Privacy Policy

Etape — AI-Powered Road Trip Planner

Effective Date: March 2, 2026

1. Introduction

Welcome to Etape ("we," "us," or "our"). Etape is an AI-powered road trip planner that helps you discover interesting stops along your driving routes. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and associated backend services (collectively, the "Service").

This Privacy Policy has been drafted in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Finnish Data Protection Act (Tietosuojalaki 1050/2018), and other applicable data protection laws. By using Etape, you acknowledge the collection and processing of information as described in this policy.

2. Data Controller

The data controller responsible for your personal data is:

Hannu Kallan
Email: etapeapp@gmail.com
Country: Finland

As a sole developer operating within the European Economic Area (EEA), we are subject to the GDPR. You may contact us at the email address above for any data protection inquiries.

3. Information We Collect

3.1 Location Data

To provide route planning and stop discovery, we process the following location-related data:

• Route start and destination addresses that you enter
• Route waypoints and calculated driving routes
• Geographic coordinates of suggested stops along your route

We do not continuously track your real-time GPS location in the background. Location data is only processed when you actively plan a route within the app.

3.2 Usage Data and Preferences

We collect information about how you interact with the Service to improve your experience:

• Travel profile settings (e.g., travel style tags such as "with kids," "with dog," "campervan")
• Guide mode preferences (Explorer or Foodie)
• Taste profile data (likes and dislikes of stops)
• Saved routes and saved stops
• Recent search history
• Subscription tier and discovery usage count (Free: up to 3 discoveries/month, Pro: up to 30 discoveries/month)
• App settings (unit system, dark mode, language preference)

This data is stored locally on your device and is used to personalize your experience. Taste profile data may be transmitted to our servers to improve AI-generated recommendations.

3.3 Device and Technical Information

We automatically collect certain technical information when you use the Service:

• Device type and model
• Operating system and version
• App version
• Anonymous usage analytics (via TelemetryDeck)

4. Lawful Basis for Processing

Under Article 6 of the GDPR, we process your personal data based on the following lawful bases:

Processing Activity	Data Category	Lawful Basis	GDPR Article
Route calculation and stop discovery	Location data	Contract performance	Art. 6(1)(b)
AI-powered recommendations	Location, preferences	Contract performance	Art. 6(1)(b)
Taste profile training (Pro)	Taste profile data	Consent	Art. 6(1)(a)
App analytics via TelemetryDeck	Device info, usage events	Legitimate interest	Art. 6(1)(f)
Service improvement and bug fixing	Technical data	Legitimate interest	Art. 6(1)(f)
Weather data for stops	Location coordinates	Contract performance	Art. 6(1)(b)
Subscription and usage tracking	Discovery count, tier	Contract performance	Art. 6(1)(b)

Where we rely on legitimate interest as the lawful basis, we have conducted a balancing test to ensure that our interests do not override your fundamental rights and freedoms. Our legitimate interests include improving the Service, ensuring its security, and understanding aggregate usage patterns. TelemetryDeck collects only anonymous, non-personal data, which minimizes any impact on your privacy.

Where we rely on consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

5. How We Use Your Information

We use the information we collect for the following purposes:

• To provide and operate the Service, including calculating routes and discovering stops
• To personalize AI-generated stop recommendations based on your travel profile and preferences
• To provide weather information for stops along your route
• To calculate detour time estimates
• To improve, maintain, and optimize the Service
• To monitor app performance and diagnose technical issues

We do not use your data for automated decision-making or profiling that produces legal effects or similarly significant effects on you. AI-generated recommendations are informational suggestions only and do not constitute automated decisions within the meaning of Article 22 of the GDPR.

6. Third-Party Services and Data Processors

Etape integrates with the following third-party services to provide its functionality. Where these services process personal data on our behalf, they act as data processors under Article 28 of the GDPR. Each service processes data according to its own privacy policy:

Service	Purpose	Data Shared
Anthropic (Claude API)	AI-powered stop discovery, enrichment, and recommendations	Route coordinates, travel preferences, taste profile data
Google Places API	Place validation, geocoding, photos, and ratings	Location coordinates, place search queries
Mapbox	Geocoding fallback	Location coordinates, address queries
OSRM	Route calculation and detour time estimates	Route coordinates and waypoints
Overpass API	Point-of-interest discovery (fallback)	Geographic corridor coordinates
TelemetryDeck	Privacy-friendly app analytics	Anonymous usage events, device type, OS version

TelemetryDeck is a privacy-focused, GDPR-compliant analytics service based in the European Union. It does not use cookies, does not collect personal data, and does not track users across apps or websites. For more information, see TelemetryDeck's privacy policy.

7. International Data Transfers

Some of our third-party service providers are located outside the European Economic Area (EEA). In particular:

• Anthropic (Claude API): Based in the United States. Data transfers are governed by Standard Contractual Clauses (SCCs) as approved by the European Commission under Article 46(2)(c) of the GDPR.
• Google Places API: Operated by Google LLC (United States). Google relies on SCCs and supplementary measures for data transfers from the EEA. See Google's data processing terms.
• Mapbox: Based in the United States. Data transfers are governed by SCCs.
• OSRM and Overpass API: Open-source services. OSRM routing requests contain only geographic coordinates and do not include personal identifiers.
• TelemetryDeck: Based in the European Union. No international data transfer is required.

We only transfer personal data to countries outside the EEA where adequate safeguards are in place, such as an adequacy decision by the European Commission, Standard Contractual Clauses, or other approved transfer mechanisms under Chapter V of the GDPR.

8. Data Storage and Security

Most of your data (travel profile, saved routes, saved stops, preferences, and search history) is stored locally on your device. We do not maintain user accounts or require registration to use the Service.

When you plan a route, your route data and preferences are transmitted to our backend servers hosted on Railway (cloud infrastructure). This data is processed in real-time to generate recommendations and is not stored persistently on our servers after the request is fulfilled.

In accordance with Article 32 of the GDPR, we implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit using TLS/HTTPS
• Secure API key management for third-party service integrations
• Minimal data collection and processing (data minimization principle)
• No persistent storage of personal data on backend servers

However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, in accordance with Article 5(1)(e) of the GDPR:

• Local data: Stored on your device until you delete the app or clear app data. You have full control over this data.
• Route processing data: Processed in real-time and not retained on our servers after the request is completed. No personal data from route requests persists beyond the active session.
• Analytics data: TelemetryDeck retains anonymous, aggregated analytics data in accordance with its own retention policy. As this data is anonymous, it does not constitute personal data under the GDPR.

10. Children's Privacy

The Service is not directed to children under the age of 16 (the default age of digital consent under Article 8 of the GDPR, as applicable in Finland). We do not knowingly collect personal information from children under this age. If you are a parent or guardian and believe that your child has provided us with personal data, please contact us at etapeapp@gmail.com so that we can take appropriate steps to delete such information.

11. Your Rights Under the GDPR

If you are located in the European Economic Area, you have the following rights under the GDPR. You may exercise these rights by contacting us at etapeapp@gmail.com:

• Right of access (Article 15): You have the right to request confirmation of whether we process your personal data and to obtain a copy of that data. Since most data is stored locally on your device, you have direct access to it at all times.
• Right to rectification (Article 16): You have the right to request correction of inaccurate personal data. You can update your travel profile, preferences, and saved data directly within the app.
• Right to erasure (Article 17): You have the right to request deletion of your personal data. You can delete all local data by uninstalling the app or clearing app data in your device settings. Since we do not retain personal data on our servers, no server-side deletion is required.
• Right to restriction of processing (Article 18): You have the right to request restriction of processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.
• Right to data portability (Article 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format. As most data is stored locally on your device, you can access and export it directly.
• Right to object (Article 21): You have the right to object to processing based on legitimate interest. If you object, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent (Article 7(3)): Where processing is based on consent (e.g., taste profile data), you may withdraw your consent at any time without affecting the lawfulness of processing carried out before the withdrawal.
• Right to lodge a complaint (Article 77): You have the right to lodge a complaint with a supervisory authority. For users in Finland, the relevant authority is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto):

Office of the Data Protection Ombudsman
Lintulahdenkuja 4, 00530 Helsinki, Finland
Website: https://tietosuoja.fi/en
Email: tietosuoja@om.fi

We aim to respond to all legitimate requests within one month. In certain circumstances, such as complex or numerous requests, this period may be extended by a further two months, in which case we will notify you.

11.1 Opt Out of Analytics

TelemetryDeck respects Apple's App Tracking Transparency (ATT) framework and the "Limit Ad Tracking" setting on your device. You can opt out of analytics collection by enabling this setting in your iOS device preferences.

12. Data Protection by Design and by Default

In accordance with Article 25 of the GDPR, we have designed Etape with data protection principles built in from the outset:

• Data minimization: We only collect data that is strictly necessary for providing the Service. Most data is stored locally on your device.
• Purpose limitation: We process data only for the specific purposes described in this policy.
• Storage limitation: Route processing data is not retained after the request is fulfilled. We do not build persistent user profiles on our servers.
• Privacy by default: The app functions without requiring user accounts or registration. Analytics are collected anonymously via TelemetryDeck.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, regulatory, or operational reasons. We will notify you of any material changes by posting the updated Privacy Policy within the app and updating the "Effective Date" at the top of this document. Where required by the GDPR, we will seek your consent before applying material changes that affect how your personal data is processed.

14. Contact Us

If you have any questions or concerns about this Privacy Policy, our data practices, or if you wish to exercise your rights under the GDPR, please contact us at:

Hannu Kallan (Data Controller)
Email: etapeapp@gmail.com
Country: Finland