Privacy Policy.

1. Data Controller and Contact

The data controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the Member States as well as other data protection provisions is:

TakeMeTo Inc.

(hereinafter "we", "us" or "TakeMeTo")

126 East 30th Street, Apt. 1D

New York, NY 10016, USA

Platform operator: www.takemeto.ai

General requests: [email protected]

Data protection and data subject rights: [email protected]

Data Protection Officer: Claudius Herz, [email protected]

A legal notice with further information (managing directors) can be found at www.takemeto.ai/impressum.

2. Scope and Overview

This Privacy Policy informs you about the nature, scope and purpose of the processing of personal data (hereinafter "data") within our online services and the associated websites, features, content, mobile apps and external online presences (e.g. social media profiles), hereinafter jointly referred to as the "online services".

TakeMeTo is an AI-powered travel planning and booking platform that enables you to plan personalized trips, create your individual Travel DNA, share content and complete bookings with third-party providers (airlines, hotels, activity and transfer providers).

The terms used (e.g. "personal data" or "processing") are understood within the meaning of the definitions in Art. 4 GDPR.

3. Legal Bases of Processing

In accordance with Art. 13 GDPR we inform you of the legal bases of our data processing:

• Art. 6(1)(a) GDPR – consent (e.g. analytics cookies including Google Analytics, session recording, marketing, newsletter, social media integration)
• Art. 6(1)(b) GDPR – performance of a contract and pre-contractual measures (e.g. registration, AI chat and travel planning, map display, bookings)
• Art. 6(1)(c) GDPR – compliance with legal obligations (e.g. retention obligations under commercial and tax law)
• Art. 6(1)(f) GDPR – legitimate interests (e.g. operation, security, reach measurement, attributing registrations to marketing channels)
• Art. 9(2)(a) GDPR – explicit consent, where special categories of personal data are processed in individual cases

In addition, we observe the requirements of the TDDDG (German Telecommunications Digital Services Data Protection Act, which replaced the TTDSG in May 2024), in particular Section 25 TDDDG for cookies and comparable access to your device, and the requirements of the AI Regulation (Regulation (EU) 2024/1689, "AI Act") to the extent these apply to our AI systems.

4. Categories of Data Processed

We process the following categories of data:

• Master data: e.g. names, addresses
• Contact data: e.g. email, telephone numbers
• Content data: e.g. text entries, photographs, uploaded travel content
• Contract data: e.g. subject of contract, term, customer category
• Legacy payment data: accounting records from the period in which TakeMeTo offered paid services; no new payment data is created
• Allowance data: the number of messages sent per calendar day, per account and, for use without an account, per device or session
• Usage data: e.g. websites visited, interest in content, access times
• Meta/communication data: e.g. device information, IP addresses
• Travel and preference data: Travel DNA: travel mood, destination wishes, budget, travel months, travel style, duration, number of travelers
• AI conversation data: chat messages, AI responses, session logs
• Identity tags: e.g. "founder", "family traveler", derived from your inputs
• Location data: where shared
• Consumption and cost data of the AI functions: model used, number of tokens processed, cost incurred per request
• Origin data for registration: campaign parameters (UTM), entry page, referring domain, derived interest segment, language and time of the first page view (section 14.11)

5. Data Subjects

Visitors and users of the online services (hereinafter jointly "users").

6. Purposes of Processing

• Provision of the online services and their functions
• Registration, authentication, login identification
• Creation and maintenance of the personal Travel DNA
• Generation of AI-powered travel plans and recommendations
• Execution of bookings with third-party providers
• Communication with users
• Ensuring platform security, fraud and abuse prevention
• Reach measurement, product improvement, measuring which channels and landing pages lead to registrations
• Detection and remediation of errors and outages
• Cost and consumption control of the AI functions and limiting daily use
• Newsletter and product information (with consent)
• Measuring the success of our advertising and retargeting via marketing partners (only with consent)
• Compliance with legal obligations

7. Registration, User Account and Identification

You can register on our platform by providing personal data. Which data are mandatory or optional is indicated by the input forms. We use this data for authentication (login), contract performance and communication with you.

Legal basis: Art. 6(1)(b) GDPR.

You can withdraw your consent at any time with effect for the future.

8. Travel DNA – Creation of a Personal Travel Profile

On the basis of the data you actively provide to us (entries in forms, chat dialogues with our AI assistant, selection of destinations, interactions on the platform), we create a Travel DNA for you. This includes, among other things:

• preferred travel pace, style and duration
• interests, themes and activity preferences
• preferred accommodation types
• approximate budget range
• preferred travel months and departure region
• traveler identity tags (e.g. "founder", "family traveler")

Legal basis: Art. 6(1)(b) GDPR (performance of contract) and — where going beyond this — Art. 6(1)(a) GDPR.

Profiling (Art. 4(4) GDPR): The creation of the Travel DNA constitutes profiling. However, it has no legal effect and no similarly significant adverse impact within the meaning of Art. 22 GDPR. It serves exclusively to personalize your travel suggestions.

Your rights: You can view the Travel DNA in your profile settings at any time, edit or delete individual tags and attributes. You can also object to the profiling at any time ([email protected]).

