Privacy, AI and terms of use.
This page describes how TappaMia processes personal data and the terms that apply to the service currently available under controlled access. It is an operational policy aligned with the product currently running; it does not replace the professional review required before public opening, commercial activation or real payments.
1.Scope and service status
TappaMia is currently available free of charge under controlled access. Real payments and commercial subscriptions are not active. Features, limits and providers may evolve; material changes to privacy or terms will be made available on this page before they apply.
2.Controller and contact
The data controller for the current personal TappaMia project is Andrea Toninelli. For privacy requests, data-subject rights and service communications: support@tappamia.it. A professional address and any applicable tax/company identifiers will be published once defined and before commercial activation.
3.Data processed and source
Data mainly comes from you or is generated while you use the service. It may include email and account identifier, language and profile, trip preferences and parameters, generated itineraries, Booking Organizer and Booking Import notes and references, Flight Intelligence data, Collaboration content (role, comments and votes), Travel Memories (title, notes, favorites and uploaded photos), minimised technical usage data, API counters, support requests, beta waitlist sign-ups (email, optional destination, language and date) and information required for security and abuse prevention.
4.Purposes and legal bases
- Account, sync, trip storage, AI generation, maps and requested features: performance of the requested service and related pre-contractual/contractual steps.
- Support: handling the user’s request and, where relevant, performing the service.
- Beta waitlist: pre-contractual steps taken at your request, to let you know when you can access the service.
- Security, rate limits, abuse prevention, diagnostics and minimised telemetry: legitimate interest in protecting, understanding and maintaining a reliable TappaMia service.
- Legal obligations: compliance with applicable law where required.
We do not use personal data for behavioural advertising or commercial profiling.
5.Required and optional data
Email, credentials handled by Supabase and the minimum parameters required by the creation flow are necessary for the relevant cloud features. Additional preferences, notes, booking references, flight data, collaboration comments and Travel Memories are voluntary; if you do not provide them, some features or personalisation may be less complete but the account can still be used within the current service limits.
6.Account and authentication
Authentication is handled through Supabase Auth. TappaMia does not store passwords in plain text. Email confirmation, sessions and password recovery use Supabase flows. Cloudflare Turnstile may be loaded in authentication and support flows to distinguish legitimate human traffic from automated abuse.
7.Artificial intelligence and automated decisions
TappaMia uses artificial intelligence systems to generate, regenerate and edit itineraries and organisational estimates, as well as features such as Smart Replan, Travel Assistant, Smart Packing and Booking Import when they require AI processing. Information needed for the request — such as destination, dates, preferences, budget and relevant notes — may be sent by the TappaMia server to the configured AI provider, currently OpenAI. The app discloses AI use before generation. Outputs are suggestions and may contain errors or outdated information.
TappaMia does not use AI for solely automated decisions that produce legal or similarly significant effects on the user. You decide whether to use, edit or ignore any suggestion. Do not enter passwords, full card numbers, complete identity documents or unnecessary special-category data.
8.Maps, geocoding and logistics
Geoapify processes geocoding, place search and routing requested by the app; displayed maps use OpenStreetMap with the applicable attribution. Places, coordinates, distances, timings and routes are planning aids and may be incomplete, approximate or outdated.
9.Recipients and providers
To provide the service, data may be received as necessary by: Vercel (hosting/runtime and technical logs), Supabase (Auth, database, waitlist, private Storage for Travel Memories and technical aggregates), Cloudflare (Turnstile/abuse prevention), OpenAI (AI features), Geoapify (geocoding/routing), OpenStreetMap and mapping infrastructure for display, plus the configured email provider for support. Better Stack performs HTTP availability and health monitoring and does not receive itinerary content through a dedicated application integration.
10.International transfers
Some providers may process data or operate infrastructure outside the European Economic Area. Where the GDPR requires safeguards for those transfers, applicable mechanisms must be used, such as adequacy decisions or Standard Contractual Clauses. The final contractual mapping of locations, subprocessors and transfer safeguards remains a mandatory gate before public opening.
