Privacy policy

• Owner: Luca Acosta Iglesias
• Contact for privacy matters: support@flisgo.app

• Account: email address, first name, last name, password (stored hashed, never in plain text), sign-up date, and the date and version of the terms and this policy you accepted.
• Content you enter: budgets, expenses, amounts, who pays each expense, debts and settlements between participants; trips (name, description, country, image, stops, dates, events and tasks); documents you upload to a trip (images or PDF); and the messages you write in the AI chat.
• Technical data: IP address and browser (user agent) associated with your sessions, session identifier and start and expiry dates. Our hosting providers also log the IP address and browser of each request.
• Invitations and participants: when someone invites you to a budget or trip, or you invite someone else, the invitation is stored and you become participants. Participants can see each other’s first and last names and the data shared in that budget or trip.
• Role requests: if you ask for the Pro role from your profile, your request is stored (date, the optional message you write and an administrator's decision, with its date and note). Only Flisgo administrators can see it.

Please do not upload to Flisgo documents or data you do not need to organise your trip (for example, copies of identity documents), and do not enter other people’s personal data without their knowledge.

Flisgo does not use analytics or advertising cookies, does not sell data and does not send commercial communications.

We do not disclose your data to third parties except where legally required. To provide the service we use the following providers (data processors):

You can find more information about Railway, Vercel and the other providers in their privacy policies.

• The API and the database are hosted on Railway, in the European Union.
• PostHog is used in its European Union region.
• Cloudinary, Google (Gemini and Gmail), Cloudflare, Vercel and Resend are providers that may process data outside the European Union, for example in the United States.

When a provider processes data outside the European Union, the transfer relies on an adequacy decision of the European Commission or on standard contractual clauses (Chapter V GDPR).

Flisgo uses Google’s Gemini models to generate itineraries and for the chat that modifies a trip’s stops and events when you ask it to. To do so, the following is sent to Google:

• Country, name and description of the trip, stops, dates, times and the preferences you choose, including any free text you write.
• The messages you write in the AI chat.

Google processes this information to generate the itineraries and the chat replies. Google may use the data it receives to improve its services, and Google staff may review it. By using these features, you accept that your data is sent to Google for that purpose.

Your email, first name and last name, the documents you upload and the content of budgets are not sent. If you write personal data in the name, description or free text of a trip, it will be sent along with the rest. We recommend that you do not.

Results may contain errors: check them before relying on them. The AI does not make decisions with legal effects about you.

• Account and content: for as long as you keep your account. When you delete it, your personal data is deleted or anonymised (see section 8).
• Sessions: they expire after 7 days and only the last three are kept.
• Password reset link: it expires after 15 minutes.
• Hosting provider logs: the period set by each provider (Railway and Vercel) according to its plan. We do not use them for any other purpose.
• Backups: if the provider keeps backups, data may remain in them for the length of their usual rotation cycle.
• Legal obligations: we may keep blocked the data needed to deal with possible liabilities for the legal periods.

Expenses, debts and settlements in a budget you share with other people are kept for as long as any of the participants keeps that budget and still count in their balances, because they affect their accounts. After you delete your account they will appear without your name, as “Flisgo” followed by an identifier (for example, “Flisgo #3FA9C2”), and any participant will be able to record the payment of pending debts. Tasks assigned to you in shared trips will become unassigned. The content of a shared trip that has no associated author (stops and events) is kept for as long as the trip exists.

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent where it is the legal basis, by writing to support@flisgo.app. We will reply within one month at most.

In addition, from your profile in Flisgo you can download your data as JSON and delete your account. When you delete it, your sessions and credentials are deleted and your personal data is anonymised. You leave shared budgets and trips: the other participants keep theirs, and if you were the only person in the budget or trip, it is deleted completely.

If you believe we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es, C/ Jorge Juan, 6, 28001 Madrid).

• Communications with Flisgo take place over HTTPS.
• Passwords are stored hashed, not in plain text.
• Access to budgets and trips is checked on the server: only their participants can view and modify them.

No measure is infallible. If you find a security problem, write to us at support@flisgo.app (also in /.well-known/security.txt).

Flisgo is not aimed at children under 14.

If we make a significant change to this policy, we will publish the new version on this page with its date and version number, and we will let you know if the change affects how we process your data.