9. AI Travel Planning and Data Exchange with AI Third-Party Providers

Our platform (web and mobile app) includes an AI-powered travel planning chatbot that helps you create personalized travel plans and recommendations. For this purpose we share certain data with third-party AI providers and with services that retrieve the underlying travel information.

9.1 Purposes of Processing

(a) Generation of personalized travel recommendations and routes in real time based on your inputs.

(b) Derivation and storage of travel preferences to improve future suggestions.

(c) Quality monitoring, security and prevention of abuse.

9.2 Categories of Data Processed

• Chat content: your messages in the travel-planning chat as well as AI-generated responses
• Session metadata: timestamps, session IDs, interaction logs
• Travel details: destination, dates, budget, preferences, number of travelers
• Travel planning parameters: travel mood, travel month, departure city, budget range
• Destination matching inputs: travel style, duration, number of travelers, budget per person, travel month
• Traveler identity tags: e.g. "founder", "family traveler"; editable and deletable in profile settings
• Meta/communication data: IP address, device/network information

9.3 Recipients

• Google LLC (Gemini) – location USA; language model for chat, travel planning and the associated web search. Transfer mechanism: EU-US Data Privacy Framework (DPF) pursuant to Art. 45 GDPR.
• Anthropic, PBC (Claude) – headquarters USA; language model for individual chat and planning steps. Processing takes place — as contractually assured — on EU infrastructure. For third-country transfers: Standard Contractual Clauses (SCCs).
• Groq, Inc. – location USA; conversion of your voice input into text. Only the audio recording you made is transmitted, with no reference to your account.
• SerpAPI – location USA; retrieval of search results for places, accommodation, restaurants, flights and events. The search terms are transmitted, with no reference to your account.
• Firecrawl – location USA; reading of publicly accessible web pages to determine prices and availability. Only the web addresses to be retrieved are transmitted, with no reference to your account.
• Open-Meteo (Europe) – weather data for the destination. Only coordinates or the place name of the destination are transmitted, with no reference to your account.
• OSRM routing service (router.project-osrm.org) – distances between the stops of a route. Only coordinates are transmitted, with no reference to your account.

Clarification: we use neither OpenAI/ChatGPT nor Perplexity. Earlier versions of this policy named these providers; that was incorrect. There is also no ChatGPT app integration.

9.4 Legal Basis

Art. 6(1)(b) GDPR (performance of a contract). The AI-powered travel planning chat is not an additional feature but the service itself that you obtain by using TakeMeTo. Transmitting your inputs to the service providers named in section 9.3 is necessary in order to provide that service and therefore cannot be deselected separately — for the same reason as the map display (section 11.7).

We do not obtain consent for the AI chat. Earlier versions of this policy claimed that we did and presented the function as consent-dependent, although no such choice ever existed; that was incorrect. If you do not agree to this processing, you cannot use the service. Your rights to access, rectification, erasure and data portability remain unaffected (sections 9.6 and 18).

9.5 Retention Periods

• Conversation data (messages, AI responses, session metadata): you can delete individual chats yourself in the app at any time. If you delete your account, they are irreversibly removed once the 90-day grace period has expired (section 17.2). As long as you keep your account, your chats are retained so that you can access them.
• Derived travel preference profiles (Travel DNA): until account deletion or until you remove individual entries.
• Product event records relating to AI actions (section 14.3): 90 days, then automatic deletion.

9.6 Your Rights and Control

• A transmission to the service providers named in section 9.3 takes place only when you submit a request. You decide what you enter into the chat.
• Data minimization before every transmission: we pass on only what is necessary for the respective request.
• Deletion of chat history in the app settings.
• Full export: directly in the app via the "Export data" button in your profile. You receive a JSON file containing all data stored for your account. Alternatively an email to [email protected] is sufficient.
• Rights regarding AI chat data (access, deletion, portability): email [email protected] with subject "AI Data Request". Reply within 30 days.

9.7 Safeguards

We conclude data processing agreements (Art. 28 GDPR) with our AI and research service providers and apply appropriate safeguards for international data transfers (Google: DPF; Anthropic: EU processing, additionally SCCs; other US service providers: SCCs — see section 12). Data minimization is a mandatory principle: to the research, weather and routing services (SerpAPI, Firecrawl, Open-Meteo, OSRM) we transmit search terms, web addresses and coordinates, but neither your name nor your account or contact data.

10. Booking Functions

If you use the booking functions of the platform, you grant us the right to share the travel details required for the booking with the following recipients:

• Airlines
• Hotel and accommodation providers
• Providers of activities, tours and experiences
• Transfer and mobility services

Only data necessary for the execution of the respective booking are shared (e.g. name, contact data, travel dates, preferences, ID data where applicable for flights).

Legal basis: Art. 6(1)(b) GDPR (performance of contract).

Location of recipients: varies by provider. For third-country transfers: Art. 49(1)(b) GDPR or SCCs/adequacy decision.

