Legal
Privacy policy
Last updated: 23.10.2026
This policy explains what personal data we collect, why, how long we keep it, and your rights under the General Data Protection Regulation (GDPR).
1. Data controller
- Company
- AI Solutions 2026 Ltd
- Company ID (EIK)
- 208961316
- Registered address
- 17 Mermer Kamak St, entr. 2, fl. 1, apt. 6, Ruse 7000, Bulgaria
2. What we collect
- Account: email address and password. Passwords are stored only in hashed form — we cannot see them.
- Your plans: the answers you give while planning (city, dates, pace, who you travel with, interests, budget, food needs, number of adults and children and, if you choose, the children's ages — for children's tickets and suitable places), the finished plans and the history of changes to them. A plan you made but didn't save is kept as a "pending plan" so you can come back to it.
- Payments: handled by Stripe. We receive only the payment confirmation, amount and email — never your card details.
- Messages: when you use the contact form — your name, email and message.
- Reservations: flights, hotels, cars and other bookings you add to your plan. If you forward a confirmation email or upload a photo or PDF of one, we keep only the booking details (and the email's subject) — not the email, photo or file itself.
- Technical data: IP address, browser type and time of visit in server logs, kept briefly for security and troubleshooting.
- Cookies: only essential ones — see the Cookie policy.
We do not collect special categories of data and we do not ask for the names of the people you travel with. Children's ages are optional.
3. Why we use it and on what basis
- To provide the service — create, save and send your plan and run your account (performance of a contract, Art. 6(1)(b) GDPR).
- Accounting and tax — payment records (legal obligation, Art. 6(1)(c)).
- To answer your messages and keep the site secure (legitimate interest, Art. 6(1)(f)).
We do not sell your data, use it for advertising, or make automated decisions with significant effects on you.
4. How long we keep it
- Account and plans — as long as the account exists; deleted within 30 days of a deletion request. The history of changes keeps up to 40 versions of a plan.
- Unsaved ("pending") plans — up to 90 days after their last change.
- Records of payments, wherever you pay from — 10 years. Our company is registered in Bulgaria, and Bulgarian accounting law requires us to keep them for that long.
- Contact-form messages — up to 2 years.
- Server logs — up to a few weeks.
5. Who we share it with
We use trusted providers that process data only on our instructions:
- Render — website and database hosting (servers in Frankfurt, Germany).
- Stripe — payment processing.
- Google (Gmail) — sending and receiving email.
- Anthropic — reading forwarded booking emails and uploaded photos and PDFs of bookings. They are processed only for this and are not used for training.
- Cloudflare — domain and email forwarding.
- OpenStreetMap, unpkg and Wikimedia Commons — maps and photos on the site load from their servers, which receive your IP address.
Some of these providers may process data outside the European Union. In such cases appropriate safeguards apply, such as the European Commission's standard contractual clauses or the EU–US Data Privacy Framework.
6. Your rights
You have the right to access, correct or delete your data, to restrict processing, to data portability, and to object to processing based on legitimate interest. To exercise them, write to hello@daybydaytrips.com — we reply within 30 days.
If you believe your rights have been breached, you can complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg) or the data protection authority where you live.
7. Security
The site works only over a secure connection (HTTPS), passwords are stored hashed, and access to data is restricted.
8. Changes
If we change this policy, we will publish the new version here with a new date.