Privacy Policy

Last updated: 24 September 2026

Data controller

This policy covers voyapage.cc and its associated travel guides. MATIKUS, LDA is responsible for operating the service and the processing described here. The privacy policy of our company website, matikus.com, covers that website's own operations. While checkout is disabled, it does not accept new orders; descriptions of order processing apply to existing orders and use after checkout is enabled.

Data we process

Depending on the features you use, we process:

• First name, optional last name, email address, correspondence and support requests.
• Billing and tax details that you enter with Creem. Creem collects these for the sale and invoicing.
• Order amount, payment status and transaction identifiers. Full card or bank login details are processed in the payment flow by Creem and its payment providers, not in our order form.
• Destinations and travel dates, duration, travel style, budget, group size, ages of accompanying children, interests, accommodation, transport, optional requests, and the guides and checklists created from them.
• IP address, request time and technical request information, particularly for delivering the website, diagnosing errors and preventing abuse.
• Browser and device information, language preferences and – only with the relevant consent – usage data for Google Analytics.

Describe preferences in general terms and do not enter names, diagnoses or other sensitive information about fellow travellers. Optional details about your own mobility, diet or personal requests may reveal health or religion. MATIKUS and Anthropic's Claude API process them for personalisation only with your explicit consent (Articles 6(1)(a) and 9(2)(a) GDPR). You can leave them out or remove them before purchasing and order without them. You can withdraw consent at any time by email; we then stop using these details and assess erasure. We cannot recall files already downloaded.

Purposes and legal bases

• Article 6(1)(b) GDPR: travel planning you request, processing orders, creating and delivering guides, and contractual support. Without the necessary information, we cannot deliver the requested guide.
• Article 6(1)(b) GDPR for pre-contractual and contractual correspondence; Article 6(1)(f) GDPR for other enquiries. Our interest is reliable communication with users and prospective customers.
• Article 6(1)(c) GDPR: complying with legal obligations, particularly tax and accounting requirements.
• Article 6(1)(f) GDPR: secure and reliable operation, troubleshooting, preventing abusive requests, and handling or defending legal claims. Location and map features support the travel planning you request.
• Article 6(1)(a) GDPR: optional newsletters and usage analytics. Consent is voluntary and can be withdrawn at any time for the future.

Service providers and other recipients

• Creem (Armitage Labs OÜ) – Sales and payments as merchant of record, including invoicing, taxes and refunds. Creem receives the contact details and order references needed for checkout and shares payment and order information with us. Creem acts as a controller for its own sales and legal obligations.
• Anthropic (Claude API) – Creates guide content from the travel details and preferences submitted to it. We use the commercial API; under its standard terms, this content is not used to train models. The provider's contractual retention and security rules apply.
• Hetzner – Hosting, database operation and storage of guide files in our European infrastructure.
• Brevo – Sends order and support messages through the configured SMTP service and manages newsletter contacts if you subscribe. This includes email addresses, names and message content.
• Komoot / Photon · OpenStreetMap / Nominatim – For place and accommodation suggestions, our server queries Komoot's public Photon service using OpenStreetMap data. It receives your search text, selected language and our server's technical connection data, not your IP address or browser cookies. We cache search results in memory for up to 24 hours. Search only for places or accommodation; do not enter people's names or confidential information. Additional geographic queries for map generation are made server-side via Nominatim/OpenStreetMap. Search supports the travel planning you request (Article 6(1)(b) GDPR).
• OpenFreeMap – When you open interactive maps, your browser loads map resources from OpenFreeMap, sending your IP address and technical connection data to that service. External navigation links, such as Google Maps links, open the relevant provider when you click them.

Processing outside the EEA

Some providers, particularly Anthropic and Google, may also process data outside the European Economic Area, including in the United States. Where required, transfers rely on adequacy decisions or appropriate safeguards under Articles 44 onwards GDPR, particularly EU Standard Contractual Clauses. You can request information about safeguards applicable to your data through our privacy contact.

Cookies and browser storage

Necessary Voyapage storage: NEXT_LOCALE is a language cookie lasting for the browser session; voyapage-cookie-consent records your choice in localStorage for up to one year. voyapage_wizard_v1 saves your requested planning progress, including contact and trip details, locally. After seven days since the last change, the draft is discarded when the planner is next opened; you can clear it at any time in your browser settings. Consent boxes are not preselected when you reopen the planner. Guide checklists are stored locally (voyapage:guide:token:list) and on our server through the private guide link. Local checklist entries remain until you clear site data. Admin sign-in and preview access use additional security cookies not needed by ordinary visitors. Only after analytics consent does Google set first-party cookies _ga and _ga_* for up to one year; we remove them when consent is withdrawn. Creem's checkout provides its own cookie information. You can clear local data in your browser settings.

Newsletter and contact

Newsletter signup is voluntary and independent of purchase. When offered, we first send a confirmation email through Brevo. Only clicking its confirmation link adds you to the mailing list (double opt-in). We record the signup wording, time and confirmation evidence. Every marketing email includes an unsubscribe option; you can also email us. Necessary order and support messages are separate.

Retention

We retain personal data for as long as needed for delivery, support, security or handling claims. Tax-relevant books, records and supporting documents in Portugal are generally subject to a ten-year retention requirement; special legal periods may differ. This does not mean all travel preferences need to be kept for ten years. Data no longer needed is deleted or anonymised unless retention obligations or unresolved claims require otherwise. Newsletter data is processed until you unsubscribe; necessary evidence of consent or unsubscription may be kept longer. Expiry of a guide or download link does not automatically delete all associated data. Creem and other providers acting as independent controllers apply their own retention rules.

Your rights

Subject to the applicable legal conditions, you have the following rights:

For access, correction, export or erasure, email voyapage@matikus.com, preferably from your order address. No customer account or special form is required. We verify identity proportionately and normally respond within one month; any lawful extension is explained within that month. We distinguish trip data and guide files from records subject to legal retention. Recipients, email systems and backups are handled separately. We explain any data retained and the reasons.

• Access to your personal data (Article 15 GDPR).
• Rectification of inaccurate data (Article 16 GDPR).
• Erasure of your data (Article 17 GDPR).
• Restriction of processing (Article 18 GDPR).
• Data portability (Article 20 GDPR).
• Objection to processing based on legitimate interests for reasons relating to your particular situation; objection to direct marketing at any time (Article 21 GDPR).
• Withdrawal of consent for the future, without affecting the lawfulness of prior processing (Article 7(3) GDPR).

Optional analytics with Google Analytics 4

Only after your active consent do we load Google Analytics 4 from Google Ireland Limited. It may process cookie identifiers, public page views and device information; these data are not fully anonymous. Google may process data in the USA. Private guide, order, planner, admin and legal pages are excluded from our analytics. Reset consent using Cookie settings in the footer: analytics stops and its first-party cookies are removed. The website works without analytics.

Google's privacy policy

AI and automated decisions

We use AI to compile travel recommendations. This does not involve solely automated decisions producing legal or similarly significant effects within the meaning of Article 22 GDPR. Recommendations are planning aids and should be checked for accuracy before travelling.

Right to complain

You can complain to a data protection authority, particularly in the country where you live or work or where an alleged infringement occurred. The Portuguese authority is CNPD (Comissão Nacional de Proteção de Dados). You do not need to contact us first.

CNPD – Comissão Nacional de Proteção de Dados

Privacy contact: voyapage@matikus.com