11. Recipients / Disclosure of Data to Third Parties

Overview of the main categories of recipients, legal bases and transfer mechanisms:

Recipient

Data

Legal basis

Location / mechanism

Hetzner Online GmbH (servers, hosting)

Master, contact, content, contract, usage, meta/comm. data

Art. 6(1)(b) / (f) GDPR

Germany

Supabase (database, sign-in, file storage) — operated by ourselves on the infrastructure named above

same data as for hosting

Art. 6(1)(b) / (f) GDPR

Germany

Cloudflare, Inc. (website delivery/CDN, "Turnstile" bot protection, cookieless web analytics)

IP address, timestamp, address requested, browser/device information

Art. 6(1)(b) / (f) GDPR

European data centres; parent company USA

Google LLC (Maps Platform)

IP address, device/browser information, map sections, place search terms

Art. 6(1)(b) GDPR — necessary part of the service, see section 11.7

USA — DPF

Google LLC (Gemini)

Chat content, travel planning data, search queries

Art. 6(1)(b) GDPR — necessary part of the service, see section 9.4

USA — DPF

Google LLC (Tag Manager)

Device data, IP address — loaded only after analytics or marketing consent

Art. 6(1)(a) GDPR

USA — DPF

Google Ireland Limited (Google Analytics 4) — processor

Usage events, random identifier from cookies, device/browser information, IP address — only after analytics consent, see section 14.9

Art. 6(1)(a) GDPR

Ireland; possible transfer to Google LLC, USA — DPF

Marketing partners: Google Ireland Limited (Google Ads), Meta Platforms Ireland Ltd. (Facebook, Instagram), TikTok Technology Limited (TikTok)

Currently only your consent signals to Google; pixels are not yet integrated — only after marketing consent, see section 14.10

Art. 6(1)(a) GDPR

USA — DPF (Google, Meta); TikTok: USA, Singapore, possibly China — SCCs

Anthropic, PBC (Claude)

Chat content, travel planning data

Art. 6(1)(b) GDPR — necessary part of the service, see section 9.4

EU/DE, additionally SCCs

Groq, Inc. (speech recognition)

audio recording of your voice input — no account reference

Art. 6(1)(b) GDPR

USA — SCCs

SerpAPI (search results)

search terms for places, accommodation, restaurants, flights, events — no account reference

Art. 6(1)(b) / (f) GDPR

USA — SCCs

Firecrawl (price and availability retrieval)

web addresses to be retrieved — no account reference

Art. 6(1)(b) / (f) GDPR

USA — SCCs

Open-Meteo (weather data)

coordinates of the destination — no account reference

Art. 6(1)(b) GDPR

Europe

OSRM routing service (router.project-osrm.org)

start and destination coordinates for distance calculation — no account reference

Art. 6(1)(b) GDPR

open project service; only coordinates are transmitted

PostHog, Inc. (product analytics)

anonymous or — only with consent — pseudonymous usage events

Art. 6(1)(f) / (a) GDPR

European infrastructure (eu.i.posthog.com)

Resend (sending emails, e.g. confirmations, invitations, newsletter)

email address, content of the respective message

Art. 6(1)(b) / (a) GDPR

USA — SCCs

Twilio (notifications via WhatsApp/SMS)

telephone number, content of the notification

Art. 6(1)(a) / (b) GDPR

USA — SCCs

Booking partners (airlines, hotels, activities)

Travel details

Art. 6(1)(b) GDPR

varies by provider

Financial/legal advisers

Financial, contract data

Art. 6(1)(c) / (f) GDPR

EU

11.6 Advertising and Marketing Services Only with Consent

We use third-party analytics tools, advertising networks and conversion pixels only with your consent: Google Analytics 4 only with consent to the "analytics" category (section 14.9), marketing tools from Google, Meta and TikTok only with consent to the "marketing" category (section 14.10). A Meta Pixel, the Meta Conversions API, a TikTok Pixel and Google Ads tags are currently not integrated; before we activate any of them, we will supplement this policy. There is no session recording by advertising service providers; we do not use SmartLook. Earlier versions of this policy named a joint controllership with Meta pursuant to Art. 26 GDPR — that was incorrect. No joint controllership currently exists.

11.7 Google Maps Platform — a Necessary Part of the Service

Maps, place search and the display of places and routes are provided via the Google Maps Platform of Google LLC (USA). When a map loads, your IP address as well as device and browser information are transmitted to Google; for a place search, additionally the search term you entered.

Until 31 July 2026 the map display was listed in the cookie banner as a separate consent category. We removed that choice because it suggested an option the product did not honor: the map is an inseparable part of travel planning. We therefore no longer obtain separate consent for it. The legal basis is Art. 6(1)(b) GDPR (performance of the user contract). The associated transfer to the USA cannot be deselected — if you do not want it, you cannot use the service. Details of the transfer mechanism are in section 12.

12. Processing Outside the EU/EEA

We transfer data in part to third countries (in particular the USA). This takes place exclusively in compliance with Art. 44 et seq. GDPR.

