1. Who this policy covers
This policy explains how EverywhereApp handles personal information when you discover tours, use Freya, create an account, save travel plans, or contact us. It applies to EverywhereApp and its travelers, not to a tour provider’s separate booking service.
The operator of EverywhereApp, referred to here as “Everywhere”, “we”, or “us”, determines the purposes and means of processing covered by this policy. For privacy questions and requests, contact info@everywhere.tours.
This policy is an explanation of our practices, not a request for blanket consent. Using the app or accepting its Terms of Service does not replace consent where the law requires it. Your applicable privacy rights are not limited by this policy.
2. Information we collect
Account and profile information. This includes your name, email address, account identifier, username, profile image, and authentication information. Optional profile fields can include your birthday, location, biography, gender, and preferred language.
Travel information. We store the destinations and activities you select, visited destinations, saved tours and collections, budget and activity preferences, and information in your travel profile. The “travel passport” feature is a preference profile; it is not a request for an official passport or identity document.
Conversations and submitted material. We process messages to Freya, conversation history, images you submit, voice recordings sent for transcription, the resulting text, and related search context. We also retain preferences inferred from messages as travel memory when you use the relevant account features.
Accessibility information. If you provide disability or accessibility information in your profile or messages, we may store it as part of your travel information. This can reveal health or other sensitive information. Section 5 explains this separately.
Technical and usage information. Requests to the service can include an IP address, browser and device information, language, referring page, timestamps, and session identifiers. We record searches and result counts, and these records may be associated with an account or browser session. Security and error logs can include information about a request.
Communications and subscription records. When you contact us or subscribe to the newsletter, we collect the information you send. Newsletter records include your email address, confirmation and unsubscribe status, relevant dates, source page, and browser information.
3. Where information comes from
Most information comes from you, your device, and your activity in the app. Travel memory and other personalization can also contain information inferred from your requests, rather than fields you entered in a profile form.
If you sign in with Google, we receive the identity and profile information authorized by the sign-in process, such as your account identifier, email, name, and profile image. This sign-in does not give us general access to your Gmail messages or Google Drive files.
If another person shares a conversation or travel list containing information about you, that information can be included in the shared content. Please contact us if someone has submitted or shared your personal information without permission.
4. Why we use information and the legal grounds
Accounts and requested features. We use account details, searches, saved items, and conversation context to sign you in, answer requests, preserve history, and deliver the features you choose. Where contract necessity is a recognized legal ground, it applies only to processing objectively needed to provide those features.
Personalization. We use your selected and inferred preferences to adapt recommendations and responses. Optional processing that requires consent must have that consent; information being useful to the service does not by itself make every personalization activity necessary for a contract.
Security and reliability. We use technical records and relevant account information to prevent abuse, control request rates, diagnose problems, and protect the service. Where permitted, the legal ground is our legitimate interest in operating a secure, reliable service, balanced against your rights, or compliance with a specific legal obligation.
Support and legal matters. We use information to answer you, handle rights requests, investigate complaints, and meet legal requirements. The ground depends on the request: providing the requested service, complying with law, or a permitted legitimate interest in resolving disputes and protecting legal rights.
Newsletter and optional measurement. Newsletter subscriptions use email confirmation and can be withdrawn. Consent applies where required for marketing, optional cookies, or similar tracking. A legitimate-interest ground cannot replace consent where consent is mandatory.
The grounds available differ by jurisdiction. Where local law requires meaningful or explicit consent for a particular activity, that requirement prevails. You can ask us which ground applies to a specific use of your information. Declining optional information may limit the related personalization, but does not require you to disclose unrelated information to browse tours.
5. Accessibility and other sensitive information
Accessibility preferences and disability descriptions can reveal health information. Details in chat, images, or recordings may also reveal sensitive information about you or someone else. Provide only what is needed for your request; do not upload medical records, identity documents, or payment card details.
Information saved in your travel profile may be used as context for recommendations and AI responses. Do not assume that entering a health-related preference keeps it separate from the AI-assisted features.
Where explicit consent or another specific legal condition is required for sensitive information, that condition must be satisfied separately. This policy and general acceptance of the Terms of Service are not explicit consent. You may ask us to remove accessibility information or withdraw consent by contacting us.
An accessibility preference helps describe what you are looking for. It does not establish that a provider can meet your needs, and it is not a medical assessment.
6. Freya, voice, images, and travel memory
To answer a request, Freya can process your current message, relevant conversation history, search context, and travel profile. The app can derive and save travel interests from your messages and use them in later interactions. An inference can be wrong; you can update available profile fields or ask us to correct or remove saved information.
