Privacy Policy
Stippl B.V., stippl.io · Last updated: October 2026 · Effective: October 2026
1. Who We Are
This Privacy Policy explains how Stippl B.V. ("Stippl", "we", "us", "our") collects, uses, and protects your personal data when you use our website at stippl.io, our mobile applications, and related services (collectively, the "Service").
Stippl B.V. is the data controller for personal data processed through the Service.
Contact details:
Stippl B.V.
Ruimzicht 129
1068CS Amsterdam, the Netherlands
KvK: 82938865
Email: [email protected]
Data Protection Officer (DPO): We have not appointed a DPO as we do not meet the threshold requirements under Article 37 GDPR. Privacy enquiries can be directed to [email protected].
2. Scope
This Policy applies to all personal data we process in connection with the Service, under the General Data Protection Regulation (GDPR) and Dutch law.
Stippl for Business. If you use Stippl for Business, this Policy covers the personal data we process about you as an account holder and about your colleagues as authorised users. Personal data that you enter about your own clients ("Client Data") is processed by Stippl as a processor on your behalf; that relationship is governed by our Business Terms (Section 9), including the sub-processor list there, and, where agreed, a Data Processing Agreement, not by this Policy. Your clients receive their privacy information from you.
3. Personal Data We Collect
3.1 Data You Provide
- Account: email address, name, password (stored as a hash), and optional profile information such as age, hometown, and a profile photo. If you sign in with Google, Apple, or Facebook, we receive your name and email address from them.
- Trips: itineraries, destinations, notes, journal entries, photos and videos, expenses, and anything else you add.
- Traveller preferences: optional preferences such as travel pace, budget, room preferences, dietary requirements, and special requests. Some of these (for example dietary requirements) may reveal information about your health or beliefs; we use them only to personalise your travel planning, including suggestions from our AI assistant.
- AI assistant: the messages you send and any images you share in the chat.
- Forwarded booking emails: the content and attachments of booking confirmations you forward to your trip's Stippl email address, used to add the booking to your trip.
- Bookings and purchases: for Stays bookings, eSIMs, photobooks, and subscriptions, the details needed to complete them (see Section 5 for Stays).
- People you invite: if you invite someone to a trip, we use their email address to send the invitation.
- Support and feedback: messages you send our support team and answers you give in surveys.
- Business contacts: if you contact us about Stippl for Business, your name, email address, company name, and website.
3.2 Data We Collect Automatically
- Usage and device data: screens and pages visited, features used, search queries, IP address, device and browser type, and device identifiers.
- Location: approximate location from your IP address. With your permission, the app uses your device's location while it is open, to center the map and to find hotels near you; for that search it is sent to our booking partner. It is not saved to your account.
- Session replay: recordings of how the interface is used (taps, scrolls, screens), on the website with your consent and in the app for a sample of users (see Section 12).
- Email interaction: whether our emails are opened and which links are clicked.
3.3 What Others Can See
Each trip has its own visibility setting: trip members only, your followers, or everyone. Trips set to everyone appear on your profile, can be viewed by anyone with the link, and can appear in search engines, together with your display name, username, and profile photo. Trips set to your followers appear on your profile only for your followers, and trips set to members only do not appear on it; neither is shown to search engines. Whatever the setting, anyone who has the link to a trip can open it. Booking details are only shown to trip members; booking numbers in your notes are hidden from others. You can change the setting for each trip at any time.
3.4 ChatGPT and Claude
You can connect your Stippl account to ChatGPT (OpenAI) or Claude (Anthropic) and ask the assistant to save or change trips in Stippl. When you do:
- What we receive: only what the assistant sends to save or change a trip: the trip name, start date, destinations, and the places, times and notes for each day. We do not receive your conversation.
- What the assistant receives: our answers to its requests: the names, dates and links of your trips, and which places were added. OpenAI and Anthropic handle this under their own privacy policies.
- Finding places: to find the places and destinations on the map, we send place and city names to Serper, LocationIQ and Google. No account data is sent.
- The connection itself: we keep a record of each connection (which assistant, when it was made and last used) and a hashed key that keeps the assistant signed in. The assistant loses access when you disconnect Stippl in its settings, change your Stippl password, or delete your account.