Transfer mechanisms used:

• Google LLC (Maps Platform, Gemini, Tag Manager) as well as Google Analytics 4 and Google Ads (contracting party Google Ireland Limited, possible transfer to Google LLC, USA): EU-US Data Privacy Framework (DPF).
• Meta Platforms Ireland Ltd. (possible transfer to Meta Platforms Inc., USA): EU-US Data Privacy Framework (DPF); TikTok Technology Limited (processing also in the USA, Singapore and possibly China): standard contractual clauses (SCCs). Both only once the respective marketing tool is activated and only with your marketing consent (section 14.10).
• Anthropic, PBC: processing on EU infrastructure as contractually assured; additionally Standard Contractual Clauses (SCCs).
• Other service providers based in the USA (Cloudflare, Groq, SerpAPI, Firecrawl, Resend, Twilio, PostHog as parent company): Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR or — where the provider is certified — the EU-US Data Privacy Framework.
• Open-Meteo processes in Europe; for the OSRM routing service we transmit only coordinates with no account reference.
• The actual processing by PostHog takes place on European infrastructure; Cloudflare delivers our content via European data centers. Our own database and all account, chat and log data stored in it are located in Germany.

Cannot be deselected: both the map display via the Google Maps Platform (section 11.7) and the AI travel planning via the service providers named in section 9.3 (section 9.4) are necessary parts of the service. The associated transfers are based on Art. 6(1)(b) GDPR in conjunction with the mechanism named above in each case and cannot be deselected individually.

The EU-US Privacy Shield, mentioned in earlier versions of this policy, was declared invalid by the CJEU in July 2020 and is no longer relied upon.

In addition, we may process data outside the EEA in individual cases to fulfil contractual obligations, on the basis of your consent, due to legal requirements or out of legitimate interests.

13. Cookies and Similar Technologies

13.1 What are Cookies?

Cookies are small text files that are stored on your device when you visit our website. We use cookies in particular to store sessions and ensure the platform's functionality.

13.2 Categories

Our cookie banner has exactly four categories: necessary (always active, cannot be deselected), analytics, session recording and marketing. There are no further options. Legally, the storage and measurement we use is classified as follows:

• Technically necessary storage (session, login, security, "Turnstile" bot protection by Cloudflare): Section 25(2) no. 2 TDDDG, Art. 6(1)(b)/(f) GDPR. No consent required.
• Functional storage (language, currency, your consent decision itself): Section 25(2) no. 2 TDDDG, Art. 6(1)(b)/(f) GDPR. These values are required for the service you requested and are not evaluated for analytics purposes.
• Start page buffer (the travel request you typed for up to 24 hours, attached images and PDF files for up to 7 days, stored only on your device in the browser): Section 25(2) no. 2 TDDDG, Art. 6(1)(b) GDPR. No consent required. Text and attachments are transmitted only when you sign in and are then processed as described in section 9. If you do not sign in, your browser discards the attachments after 7 days at the latest, without us ever receiving them.
• Analytics with recognition (PostHog identifier in localStorage, Google Tag Manager, Google Analytics cookies _ga and _ga_*): Section 25(1) TDDDG, Art. 6(1)(a) GDPR. Only with your consent.
• Session recording (PostHog Session Replay): Section 25(1) TDDDG, Art. 6(1)(a) GDPR. Only with a separate, additional consent; input fields are masked.
• Anonymous, cookieless measurement (PostHog base measurement, Cloudflare Web Analytics): no information is stored on or read from your device, therefore Section 25 TDDDG does not apply and no consent is required (Art. 6(1)(f) GDPR) — see section 14.
• Marketing (consent signals to Google; in future advertising cookies and pixels from Google, Meta and TikTok): Section 25(1) TDDDG, Art. 6(1)(a) GDPR. Only with your separate consent to the "marketing" category. We currently do not use marketing or advertising cookies (section 14.10).

13.3 Consent and Withdrawal

Before any non-necessary storage on your device and before any analytics involving recognition we obtain your consent via our consent banner. There are no pre-ticked boxes, and "Reject all" is available on the first level.

You can withdraw your consent at any time with effect for the future: via the "Cookie settings" entry in the footer of every page, via the cookie settings in the app, or informally by email to [email protected]. After a withdrawal we pass your changed choice to Google via Consent Mode (section 14.9), the extended measurement ends and stored identifiers are removed; when you withdraw analytics consent, this includes the Google Analytics cookies.

Two categories were discontinued as of 31 July 2026. Map display: the map is a necessary part of travel planning, so offering a choice would not have been honest — see section 11.7. Voice output: we have discontinued the feature that read AI responses aloud; no speech synthesis service is embedded any more, so there is nothing left to consent to. Voice input — dictating a message into the chat — is not affected and continues unchanged (section 9.3).

14. Product Analytics, Reach Measurement and Our Own Records

This section describes in full what we record about the use of our service — both via external tools and on our own servers. We use third-party analytics and advertising services (Google Analytics 4, marketing tools) only with your consent (sections 11.6, 14.9 and 14.10).

14.1 PostHog (product analytics, EU hosting)

For reach measurement and product improvement we use PostHog (PostHog, Inc.; processing via European infrastructure, eu.i.posthog.com). It is used in two stages:

• Anonymous, cookieless measurement (without consent): as long as you have not given analytics consent, we process exclusively anonymous, aggregated events (e.g. opening a landing page, submitting the waiting-list form). No cookies or comparable information are stored on or read from your device (storage only transiently in memory for the duration of the page visit), no personal profile is created, and the IP address is discarded and not stored. Since no access to your device takes place (Section 25 TDDDG does not apply) and no personal data are stored, no consent is required for this. Legal basis, in so far as any personal reference should exist at all: Art. 6(1)(f) GDPR (legitimate interest in anonymous reach measurement).
• Extended measurement (only with consent): only with your consent does PostHog store a recognizable identifier in your browser (localStorage), link events across sessions and create — if you additionally consent — pseudonymised session recordings (Session Replay; input fields are masked). Also only after consent (analytics or marketing) do we load the Google Tag Manager (section 14.9). Legal basis: Art. 6(1)(a) GDPR, Section 25(1) TDDDG.