AI processing uses external services. The application supports Amazon Web Services Bedrock and OpenRouter, including model providers reached through OpenRouter, depending on the feature and configuration. Content needed for an answer or image interpretation can be sent to those services.
When you use voice input, the recording is sent for transcription through OpenRouter, and the resulting text can become part of your request and conversation. The transcription endpoint does not itself create an audio archive, but that does not mean providers or technical systems have no retention. Generated audio and its source text may also be processed by speech services.
Provider retention and permitted uses depend on the service and its contractual and account settings. This policy does not promise zero retention or authorize general-purpose model training through your acceptance of it. You can contact us for information about the providers and safeguards relevant to your data.
Personalization ranks or suggests travel options; it does not itself complete a booking or make a binding eligibility decision about you. If an automated result is inaccurate or affects your rights, contact us to request correction, explanation, or review where applicable.
7. Who receives information
Service providers. Hosting, database, storage, content delivery, email, authentication, AI, and support services process the information needed for their functions. The application uses AWS for cloud services, Google for sign-in, map-related services, and usage analytics (Google Analytics, as described in our Cookie Notice), Resend for email, and the AI services described above. Different features can involve different recipients.
People accessing shared content. A person with a valid sharing link can access the content exposed by that feature, as explained in section 8.
Travel providers and external websites. When you follow a booking link, your browser contacts the destination website, which receives technical information such as your IP address and may receive referral or referring-page information. Data you enter there is handled under that provider’s policy. EverywhereApp does not take your tour payment; check the booking provider’s information before submitting payment details.
Authorized personnel and advisers. Information may be accessed to operate the service, respond to you, investigate a problem, or obtain professional advice, where necessary for those tasks.
Legal disclosures and business changes. Information may be disclosed where required by law, necessary to establish or defend legal claims, or lawfully needed in connection with a business transfer. Such a transfer does not remove applicable privacy obligations or make unrelated uses automatically permissible.
EverywhereApp can earn commissions from referred bookings. A referral commission is not, by itself, a description of a personal-data sale. Privacy laws can define “sale”, “sharing”, and targeted advertising more broadly than an ordinary sale of a customer list. Any applicable opt-out rights remain available regardless of the label used for a commercial arrangement.
8. Conversations and lists shared by link
A shared conversation can expose its messages and search context to anyone holding the link, without requiring them to sign in. Recipients may save a copy or continue from a copy of the shared conversation.
A shared bucket list can display saved experiences together with your name, username, and profile image. A hard-to-guess link is not the same as restricting access to named people. Anyone receiving it can forward it.
Review content before sharing it. You can disable a conversation’s sharing link through its sharing controls. Other features may have different controls; contact us if you need help restricting access. Disabling a link does not erase screenshots or copies already held by others.
9. Cookies and browser storage
We use cookies and browser storage for functions such as sign-in, session continuity, saved interface state, conversation continuity, and remembering cookie choices. Some information is kept in your browser and some on our servers.
The cookie banner offers accept, decline, and category choices. Clearing browser storage can remove local preferences and conversation state, but does not itself delete server-side records. Rejecting optional cookies also does not close an account or erase saved search history.
Optional tracking that requires consent must be distinguished from storage needed to deliver a requested feature. Browser settings can restrict cookies, microphone access, and other permissions. Restrictions may affect the feature concerned.
Do not assume a browser “Do Not Track” setting automatically changes all server-side processing. Legally recognized opt-out preference signals are subject to the requirements of the law that applies. You can also contact us about your privacy choices. Cookie details and tracking controls require separate information; this policy does not replace them.
10. International processing
Because EverywhereApp uses international cloud and service providers, your information may be processed outside your country, including in the United States. Foreign laws may provide different protections and may allow access by local authorities.
Where a transfer requires a legal safeguard, the applicable mechanism must be in place. Depending on the jurisdiction and destination, that can involve an adequacy decision, approved contractual safeguards and additional measures, or another legally permitted mechanism. Using the app is not blanket consent to an otherwise unlawful transfer.
Contact us to ask where your information is processed and for information about the safeguards relevant to a transfer, including a copy where you are entitled to one. Disclosure may be limited as necessary to protect confidential information and other people’s rights.
11. How long information is kept
Retention depends on the type of information and why it is needed. Account information, saved tours, preferences, travel memory, and conversations support your continuing use of those features. Deleting one conversation does not necessarily remove preferences already saved separately in your travel profile.