4. How We Use Your Personal Data
| Purpose | Legal Basis |
|---|---|
| Providing the Service: your account, trips, AI assistant, bookings, purchases, and subscriptions | Art. 6(1)(b), performance of contract |
| Service emails and notifications (confirmations, receipts, support, trip reminders) | Art. 6(1)(b), performance of contract / Art. 6(1)(f), legitimate interests |
| Emails about Stippl's features and offers; you can opt out at signup, in your settings, and in every email | Art. 6(1)(f), legitimate interests |
| Personalising content and reminders based on your trips | Art. 6(1)(f), legitimate interests |
| Improving the Service: usage analytics, email open and click measurement, and testing different versions of features and prices | Art. 6(1)(f), legitimate interests / Art. 6(1)(a), consent for cookies |
| Publishing anonymised travel statistics (for example typical trip lengths), never based on fewer than 500 trips | Art. 6(1)(f), legitimate interests |
| Reviewing support and AI assistant conversations for quality, including with AI tools, with names and contact details removed where possible | Art. 6(1)(f), legitimate interests |
| Advertising measurement | On the website: Art. 6(1)(a), consent. In the app: Art. 6(1)(f), legitimate interests, limited by your device's tracking settings. |
| Security, error monitoring, and preventing fraud and abuse | Art. 6(1)(f), legitimate interests |
| Handling business leads and outreach | Art. 6(1)(f), legitimate interests |
| Complying with legal obligations (for example tax and requests from authorities) | Art. 6(1)(c), legal obligation |
You may object to processing based on legitimate interests at any time (see Section 9).
5. Stays Bookings
When you book accommodation through Stippl Stays, we share your name, date of birth (where required), nationality, contact details, billing address, and any preferences or accessibility requirements with Nuitee Travel Limited ("Nuitee", operator of the LiteAPI booking platform), the merchant of record, which passes them to the accommodation. Card details go encrypted directly to Nuitee's payment processor; Stippl does not store full card numbers. If you book for children, we pass on their ages. See Nuitee's Privacy Policy.
6. Data Sharing
We do not sell your personal data. We share it only with the service providers below, who may use it only on our instructions, and with the parties listed under "Other". Providers marked "self-hosted" run on servers we control.
| Category | What for | Providers |
|---|---|---|
| Bookings and payments | Stays bookings, payments, subscriptions, eSIMs, photobook printing | Nuitee (LiteAPI), Stripe, Apple App Store, Google Play, RevenueCat, Airalo, Cloudprinter |
| AI services | AI assistant (including your trip details, preferences, and chat images), trip generation, booking email import, quality monitoring, internal conversation review | Google (Gemini), Anthropic (Claude), Langfuse (self-hosted) |
| Maps and travel data | Maps, routes, place search, weather, transport, hotels, and activities | Google Maps, Mapbox, Stadia Maps, LocationIQ, Serper, and travel data providers (no account data) |
| Analytics and error monitoring | Understanding usage, session replay, crash and error reports | Google Analytics, Firebase, Microsoft Clarity, Fathom, OpenPanel (self-hosted), Sentry (self-hosted) |
| Advertising measurement | Measuring which campaigns bring visitors and app installs (with your consent where required) | Meta, Google Ads, Apple Search Ads, TikTok, Pinterest, OpenAI (ChatGPT ads), AppsFlyer |
| Email, notifications, and support | Sending emails and push notifications, receiving forwarded booking emails, support, surveys | Listmonk (hosted by Elestio), Resend, Google Workspace, Amazon Web Services, Expo, Crisp, Typeform |
| Hosting and storage | Servers, database, and file storage (mainly in the EU) | Fly.io, MongoDB Atlas, Cloudflare, Backblaze, Amazon Web Services, Hetzner |
| Business leads | Enriching and following up business enquiries | Anthropic (Claude), Slack, Lemlist |
| AI assistants you connect | Only if you connect Stippl to them (see Section 3.4): the names, dates and links of your trips, and the places added | OpenAI (ChatGPT), Anthropic (Claude) |
| Booking partners | When you open a booking link (for example Booking.com, Expedia, Hostelworld, Skyscanner, Rentalcars), the partner receives your visit and a reference so we are credited; your booking then falls under the partner's own privacy policy | The partner you choose |
| Other | Legal, accounting, and audit advice; legal requests; a merger or acquisition | Professional advisers, competent authorities, a successor entity |
Advertising and session-replay tools on the website load only after you accept marketing cookies (see Section 7). Each provider's own privacy policy applies to its processing.