You can withdraw your consent at any time with effect for the future via our consent tool; the extended measurement then ends and stored identifiers are removed. The anonymous, cookieless measurement contains no personal data.

14.2 Cloudflare (delivery, bot protection, web analytics)

Our website is delivered via Cloudflare. In doing so, Cloudflare processes technically necessary connection data (IP address, timestamp, address requested, browser and device information) in order to deliver content and to fend off attacks and automated mass access. During sign-in and on forms, the "Turnstile" bot protection additionally checks whether the request originates from a human. Legal basis: Art. 6(1)(b) and (f) GDPR (provision and protection of the service).

Cloudflare Web Analytics additionally counts page views. In doing so, no cookies are set and no information is stored on or read from your device; no cross-device identifier and no personal profile are created. The evaluation is purely statistical and is viewed exclusively by us in our internal dashboard. Section 25 TDDDG does not apply for want of access to your device; the legal basis is Art. 6(1)(f) GDPR.

14.3 Our Own Event Records on Our Servers

Independently of external tools, we record on our own infrastructure (database in Germany) what happens in the application. This takes place in two clearly separated tiers:

• Without consent — Art. 6(1)(f) GDPR (operating and securing the service): we store which page or view was opened, which action was performed, whether that action succeeded or failed, and, in the event of an error, an error code. In this tier no device identifier is stored: individual entries can be combined neither into a visit history nor, across visits, into a device. If you are signed in, the entry is assigned to your account, because we process your account data to provide the service in any case. This tier cannot be deselected — without it we would not notice outages and errors. You may object to it pursuant to Art. 21 GDPR.
• With analytics consent — Art. 6(1)(a) GDPR: in addition to the same information we store a session identifier. This allows us to follow the click path within one browser visit and to see where a function is abandoned. The session identifier is newly assigned for each visit; it is not a permanent identifier spanning visits.

The separation is technically enforced, not merely organisational: our database accepts a session identifier only if analytics consent is present. An error in the application therefore cannot silently turn the lower tier into the upper one. All entries are automatically and permanently deleted after 90 days; a deletion job runs daily for this purpose.

Campaign and funnel counts: In the tier without consent we also record how often key steps of our service are reached, e.g. views of landing pages and clicks on their buttons, the first travel request submitted (not its content), travel plans created, registrations started and completed, group trips created, invitations sent and accepted, newsletter sign-ups, clicks on booking links, and the display of the cookie banner and the choice saved there (only which categories were selected). With these entries we additionally store the interest segment, the entry page and the source and name of the campaign (utm_source, utm_campaign) through which you came to us. Here, too, no device identifier is stored and nothing is placed on your device. We evaluate these entries only in aggregated form as counts, to understand which channels and landing pages lead to usage and registrations. The legal basis is Art. 6(1)(f) GDPR; you may object pursuant to Art. 21 GDPR. These entries are also deleted after 90 days.

14.4 Cost and Token Records of the AI Functions

For every AI request we record which model was used, how many tokens were processed, what costs were incurred and which chat this relates to — in each case linked to your account. We need this to steer our operation, to detect cost outliers and to detect misuse. It does not serve billing: TakeMeTo is free of charge, there is no balance and there is no invoice. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a stable, sustainable operation and in detecting misuse). These records contain consumption and cost figures, not the text of your messages. They are removed upon final account deletion (section 17.2).

14.5 Error Records of the Processing Chain

If a step of our travel planning processing fails, we store an error entry with timestamp, the step affected, the error message and the error type. Such an entry may also contain the triggering request, that is the information passed within it such as destination, travel dates or your chat input — otherwise an error cannot be reproduced. Credentials and keys are not stored with it. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a functioning service). We keep such entries only for as long as this is necessary for error analysis; upon account deletion the reference to your account is removed and the entry remains without any personal reference. Access is limited exclusively to persons involved in fixing the error.

14.6 Anonymous Time on Page

We count, aggregated per page and per day, how often and how long pages were open. This counter contains no identifier whatsoever — neither to your account nor to your device, no IP address — and permits no conclusions about individual persons. It is kept identically for consented and non-consented visits because it contains no personal data within the meaning of Art. 4(1) GDPR.

14.7 Time of Last Activity

For every account we store when it was last active. We use this to identify inactive accounts, to delimit the scope of a possible security incident and to plan capacity. Only the respective most recent timestamp is stored — it is overwritten, so no activity history is created. Legal basis: Art. 6(1)(f) GDPR.

14.8 Daily Allowance

TakeMeTo is free of charge. So that the service stays usable for everyone, we limit the number of messages per day: 60 for signed-in users, 5 for use without an account. For this we store, per account and calendar day, the number of messages sent, and per device or session when you use TakeMeTo without an account. Purpose: protection against misuse and load peaks. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a stable operation). The counter holds none of the content of your messages. Counting starts again once the day ends, and we delete older daily values after 30 days at the latest.

