Privacy Policy for Trip Canvas

1. Introduction

Trip Canvas helps users plan, organize, and manage travel itineraries. This Privacy Policy explains what information we collect, how we use it, how we protect it, and what rights you have regarding your personal data.

2. Who we are

Trip Canvas is operated by PhotoEnergy Ltd..

Contact email: privacy@travelsteps.net

Registered address: Bulgaria, Sofia, 1000, Petar Parchevich 31

3. Information we collect

Depending on how you use Trip Canvas, we may collect:

• Account information: such as your email address, name, and authentication details.
• Login information: if passwords are used, we store only a hashed version of your password, not the plain text password.
• Trip and planning data: such as destinations, dates, notes, itineraries, preferences, and saved travel plans.
• Technical information: such as device type, browser, app version, IP address, logs, and diagnostics.
• Usage information: such as pages visited, features used, and interactions with the app.
• Optional content: any information you choose to enter into the app.

4. How we use your information

We use your information to:

• Create and manage your account.
• Provide, personalize, and improve Trip Canvas.
• Save and display your trips and itineraries.
• Maintain security and prevent misuse.
• Fix bugs, monitor performance, and improve reliability.
• Comply with legal obligations.
• Communicate with you about your account or the service.

5. Legal bases for processing

Where applicable, we process personal data based on one or more of the following legal bases:

• Contract: to provide the Trip Canvas service you request.
• Legitimate interests: to secure, maintain, and improve the app.
• Consent: where we ask for your permission, such as for optional cookies or certain device permissions.
• Legal obligation: where required by law.

6. Sharing of information

We do not sell your personal data. We may share limited information with trusted infrastructure and service providers who help us host, store, and deliver Trip Canvas.

These providers may process data only as needed to provide their services to us and must protect the data they process.

Depending on how Trip Canvas is deployed and configured, those providers commonly include:

• Vercel — hosts and runs the Trip Canvas web application.
• PostgreSQL provider — stores accounts, trips, chat and planning content, expenses, and related application data (via Prisma). Production setups typically use a managed PostgreSQL database.
• Vercel Blob — stores files you upload to trips (for example attachments).
• Resend — sends transactional email such as password resets and trip invitations. Your deployment may alternatively route outbound mail through a custom relay URL you configure.
• OpenStreetMap — provides map tiles shown in the app (via Leaflet). Address lookup may use the OpenStreetMap Nominatim search API through Trip Canvas server-side routes.
• Public CDNs — Leaflet map marker assets may load from unpkg when viewing maps.

Trip Canvas verifies sign-in with HTTP-only session cookies and handles passwords inside the application (passwords are hashed and never stored in plain text). The codebase does not integrate a bundled third-party analytics SDK or consumer AI provider.

7. Cookies and similar technologies

Trip Canvas may use cookies or similar technologies to keep you signed in, remember preferences, improve performance, and understand how the app is used. Where required, we will ask for consent before using non-essential cookies.

8. Data retention

We keep your personal data only for as long as necessary to provide Trip Canvas, comply with legal obligations, resolve disputes, and maintain security. You may request deletion of your account and associated personal data by contacting us.

9. Security

We use reasonable technical and organizational measures to protect your information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. International transfers

Some of our service providers may process data in countries outside your country of residence. Where required, we use appropriate safeguards to protect your personal data during such transfers.

11. Your rights

Depending on your location, you may have the right to access, correct, delete, restrict, object to processing, or request a copy of your personal data. You may also have the right to withdraw consent where processing is based on consent.

To exercise your rights, contact us at privacy@travelsteps.net.

12. Children’s privacy

Trip Canvas is not intended for children under the age of 13, or the minimum age required in your country. We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, please contact us.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date above. Significant changes may be communicated through the app or by email where appropriate.

14. Contact

For questions about this Privacy Policy or your personal data, contact us at: