Privacy Policy

1. Data controller

Varoam is a travel planning service operated by Masciin IT. For any privacy question or request, contact ia@masciinit.com.

2. Data we collect

• Account data: name, email address, profile image and authentication identifiers when you sign in.
• Travel content: trips, itineraries, notes, budgets, booking status and collaboration data that you create or import.
• AI requests: prompts, voice transcriptions and the context needed to generate or improve an itinerary.
• Technical data: IP address, device and browser information, security events, error reports and service logs.
• Preferences and consent: language, notification choices, email consent and analytics choices.
• Affiliate data: the partner, placement and trip context associated with an outbound affiliate click.

3. How we use your data

• Provide, save, synchronise and share the travel plans you request.
• Generate suggestions and itineraries using configured AI providers.
• Send service messages, reminders and alerts that you request.
• Secure the service, enforce usage limits and investigate failures or abuse.
• Measure and improve the service when analytics consent is required and granted.
• Measure outbound affiliate referrals and commissions.

Varoam is free at launch. We do not currently sell a subscription or collect payment-card details.

4. Legal bases

• Contract: account, trip, collaboration and AI processing needed to provide the service you request.
• Legitimate interests: service security, fraud prevention, essential diagnostics and product reliability.
• Consent: optional emails, notifications and non-essential analytics or affiliate trackers.
• Legal obligations: records that must be kept to meet applicable duties.

5. Recipients and service providers

Data is available only to authorised personnel and providers that need it for the purposes described above. Depending on the configuration and feature you use, these categories may include:

• hosting, database, storage and security infrastructure;
• Google OAuth for authentication;
• AI and transcription providers used to answer your request;
• email, push-notification, monitoring and error-reporting providers;
• analytics providers, only under the applicable consent settings;
• travel affiliate partners when you choose to follow their link.

Opening an affiliate link takes you to a third-party service. That partner then processes data under its own privacy policy. Affiliate tracking is never a condition for using Varoam.

6. International transfers

Some providers may process data outside the European Economic Area. Where required, we rely on an adequacy decision, approved contractual safeguards or another lawful transfer mechanism. You may contact us for information about the safeguards applicable to your data.

7. Retention

• Account and saved-trip data is kept while your account is active, unless you delete it earlier.
• Public or shared content remains available until you remove it or close the account, subject to copies already made by collaborators.
• Security, diagnostic and email-delivery records are kept only for the period needed to protect the service, investigate incidents and establish legal claims.
• Consent and suppression records may be retained as necessary to demonstrate and respect your choices.
• Affiliate attribution data is retained according to applicable attribution, accounting and legal requirements.

8. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability or object to certain processing. You may withdraw consent at any time without affecting earlier lawful processing. Use the account privacy controls or contact ia@masciinit.com. You may also lodge a complaint with the CNIL or your local data protection authority.

9. Cookies and similar technologies

Varoam uses necessary storage for authentication, security and preferences. Non-essential analytics and affiliate trackers are activated only when the applicable consent has been obtained. You can change or withdraw your choices through the cookie controls.

10. AI features

When you use an AI feature, the prompt and relevant travel context may be sent to the configured provider. Do not include passport numbers, payment data, health information or other sensitive personal data in a prompt. AI output may be inaccurate and should be checked before booking or travelling.

11. Changes and contact

We may update this notice when the service or its providers change. Material changes will be highlighted in the service when appropriate. For questions, contact ia@masciinit.com.