14.9 Google Analytics 4 and Google Consent Mode

If you consent to the "analytics" category, we additionally use Google Analytics 4, a web analytics service of Google Ireland Limited (Ireland), which we integrate via the Google Tag Manager. Google Analytics stores a random identifier of your browser in cookies (_ga, _ga_*) and records how you use our pages and the app: pages viewed including campaign parameters, the referring page, interactions such as creating a travel plan or registering, the interest segment and language, as well as device and browser information and your IP address. We do not transmit names, email addresses or the content of your chats to Google. We use the reports to understand which channels and content lead to usage and registrations and to improve our service.

Consent Mode: We use Google Consent Mode (version 2) in basic mode. Before you decide, no Google service is loaded and no Google cookie is set. After your decision we pass your choice to Google as consent signals: for analytics (analytics_storage) and for marketing (ad_storage, ad_user_data, ad_personalization). Google Analytics only runs if you have consented to analytics. If you change or withdraw your choice, we send the updated signals; if you withdraw analytics consent, we also delete the Google Analytics cookies.

Processing on our behalf and third-country transfer: Google Ireland Limited processes the data as our processor (Art. 28 GDPR). A transfer to Google LLC in the USA is possible; Google LLC is certified under the EU-US Data Privacy Framework (section 12). Google Signals is disabled, so your usage is not combined across devices via Google accounts; the collection of granular location and device data is disabled as well.

Retention: Google Analytics automatically deletes the recorded event data after 14 months. The _ga and _ga_* cookies expire after 2 years; if you withdraw your analytics consent, we delete them immediately.

Legal basis: your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw it at any time with effect for the future via "Cookie settings" in the footer (section 13.3).

14.10 Marketing (Separate Consent)

Our cookie banner contains the "marketing" category; it is switched off by default. With your consent to this category we may use tools with which we measure the success of our ads (e.g. whether a registration follows a click on an ad) and show our advertising again, on the providers' platforms, to people who have visited our pages (retargeting). The intended recipients are:

• Google Ireland Limited (Google Ads and the consent signals of Google Consent Mode); possible transfer to Google LLC, USA: EU-US Data Privacy Framework (DPF)
• Meta Platforms Ireland Ltd. (Facebook, Instagram); possible transfer to Meta Platforms Inc., USA: DPF
• TikTok Technology Limited, Ireland (TikTok); processing also in the USA, Singapore and possibly China: standard contractual clauses (SCCs)

Current status: advertising pixels from Meta and TikTok and Google Ads tags are not yet integrated. At present the category only means that we store your decision and pass it to Google as a consent signal (section 14.9); for this we load the Google Tag Manager even if you have consented only to marketing and not to analytics. Google Analytics stays switched off in that case. We activate a marketing tool only if you have consented to this category. Before we integrate any of them, we will supplement this policy with the data processed, the cookies set, the retention period and — where applicable — a joint controllership pursuant to Art. 26 GDPR.

Legal basis: your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw it at any time with effect for the future via "Cookie settings" in the footer; we then send Google the updated signal, no longer load any marketing tools and remove the cookies they have set.

14.11 Origin of Your Registration (First-Touch Attribution)

When you create an account, we store once, with your account, how you came to us. This takes place without consent on the basis of our legitimate interest (Art. 6(1)(f) GDPR) and comprises only:

• the campaign parameters of the address through which you came to our site (utm_source, utm_medium, utm_campaign, utm_content, utm_term), if present;
• the entry page (e.g. a specific landing page) and the domain of the referring website (only the domain name, not the full address);
• the interest segment derived from this (group trip, honeymoon or other, where applicable with a subcategory such as bachelor party) and what it was derived from;
• the language of the page and the time at which you first opened our site in this session.

We store no IP address, no device or browser identifier and no free text, and we place nothing on your device for this purpose: until registration, the information is held only in the working memory of the open page. If you do not create an account, none of it is stored.

Purpose and legitimate interest: we want to measure which channels (e.g. social networks, newsletter, press) and which landing pages actually lead to registrations, so that we can use our advertising and content in a targeted way. The information is evaluated only internally by us and in aggregated form, is not passed on to advertising partners and is not used for decisions about you as an individual. Because it consists of a few non-sensitive details that are evaluated only internally, your interests do not, in our assessment, override ours.

Retention: as long as your account exists. The information is removed with the final deletion of your account (section 17.2) and is included in the data export in your profile (section 18).

Objection: you may object to this processing at any time pursuant to Art. 21 GDPR, informally by email to [email protected], stating the email address of your account. We will then delete the origin information for your account without undue delay, at the latest within 30 days; your account remains unaffected.

15. Newsletter

We send newsletters with promotional content only with your express consent using the double-opt-in procedure.

• Legal basis: Art. 6(1)(a) GDPR, Section 7(2) UWG (German Act Against Unfair Competition).
• Sign-up: logging (time, IP address, confirmation) as proof.
• Unsubscribe: at any time via the link in every newsletter or by email to [email protected].