11.Retention and deletion
| Category | Current retention criterion |
|---|---|
| Account, profile and cloud trips | Until the account or individual trip is deleted, subject to any legal retention duty. |
| Collaboration and Travel Memories | Comments, votes, roles and memories remain linked to the trip until removed through available controls or until the trip/account is deleted. Travel Memories photos are stored in a private Storage bucket. |
| Local trip/navigation cache | Resilience copy on the device; removed on logout and account deletion under current flows. |
| API usage counters | Associated with the account to enforce limits; current database relationships remove them with account deletion. |
| Beta waitlist | Until the invitation is sent and in any case no longer than 12 months from sign-up (automatic daily deletion), unless earlier removal is requested. |
| Support | For the time needed to handle the request and reasonable follow-up; a formal maximum policy must be defined before public opening. |
| Technical / anti-abuse logs | Minimised and retained according to operational needs and provider configuration; maximum periods must be consolidated in the provider register before public opening. |
| Aggregate product events | Stored as daily aggregate dimensions without account/trip identifier, destination, notes or coordinates; final retention to be formalised before public opening. |
12.Cookies, session, local storage and telemetry
| Element | Purpose | Duration / criterion |
|---|---|---|
| Technical access cookie | HttpOnly/Secure technical cookie used to keep access to the protected site. | 7 days after successful access. |
| Supabase session | Authentication, session refresh and account-resource access. | Managed by the Supabase client according to the session lifecycle; cleared locally on logout. |
| TappaMia local storage | Resilience cache, navigation state and offline features. On the access page, a flag remembering whether a code has already been used in that browser. | Linked to the account/device and cleared by the relevant logout/deletion flows. |
| Turnstile | Bot and abuse prevention in flows where enabled. | Technical data processed according to provider operation and policies. |
Advertising cookies and marketing-profiling tools are not active. If non-essential tools are introduced, the notice and consent controls will be updated before activation.
13.Product analytics and diagnostics
TappaMia records minimised, aggregateable functional events such as wizard start/completion, generation outcome, opening map/PDF/Travel Mode and plan interest. These events contain no email address, account or trip identifier, destination, note, coordinate or itinerary content, require no analytics cookie and are not used for advertising or profiling. Client errors are reduced to error name, fingerprint, page and technical location without raw message or stack.
14.Support and waitlist
When you use the support form we process your email address and message to answer your request through the configured email infrastructure. The form applies origin checks, rate limits and, when required, Cloudflare Turnstile. Do not send credentials, full card numbers or unnecessary data.
If you join the beta waitlist we process your email, the optional destination you choose, your language and the sign-up date, solely to let you know when a spot opens. The data is stored in Supabase in a table that cannot be accessed from the browser and is not used for newsletters, marketing or profiling. It is kept until the invitation is sent and in any case no longer than 12 months from sign-up, with automatic deletion; you can ask for earlier removal by writing to support@tappamia.it.
15.Bookings and external websites
TappaMia may open external services such as Skyscanner, Booking.com or GetYourGuide. Booking Import organizes booking data provided by the user but does not create or confirm reservations. TappaMia does not conclude those bookings or collect their payment. Prices, availability, terms, cancellations and processing on the external website are governed by the provider chosen by the user.
16.Access, export and deletion
From “My trips” you can export a JSON copy of account data and trips available in the app. Individual trips can be deleted. Self-service account deletion, when configured, requires an authenticated session and email confirmation and deletes the Supabase user; current database relationships remove the linked profile, trips and API counters. If the feature is unavailable, contact support@tappamia.it.
17.Privacy rights
Where provided by the GDPR you may request access, correction, deletion, restriction, portability and objection; if a future processing activity relies on consent, you may withdraw it without affecting prior lawfulness. You may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali). To protect the account we may ask you to verify your identity or use the associated email address.
18.Minors and special-category data
TappaMia is not designed as a service directed to children and does not intentionally request health, biometric or other special-category data. Do not provide such information unless strictly necessary. The final age threshold and any minors procedure must be defined before public access.
19.Terms and acceptable use
The service may be changed, limited or suspended for maintenance, security or product development. Do not use TappaMia for unlawful activity, unauthorised access, limit circumvention, abusive automation, infringement of others’ rights or attempts to compromise the service. You retain rights in content you submit and grant TappaMia only the technical use needed to provide the requested features.
20.Intellectual property and AI output
The TappaMia brand, interface, code, graphics and original content remain protected under applicable law. AI outputs may not be exclusive and may contain elements similar to outputs provided to other users; use remains subject to third-party rights and applicable provider terms. TappaMia does not guarantee exclusive originality of generated output.
21.Reliability, official sources and liability
Itineraries, cost estimates, opening times, distances, entry requirements, health information, availability and suggestions are not official verification or professional advice. Before purchasing or travelling, verify critical information with carriers, venues, authorities, consulates and other official sources. To the extent permitted by law, TappaMia does not guarantee uninterrupted availability, absence of errors or suitability of a suggestion for a specific trip.
22.Changes, suspension and applicable law
We may update these terms to reflect product, security or legal changes. Material updates will change the revision date and be made accessible in the service. Italian law applies to the extent permitted; any mandatory consumer protections and legally applicable consumer forum remain unaffected.
Commercial availability
Paid purchases and subscriptions are not available yet. Before commercial activation, the terms applicable to paid services will be published and made accessible, including information on pricing, duration, renewal, withdrawal, refunds and invoicing as required by applicable law.