Privacy & Cookie Policy

We collect the minimum data needed to run ViaKyoto and plan your trips:

• Account data: your email address and authentication identifiers, created when you sign up or log in.
• Trip content: the trips, itineraries, canvases, and preferences you create or save.
• Usage and device data: basic technical information (such as browser type, approximate region, and pages viewed) needed to operate, secure, and improve the service.

We do not sell your personal data, and we do not use it to build advertising profiles.

We use a small number of cookies and local storage entries. These fall into two groups:

• Strictly necessary: sign-in sessions, security, and your interface preferences (for example theme and language). These are required for the service to work and do not need consent.
• Analytics (optional): if and when enabled, these help us understand aggregate usage. They are only set with your consent, and you can withdraw consent at any time.

Under the GDPR, we rely on the following legal bases:

• Contract: to provide the account and planning features you ask us for.
• Legitimate interests: to keep the service secure, reliable, and improving, balanced against your rights.
• Consent: for optional analytics and any non-essential cookies. You can withdraw consent at any time.
• Legal obligation: where we must retain or disclose data to comply with the law.

We keep personal data only as long as your account is active or as needed to provide the service, then delete or anonymise it within a reasonable period, unless a longer retention is required by law. Trip content is kept until you delete it or close your account.

If you are in the EU/EEA (and in many other regions), you have the right to:

• Access the personal data we hold about you.
• Rectify data that is inaccurate or incomplete.
• Erasure(“right to be forgotten”): ask us to delete your account and personal data.
• Portability: receive a copy of your data in a structured, machine-readable format.
• Restrict or object to certain processing, and withdraw consent where processing is based on it.

To exercise any of these rights, contact us using the details below.

We store and process personal data within the European Union / European Economic Area. If any processing ever takes place outside the EU/EEA, we will put appropriate safeguards in place (such as the European Commission’s Standard Contractual Clauses) and update this policy accordingly.

For any privacy question or to exercise your rights, contact the ViaKyoto team. A dedicated privacy contact address will be published here before this policy takes effect.