Records of consent are kept for up to three years after withdrawal.

15.1 Sign-up via the form on our website

On our home page you can subscribe to the newsletter without a user account. The purpose of the processing is solely the dispatch of the newsletter with travel ideas, product news and offers from TakeMeTo. The legal basis is your consent under Art. 6(1)(a) GDPR (in conjunction with Section 7(2) no. 3 UWG).

The sign-up uses the double opt-in procedure: after you enter your email address we send a confirmation email containing a link that is valid for 72 hours. Only when you click that link do we add you to the distribution list. Without that click your address stays unconfirmed and is not used for any dispatch.

We store: your email address, the language of the sign-up page, the time of the sign-up, the time of the confirmation and the origin of the sign-up (e.g. "landing"). To protect against automated bulk sign-ups we use Cloudflare Turnstile; your IP address and technical details about your browser are transmitted to Cloudflare Inc. in the process.

The technical dispatch is carried out by Resend Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA, as a processor under Art. 28 GDPR. Your email address and the content of the message are thereby transferred to the United States, that is, to a third country. The transfer is based on the European Commission's standard contractual clauses under Art. 46(2)(c) GDPR and, additionally, on Resend's certification under the EU-US Data Privacy Framework, to the extent that it exists. Despite these safeguards it cannot be ruled out that US authorities access the data and that you have no legal remedies against this that are comparable to those in the EU.

You may withdraw your consent at any time with effect for the future, free of charge. The unsubscribe link at the bottom of every newsletter is enough; an informal message to [email protected] works as well. The withdrawal does not affect the lawfulness of the processing carried out up to that point. After the withdrawal your address is removed from the list; the record proving the original consent is kept for up to three years.

If you delete your user account, we also delete a newsletter sign-up belonging to the same email address. An access request under Art. 15 GDPR (data export) likewise includes that record.

The technical dispatch of the newsletter and of all transactional emails (e.g. confirmations, invitations, notices about your account) is carried out by our service provider Resend; your email address and the content of the respective message are transmitted there (see section 11). Notifications via WhatsApp or SMS are sent via Twilio; your telephone number is transmitted there.

16. Social Media Integrations (Instagram, TikTok, YouTube, Facebook)

16.1 General

When you access embedded content (videos, posts, buttons), personal data (in particular IP address, device/browser information, cookie IDs) may be transferred to the respective providers. Where technically possible we use two-click solutions so that data is only transmitted after your consent.

Legal basis: Art. 6(1)(a) GDPR (consent).

16.2 Instagram

Provider: Meta Platforms Ireland Ltd., Ireland / Meta Platforms Inc., USA. Privacy policy: https://privacycenter.instagram.com/policy. Transfer mechanism USA: DPF.

16.3 TikTok

Provider: TikTok Technology Limited, Ireland / TikTok Ltd.; additional processing in USA, Singapore, possibly China. Privacy policy: https://www.tiktok.com/legal/privacy-policy. Transfer mechanism: SCCs.

16.4 YouTube

Provider: Google Ireland Limited; Google LLC, USA. The embed is served via youtube.com and is loaded only after your click. Privacy policy: https://policies.google.com/privacy. Transfer mechanism USA: DPF.

16.5 Facebook

Provider: Meta Platforms Ireland Ltd., Ireland / Meta Platforms Inc., USA. We embed only individual video posts shared by users, and only after your click. We currently do not use a Meta Pixel, the Meta Conversions API or a Messenger integration; a Meta Pixel would be loaded only with your marketing consent (sections 11.6 and 14.10). Privacy policy: https://www.facebook.com/privacy/policy. Transfer mechanism USA: DPF.

17. Retention and Deletion of Data

We store personal data only as long as is necessary for the respective purposes or as long as statutory retention obligations exist.

Category

Guideline

User account / master data

until account deletion

Contract and booking data

up to 10 years (Section 147 AO, Section 257 HGB)

Tax-relevant documents

10 years

Communication data (business)

6 years (Section 257 HGB)

AI conversation data (chats)

until you delete them; at the latest 90 days after account deletion

Travel DNA / preference profiles

until account deletion

AI cost and token records (section 14.4)

until account deletion

Error records of the processing chain (section 14.5)

as long as necessary for error analysis; personal reference removed on account deletion

Anonymous time-on-page counter (section 14.6)

permanently — contains no personal reference

Daily allowance counter (section 14.8)

30 days at the latest

Product event records including campaign and funnel counts (section 14.3)

90 days, then automatic deletion

Google Analytics 4 (section 14.9)

Event data 14 months; cookies until withdrawal, at most 2 years

Origin of registration (section 14.11)

until account deletion

Legacy accounting records (section 17.3)

10 years (Section 147 AO, Section 257 HGB) — after account deletion only in pseudonymised form, see section 17.3

Log and security data

30–90 days

Marketing/newsletter consent (proof)

3 years after withdrawal

After the retention periods expire, your data will be deleted or anonymised.

17.1 Deletion of Individual Content

You can delete individual chats, uploaded content and entries of your Travel DNA directly in the app at any time. This deletion takes effect immediately.

