Privacy Policy

Waypost is a map-based trip-planning service, based in the Netherlands.

This Privacy Policy explains what personal data we process, why we process it, the parties that may process it on our behalf, and the rights available to you.

1. Contact

Waypost is operated from the Netherlands. For privacy questions or requests, including access to or deletion of your data, contact us at contact@gowaypost.app.

2. What data we process

Depending on how you use Waypost, we may process the following information.

Account information

If you create an account, we may process your email address and authentication information.

If you use Google to sign in, Google may provide us with information associated with your Google account that is required for authentication, such as your email address and account identifier.

Trip information

We process information that you add to your trips, such as:

• trip names and dates;
• saved places and their locations;
• notes and other descriptions;
• colours and other trip settings;
• photographs or image references;
• the order of stops and routes.

Sharing information

When you use sharing features, we may process information needed to provide those features, such as sharing links, permissions and information about users who have access to a shared trip.

Technical information

When you use Waypost, our service providers may process technical information such as IP addresses, request times, device or browser information, security information and server logs.

Browser storage and location

Waypost may store certain information locally in your browser, such as an unsaved trip draft or display preferences.

If you give your browser permission to use your device’s location, Waypost may use that location to centre the map. We do not intentionally store that location as account information unless it becomes part of information that you save to Waypost.

3. Why we process personal data, and on what basis

We process personal data for the purposes below. Where the GDPR applies, each purpose rests on the legal basis named with it.

• Providing Waypost — operating the service, creating and managing accounts, authenticating users, storing and displaying your trips, and providing sharing and collaboration features. Legal basis: performance of our agreement with you.
• Communicating with you — messages about your account or the service, such as confirming your email address or resetting your password. Legal basis: performance of our agreement with you.
• Keeping Waypost working and secure — maintaining security, preventing fraud, abuse and misuse, and troubleshooting and improving the technical operation of the service. Legal basis: our legitimate interest in a service that stays available and is not abused.
• Meeting legal requirements — complying with legal obligations and responding to lawful requests. Legal basis: compliance with a legal obligation.

4. Service providers

We use third-party providers to operate parts of Waypost. Depending on how you use the service, these may include:

• Supabase — database, authentication and related infrastructure.
• Vercel — website hosting and related infrastructure.
• OpenFreeMap — map tiles and map data.
• MapTiler — place search.
• ImprovMX — forwarding of email sent to our contact address.
• Pexels — photographs and related image services.
• Google — authentication when you choose to sign in with Google.
• GitHub — storage of encrypted database backups.

We may also use other service providers where reasonably necessary for hosting, security, communications, infrastructure or other functions required to operate Waypost.

These providers may process personal data on our behalf or process certain data under their own privacy terms, depending on the service involved.

5. International transfers

Some service providers may process personal data outside the European Economic Area.

Where applicable law requires safeguards for such transfers, we rely on an applicable legal mechanism, such as an adequacy decision or appropriate contractual safeguards.

6. Sharing your trips

Trips are not publicly available unless you use a feature that makes them available to other people.

When you share a trip, people with access to the relevant sharing mechanism may be able to view information contained in that trip. If you give someone editing access, they may also be able to modify the trip.

Please avoid adding information to a shared trip that you do not want to disclose to the people with access to it.

7. Cookies and browser storage

Waypost uses cookies and browser storage where necessary for functions such as authentication, maintaining sessions, saving local drafts and remembering certain preferences.

Where consent is required by applicable law for a particular technology, we will request that consent.

8. How long we keep personal data

We generally keep account and trip information for as long as it is needed to provide the service and manage your account.

When information is no longer needed, we may delete or anonymise it, subject to legal obligations and legitimate reasons to retain it, such as security, fraud prevention, dispute resolution, backups or establishing, exercising or defending legal claims.

Technical logs may be retained for periods appropriate to the operational and security purposes for which they are used.

9. Your rights

Depending on the circumstances and subject to applicable law, you may have rights to:

• obtain access to your personal data;
• have inaccurate data corrected;
• request deletion of personal data;
• request restriction of processing;
• object to certain processing;
• receive certain personal data in a portable format;
• withdraw consent where processing is based on consent.

You can exercise applicable rights by contacting contact@gowaypost.app.

We may need to verify your identity before processing a request.

We will handle requests within the time period required by applicable law.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or another competent supervisory authority.

10. Children

Waypost is intended for people aged 16 and over. We do not intentionally offer accounts to children under 16.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

The current version will be published on this page and the date at the top will be updated.

Where applicable law requires us to notify you of a change, we will provide the notice required by law.