete the trip before deleting your account. Your notes in other people's trips are deleted. A shared trip's expenses stay with the group for settling up when you leave it, the owner removes you or you delete your account — but without your name or identifier: you appear in them as an anonymous “former member”. Your vote is deleted, and an option you proposed stays with the group without an author. A deleted trip takes all its expenses, votes and options with it.
6.4. Technical data: records of model calls (model, number of tokens, duration, success — without content) — 180 days; events with a device identifier — 90 days; the counter of sign-in emails per address (a hash of the email, not the address itself) — up to one day; the “city from coordinates” cache (a cell of about 1 km; coordinates are rounded on the device) — 30 days; the road cache — 7 days; the cache of offer search responses — 30 minutes; the counter of new routes from one IP address — up to one day. Database backups are kept for 14 days in external storage, and also according to Railway's backup schedule.
6.5. Reports are kept for 12 months from submission together with everything added to them, including an excerpt of an assistant answer, and are then deleted.
7. Your rights
7.1. You have the right to obtain a copy of your data, correct it, delete your account, restrict or object to processing, withdraw consent and receive your data in a machine-readable format.
7.2. Send requests to hello@valizka.com; we respond within 30 days. You can also delete your account yourself — in the app or on the website (account settings or the “Delete your account” page).
7.3. You may lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights or, in the EU, with the data protection authority of your country.
8. Cookies
8.1. We use only strictly necessary cookies for sign-in and operation of the Service. There are no analytics or advertising cookies.
9. Children
9.1. The Service is not intended for persons under 16. Data about children travelling with you is entered by you as the adult responsible for the trip.
10. Changes
10.1. We will notify you by email of material changes to this policy at least 14 days in advance. Translations are provided for convenience; in case of discrepancies, the Ukrainian version prevails.