7. Cookies
We use cookies and similar technologies. You can manage your preferences at any time through our cookie banner, which also names the providers in each category.
| Category | Purpose | Legal Basis |
|---|---|---|
| Strictly Necessary | Essential for the Service to function (e.g., session management, security, bot protection) | Strictly necessary, no consent required |
| Functional | Remember your preferences (e.g., language, theme) | Art. 6(1)(a), consent |
| Analytics | Understand how you use the Service | Art. 6(1)(a), consent |
| Marketing | Advertising measurement and session replay | Art. 6(1)(a), consent |
Our emails contain a small image and tracked links that tell us whether an email was opened and which links were clicked. Withdrawing consent does not affect the lawfulness of processing before withdrawal.
8. International Data Transfers
Some providers in Section 6 process data outside the European Economic Area, mainly in the United States. We then rely on an adequacy decision of the European Commission (including the EU-US Data Privacy Framework) or on Standard Contractual Clauses. You can request a copy of these safeguards at [email protected].
9. Your Rights
You have the right to access, correct, delete, restrict, and receive a copy of your personal data, to object to processing based on legitimate interests or for direct marketing, to withdraw consent at any time, and not to be subject to decisions based solely on automated processing that significantly affect you. You can delete your account yourself in the app or on the website.
To exercise these rights, contact [email protected]. We respond within one month (extendable by two months for complex requests, with notice to you). You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority in your country.
10. Data Retention
| Data | Retention period |
|---|---|
| Account, trips, journals, photos, and AI assistant conversations | Until you delete them or your account; deleted trips stay in the trash for 30 days |
| Payments, invoices, bookings, and orders | 7 years (legal obligation) |
| Support conversations | 2 years after your last contact |
| Analytics and session recordings | Up to 14 months |
| Technical logs, error reports, and AI quality monitoring | Up to 90 days |
| Email open and click data | 90 days |
| ChatGPT and Claude connections | 90 days after the connection was last used, 365 days at most, or straight away when you delete your account |
| Marketing preferences | While you are subscribed; a record of your consent or unsubscribe for 3 years after |
Deleted data can remain in our backups for up to 12 months before it is overwritten. We keep data longer only where we need it to comply with a legal obligation or to establish, exercise or defend a legal claim, for example a payment dispute, and only for as long as that lasts. After the retention period, data is deleted or anonymised.
11. Facebook Page, Joint Controller
For visitor statistics (Facebook Insights) on our Facebook page, Stippl and Meta Platforms Ireland Limited are joint controllers under Article 26 GDPR, based on our legitimate interest in understanding our audience. Meta collects this data through its own cookies under Meta's Privacy Policy. You can exercise your rights with us at [email protected] or with Meta directly.
12. Mobile App
- Advertising measurement: in the app, advertising measurement is based on legitimate interests and limited by your device's tracking settings. If you decline Apple's App Tracking Transparency prompt, advertising identifiers are not used for ad measurement. Analytics that do not use them keep running.
- Session replay: a sample of app sessions is recorded (screens, taps, scrolls) to find usability problems, linked to your user ID.
- Permissions: location and push notifications are used only after you allow them in your device settings, where you can also switch them off.
13. Children's Privacy
The Service is not directed to children under the age of 16. We do not knowingly collect personal data from children under 16. If you become aware that a child has provided us with personal data without parental consent, please contact [email protected] and we will take steps to remove the data.
For Stays bookings, you must be at least 18 years old. Additional guest data for minors (e.g., ages) collected in the course of a booking is processed solely for the purpose of fulfilling that booking.
14. Security
We protect your personal data with appropriate technical and organisational measures, including encryption in transit and at rest and access controls. No system is completely secure. If you believe your Account has been compromised, please contact [email protected] immediately.
15. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through a prominent notice within the Service before the changes take effect. The "Last updated" date at the top of this page will always reflect the most recent version.
16. Contact Us
For any privacy-related questions, requests, or complaints:
Stippl B.V.
Attn: Privacy Team
Ruimzicht 129, 1068CS Amsterdam, the Netherlands
Email: [email protected]
Website: our contact page
We aim to respond to all privacy-related enquiries within 10 business days.
© 2026 Stippl B.V. All rights reserved.
