Privacy Policy

Last updated: 30 July 2026

This Privacy Policy explains how Paremson OÜ processes personal data through the Tripwala platform at tripwala.io (the “Platform”). We are committed to protecting your personal data and handling it in accordance with the EU General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act.

1. Who we are (Data Controller)

The controller of your personal data is:

For any question about this policy or your personal data, contact us at the email above. We have not appointed a Data Protection Officer, as we are not required to; privacy queries are handled by our team via that address.

2. What personal data we collect

Depending on how you use the Platform, we may process the following categories of data:

• Account data: your name, email address, a securely hashed password, your role (traveller or creator), and account status. Passwords are hashed by our authentication system and are never stored or visible to us in plain text.
• Sign-in with Google (optional): if you choose Google sign-in, we receive your basic Google profile (name, email address, and account identifier) to create and authenticate your account.
• Profile data: for creators, a display name, biography, social media links, and a profile photo; for travellers, an optional profile photo.
• Booking data: the trips you request or host, booking status and history, and related timestamps and notes.
• Messages: messages you exchange in per-trip chat rooms with other participants.
• Uploaded images: photos you upload. We re-encode images on upload and strip embedded metadata (including EXIF/GPS location) before storing them.
• Newsletter: if you subscribe, your email address.
• Attribution data: first-touch information about how you arrived (landing page, referrer, and marketing campaign parameters) to understand our reach.
• Technical and usage data: IP address, device and browser information, log data, and analytics events describing how the Platform is used. Analytics is only collected with your consent (see our Cookie Policy).

3. Purposes and legal bases

We process your personal data on the following legal bases under Article 6(1) GDPR:

• To provide the Platform: creating and managing your account, enabling trip listings, booking requests, and chat. Basis: performance of a contract (Art. 6(1)(b)).
• Transactional communications: emails about your account, bookings, and service updates. Basis: performance of a contract and our legitimate interests (Art. 6(1)(b) and 6(1)(f)).
• Newsletter: sending marketing updates where you have subscribed. Basis: consent (Art. 6(1)(a)); you may unsubscribe at any time.
• Analytics cookies: measuring and improving the Platform. Basis: consent (Art. 6(1)(a)), managed through our cookie banner.
• Security, fraud prevention, and service improvement: keeping the Platform safe and reliable. Basis: legitimate interests (Art. 6(1)(f)).
• Legal compliance: meeting our legal obligations. Basis: legal obligation (Art. 6(1)(c)).

4. Sharing your data and processors

We do not sell your personal data. We share it only as necessary to operate the Platform, with the following categories of recipients and processors, who act on our instructions under data processing agreements:

• Other users, where you choose to interact: when a booking proceeds, the relevant creator receives the traveller information needed to arrange the trip, and chat participants see each other’s messages and display names.
• Hosting: Render (application hosting, EU region, Frankfurt).
• Database: MongoDB Atlas (stores account, booking, and message data).
• File and image storage: Cloudflare R2.
• Email delivery: Resend.
• Analytics: Google Analytics (Google Ireland Ltd) and PostHog (PostHog, Inc.), only with your consent.
• Newsletter records: Google Workspace (Google Sheets), where subscriber emails are recorded.
• Content management: Sanity (powers our blog).
• Authentication: Google, where you use Google sign-in.

We may also disclose data where required by law, to protect our rights, or in connection with a business transfer.

5. International transfers

Some of our processors are established outside the European Economic Area (for example in the United States). Where personal data is transferred outside the EEA, we rely on appropriate safeguards under GDPR, such as the European Commission’s Standard Contractual Clauses or an adequacy decision. You may request more information about these safeguards using the contact details above.

6. Retention

We keep personal data only for as long as necessary for the purposes described above. Account and profile data is retained while your account is active and for a reasonable period afterwards; booking and message records are retained as needed to provide the service, resolve disputes, and meet legal obligations, then deleted or anonymised. Newsletter data is kept until you unsubscribe. You can request deletion of your account at any time.

7. Your rights

Under the GDPR, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased (the right to be forgotten);
• restrict or object to certain processing;
• data portability;
• withdraw consent at any time, without affecting prior lawful processing.

To exercise any of these rights, email hello@tripwala.io. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, email info@aki.ee, website www.aki.ee.

8. Security

We apply appropriate technical and organisational measures to protect your data, including encryption in transit (HTTPS), hashed passwords, access controls, validation of uploaded files, and stripping of image metadata. No method of transmission or storage is completely secure, but we work to protect your data and to address any incident promptly.

9. Children

The Platform is not directed to children. You must be at least 18 years old to create an account. We do not knowingly collect personal data from children.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here and revise the date above. Material changes will be communicated where appropriate.

11. Contact

Questions about this policy or your personal data: hello@tripwala.io.