For technical and security records, the relevant criteria are troubleshooting needs, incident investigation, abuse prevention, and any legal preservation requirement. For support and legal records, they include the resolution of the request, applicable limitation periods, and legal duties.
Newsletter records include subscription and withdrawal status so that mailing choices can be respected. A limited suppression record may be needed after an unsubscribe to avoid sending further marketing.
Deletion from an active account does not necessarily mean immediate removal from backups, security records, or providers’ systems. Requests must be assessed across the relevant systems and subject to lawful retention exceptions. Contact us for the retention information applicable to a particular category or request.
Clearing your browser, signing out, or uninstalling a browser does not delete information held on our servers. Use the available deletion controls for individual items or send a privacy request.
12. Keeping information secure
The service uses authenticated access for account features and controls intended to restrict access to personal information. No online service can eliminate every security risk. Keep your sign-in methods secure and take care with links that expose your content.
If you believe an account or sharing link has been compromised, contact us. Where a personal data breach requires notification to individuals or authorities, the applicable notification duties and time limits govern our response.
13. Your choices and privacy requests
You can edit available profile fields, manage saved items, delete supported history items, disable conversation sharing, and unsubscribe from newsletter emails using their links. Browser permissions control access to your microphone. These actions affect different parts of the service and are not interchangeable.
You can request account closure and deletion by emailing info@everywhere.tours. Account deletion is handled as a request, not a promise of immediate automated erasure. The conversation export feature provides conversations and messages; it is not necessarily a complete copy of all personal information.
Depending on applicable law, you may request confirmation of processing; access and a copy; correction; deletion or anonymization; restriction; portability; information about recipients; and withdrawal of consent. You may also have rights to object to particular processing, opt out of sale, sharing or targeted advertising, limit certain sensitive-data uses, or obtain review of qualifying automated decisions.
Where processing relies on consent, you may withdraw it without affecting the lawfulness of processing before withdrawal. We may still need to retain certain information under another lawful obligation. Objections to direct marketing will be respected.
Send requests to info@everywhere.tours with enough information to locate the relevant account or records. Do not send passwords or identity documents in your first message. We may ask for proportionate verification or, for an authorized agent, proof of authority. You do not need to create an account to make a request.
We will respond within the time required by applicable law and explain any lawful refusal, extension, or permitted charge. Exercising a privacy right will not result in unlawful discrimination. Where an appeal is available, you may reply asking for review of our decision. This does not prevent you from contacting a competent regulator.
14. Rights in different countries
European Economic Area and United Kingdom. Where GDPR or UK GDPR applies, the relevant access, correction, erasure, restriction, portability, objection, and consent rights apply. Requests are generally answered within one month, subject to lawful extensions and notice. You may complain to the authority in your place of residence, work, or the alleged infringement, as applicable.
United States. Where a state privacy law applies to our activities, residents may have rights to know, access, correct, delete, obtain portable data, use an authorized agent, and opt out of specified processing. California additionally provides rights concerning sale or sharing and certain sensitive-information uses. Some laws provide an appeal right. Eligibility, exceptions, and deadlines depend on the applicable law.
Brazil. Where the LGPD applies, rights can include confirmation, access, correction, anonymization, blocking or deletion of unnecessary or unlawfully processed data, portability, information about recipients and consent choices, and review of qualifying automated decisions. You may seek assistance from the ANPD.
Chile. Rights under the data protection law in force apply, including access, correction, and deletion or blocking where legally available. The changes introduced by Law 21.719 are scheduled to take effect on December 1, 2026; rights and duties introduced by that reform apply from their legally effective dates.
Canada and other countries. Applicable local laws may provide additional consent, access, correction, withdrawal, complaint, or other protections. The examples above are not an exhaustive list and do not restrict rights available elsewhere. Contact us with your location and request so that the applicable requirements can be assessed.
15. Children and family travel
EverywhereApp is not directed to children. People who cannot independently use the service and provide the permissions required by applicable law should not create an account or submit personal information. An adult can plan family travel using their own account without supplying unnecessary identifying information about children.
If you believe a child has provided information without the required authorization, contact us so that we can investigate and take the action required by law. Describing family tours does not mean the app operates a verified parental-consent service.
16. Changes and contact
We will identify changes by updating the revision date. Material changes require appropriate notice, and a new purpose requiring consent requires that consent before the relevant processing. Continuing to use the service is not, by itself, consent to a new data use.
For questions, complaints, access requests, or account deletion, contact info@everywhere.tours. Tell us which feature or information your request concerns so that we can direct it appropriately.