Privacy Policy

When you use Wayloha, we collect information you provide directly:

Account data: Email address, name and password when you create an account.

Travel preferences: Destination, travel dates, budget, travel style, group composition and nationality — used to generate your personalised itinerary.

Usage data: Which features you use, which pages you visit and how you interact with the platform. This helps us improve the product.

Device data: Browser type, operating system, IP address and approximate location (city/country level only).

We do not collect sensitive personal data (health information, social security numbers, financial account details).

We use your data for the following purposes:

Itinerary generation: Your travel preferences are sent to our AI model (Anthropic Claude) to generate your personalised itinerary and preparation guide. We do not store your preferences with Anthropic.

Account management: To authenticate you and store your generated itineraries.

Product development: Aggregated, anonymised usage data helps us improve our features and fix bugs.

Communication: If you sign up, we may send you product updates or travel inspiration. You can unsubscribe at any time.

We do not sell your personal data to third parties. We do not use your data for advertising purposes.

Affiliate links: Wayloha earns a small commission when you click booking links (hotels via Booking.com, activities via GetYourGuide) and make a purchase. This costs you nothing extra. The commission helps us keep the free plan free.

Cookies: We use essential cookies for authentication sessions. Beyond that there are three categories you switch on or off yourself, and each only loads once you have switched it on:

- Analytics — PostHog, anonymised, to understand how the platform is used.
- Affiliate — booking-partner tracking; those cookies are set on the partner's own site after you click through.
- Advertising — the Meta Pixel, which measures which ads on Facebook and Instagram lead to a visit. This one does set a cookie on wayloha.com itself and shares visit data with Meta. Meta acts as an independent controller for that data; see [Meta's privacy policy](https://www.facebook.com/privacy/policy).

Without your consent none of the three loads: no code from those parties is present in the page at all.

You can change your choice at any time via Cookie settings at the bottom of every page.

Your data is stored in Supabase (PostgreSQL database hosted on AWS), with servers in the EU region by default.

We use industry-standard security measures:
- Encrypted connections (HTTPS/TLS) for all data in transit
- Row-level security on all database tables
- Passwords hashed with bcrypt
- Regular security reviews

No system is perfectly secure. If you are aware of any security issues, please contact us at security@wayloha.com.

If you are located in the European Economic Area (EEA), you have the following rights:

Access: Request a copy of the personal data we hold about you.

Correction: Request correction of inaccurate data.

Deletion: Request deletion of your account and associated data. We will delete your data within 30 days of a verified request.

Portability: Receive your data in a machine-readable format.

Objection: Object to the processing of your data for specific purposes.

To exercise any of these rights, email us at privacy@wayloha.com. We respond within 30 days.

Wayloha integrates with the following third-party services:

- Anthropic — AI model provider. Prompts and generated content are processed by the Anthropic API. See Anthropic's privacy policy at anthropic.com/privacy.
- Supabase — Database and authentication. See supabase.com/privacy.
- Booking.com, GetYourGuide — Affiliate booking links. When you click these links, you are subject to the privacy policies of those providers.
- Unsplash — Travel photography. Images are loaded directly from the Unsplash CDN.

We do not share your personal data with these services beyond what is necessary for the described integrations.

If you sign up as a creator and connect your Instagram account, we verify through Meta (Facebook Login) that the account is really yours. In doing so we process and store:

Profile data: your Instagram username, profile picture and biography — shown on your creator profile.

Public statistics: follower count and average engagement (calculated from likes and comments on your recent posts). These determine your creator tier and are visible to brands on the marketplace once you are verified.

Aggregate audience statistics: aggregate demographics of your audience (age ranges, gender split and country/city distribution) plus reach and posting frequency. These are statistics about your audience as a whole — never data about individual followers. We retrieve them via the minimal, read-only insights permission using the same connection token below, and use them to help brands assess whether your audience is a fit and to give you insight into your own audience.

Connection token: an access token issued by Meta (valid for up to 60 days) that lets us periodically refresh your statistics and show your recent posts to brands. We only read — we never post to or change anything on your account, and we request only the minimal permissions needed for this.

You can revoke the connection at any time in your Facebook settings (Business Integrations) or by deleting your account — we then delete the token and the retrieved data as well. See also Meta's privacy policy at facebook.com/privacy.

If you connect your YouTube channel, we verify through Google that the channel is really yours. In doing so we process and show:

Channel data and public statistics: your channel name and subscriber count — shown on your creator profile and to brands on the marketplace once you are verified.

Aggregate viewer statistics: aggregate demographics of your viewers (age ranges, gender split and country). These are statistics about your audience as a whole — never data about individual viewers. We use them to help brands assess whether your audience is a fit and to give you insight into your own audience.

We read this data once via Google's minimal, read-only permission — we do not store a YouTube token and we never post to or change anything on your channel. You can revoke access at any time in your Google account settings (Security → Third-party apps and services) or by deleting your account. See also Google's privacy policy at policies.google.com/privacy.

We retain your data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, unless we are required to retain it for legal or regulatory reasons.

Anonymous, aggregated usage statistics may be retained indefinitely as they cannot be linked to individual users.

We may update this Privacy Policy from time to time. If we make significant changes, we will notify you by email (if you have an account) or by posting a notice on our website.

The date of the most recent revision appears at the top of this page.

For privacy questions or to exercise your rights, please contact us:

Email: privacy@wayloha.com

Data controller: Wayloha is a trade name of Cozy Vida (sole proprietorship), Dutch Chamber of Commerce (KvK) 92907040

Postal address: Cozy Vida (Wayloha), Fresiatuin 4, 2643 NJ Pijnacker, the Netherlands

We aim to respond to all requests within 5 business days.