17.2 Account Deletion: Grace Period and Final Deletion

You delete your entire account in the account settings. Deletion proceeds in two steps:

• Immediately: your account is marked as deleted and can no longer be used. Your profile details are anonymised, your email address is blocked from re-registration, and content you published is detached from the account.
• After 90 days: an automatic job running daily irreversibly removes your personal data from all affected tables of our database, including your sign-in account, your chats, your Travel DNA and the cost and token records. Within the 90 days you can still revoke the deletion; afterwards the data cannot be restored — not even by us.

17.3 Exception: Legacy Accounting Records

TakeMeTo has been free of charge since 15 September 2026, and no new payment transactions, credit entries or subscription grants are created. Accounting records from the period before that still exist. These legacy records are excluded from final deletion because we are required to retain them under commercial and tax law (Section 147 AO, Section 257 HGB); Art. 17(3)(b) GDPR therefore exempts them from the right to erasure.

Instead we decouple them from your person: on final deletion the reference to your account is removed and replaced by a pseudonym that permits no conclusions about you. The records then continue to exist only as pseudonymised accounting vouchers and are used exclusively to fulfil this statutory retention obligation — not for analytics, profiling or advertising.

18. Your Rights as a Data Subject

You have the following rights vis-à-vis us regarding the personal data concerning you:

• Right of access – Art. 15 GDPR
• Right to rectification – Art. 16 GDPR
• Right to erasure ("right to be forgotten") – Art. 17 GDPR
• Right to restriction of processing – Art. 18 GDPR
• Right to data portability – Art. 20 GDPR
• Right to withdraw consent given – Art. 7(3) GDPR
• Right to lodge a complaint with a supervisory authority – Art. 77 GDPR

To exercise these rights please contact [email protected] (data protection matters) or [email protected] (general requests). We will respond to your request within 30 days in accordance with the GDPR.

Access and data portability without going through us: in your profile you will find a button with which you can trigger a full export of your data yourself. You immediately receive a JSON file containing all data stored for your account — account and profile details, chats, Travel DNA, favorites, consent decisions, the origin information for your registration (section 14.11) as well as the cost and error records described in section 14. If you would prefer to receive the export by email, a message to [email protected] is sufficient.

18.1 Right to Object (Art. 21 GDPR)

You have the right, on grounds relating to your particular situation, to object at any time to processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on those provisions.

Where your personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing. If you object to processing for direct marketing purposes, your personal data will no longer be processed for those purposes.

You can send the objection informally to [email protected].

18.2 Competent Supervisory Authority

The data protection supervisory authority competent for us as a non-public body is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA — Bavarian State Office for Data Protection Supervision)

Promenade 18

91522 Ansbach

Germany

Telephone: +49 (0) 981 180093-0

Fax: +49 (0) 981 180093-800

Email: [email protected]

Web: https://www.lda.bayern.de

Without prejudice to your right to contact any other supervisory authority in an EU Member State, in particular the authority of your habitual residence, place of work or the place of the alleged infringement (Art. 77(1) GDPR).

For information — for public-law matters in Bavaria:

Bayerischer Landesbeauftragter für den Datenschutz (BayLfD — Bavarian Commissioner for Data Protection)

Wagmüllerstraße 18, 80538 München

Email: [email protected]

Web: https://www.datenschutz-bayern.de

Note: For TakeMeTo Inc. as a private company, the BayLDA in Ansbach is the relevant supervisory authority; the BayLfD is listed for information only.

19. Automated Decision-Making

Solely automated decision-making within the meaning of Art. 22 GDPR which produces legal effects concerning you or similarly significantly affects you does not take place. The profiling within the Travel DNA and the destination matching serves exclusively to personalize your travel suggestions.

20. Use of Generative AI – Transparency under the AI Act

Our platform uses AI systems to generate travel content and suggestions. In accordance with the transparency obligations under Art. 50 Regulation (EU) 2024/1689 (AI Act) we note the following:

• Responses from our travel planning chatbot may be AI-generated.
• AI outputs may contain errors, inaccuracies or fictitious statements; essential booking details must be verified before concluding a contract.
• We do not perform biometric categorization, emotion recognition or social scoring within the meaning of the AI Act.
• We do not use high-risk AI systems within the meaning of Annex III of the AI Act, nor practices prohibited under Art. 5 of the AI Act.
• AI-generated content is labeled visibly and/or in a machine-readable manner in accordance with Art. 50 of the AI Act.

Please direct reports of AI misconduct or AI-related harm to [email protected].

21. Data Security

We take appropriate technical and organisational measures (TOM) pursuant to Art. 32 GDPR to protect your data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or unauthorized access. These include in particular:

• Transport encryption (TLS 1.2+)
• encrypted database storage of sensitive fields
• access controls on a need-to-know basis
• regular security updates and penetration tests
• logging of critical accesses

22. Minors

Our online services are not directed at persons under 16 years of age. Minors may not submit personal data to us without the consent of their legal guardians. If we become aware of such processing, we will delete the data immediately.

23. Changes to this Privacy Policy

We reserve the right to adapt this Privacy Policy in order to bring it into line with changed legal situations or with changes to the service or data processing. We will inform you of material changes in good time in an appropriate manner (e.g. by email or notice in the app).

Updated: 2 November 2026 · Version: 1.3