Wheee! privacy policy

The controller is Tobias Wetzel, Löhrgasse 8, 1150 Wien, Austria, trading as SteadyGo. Privacy requests can be sent to contact@steadygo.app.

• Account and profile data, such as email address, authentication identifier, display name, profile picture, sign-in provider, and security information.
• Trip content, including destinations, dates, travellers, budgets, itineraries, saved places, routes, preferences, assistant messages, group proposals, polls, memberships, and invitations.
• Booking-handoff and status data when you open a supported Nuitee hotel offer, including the selected offer, account and optional trip link, provider booking identifiers, confirmation number, status, amount, currency, and check-in instructions. Wheee! does not receive or store your full payment-card details.
• Location data when you grant device permission. It is used to show your position and nearby context. A location becomes server-side trip content only when you choose to use it in a saved plan or assistant request.
• Subscription and entitlement information, such as product, purchase status, store, renewal or expiry state, and the pseudonymous identifiers needed to connect a store purchase to a Wheee! account. Wheee! does not receive full card details.
• Support messages, feedback, AI-response reports, and the information you include when asking for help.
• Technical, security, crash, performance, device, app-version, and network information needed to operate and protect the service.
• Optional product analytics and interaction telemetry only after the relevant consent is given. This choice can be changed in Settings.

Data is used to create and secure accounts, generate and save trips, provide collaboration and notifications, answer support requests, manage entitlements, prevent abuse, diagnose errors, and improve the service. Processing is based on performing the service requested by you, legitimate interests in secure and reliable operation, consent for optional analytics and AI processing where requested, and legal obligations where applicable.

When you use the trip assistant, the prompt, relevant trip context, tool results, and necessary account context are sent to the configured AI service to produce the response. Do not include passport numbers, payment-card details, health information, or other sensitive personal information in prompts. Travel-search and route features may send the destination, dates, occupancy, route points, currency, and other necessary request fields to the selected travel, routing, place, map, or weather provider. Partner credentials remain server-side.

For supported Nuitee hotel offers, Wheee! creates a private reference before opening Nuitee's hosted checkout. Nuitee may send booking lifecycle updates back to Wheee!, which stores normalized status and confirmation fields for the signed-in account. Raw webhook payloads are not retained. When you choose to manage a confirmed booking, Wheee! sends your current account email to Nuitee as part of the management link Nuitee requires; the email-bearing link is not stored by Wheee!. Nuitee handles checkout and payment under its own terms and privacy notice.

Depending on the feature and production configuration, recipients can include Supabase for authentication and EU-hosted application data; Cloudflare for website delivery, DNS, security, and network data; TensorX and its configured model provider for text-based AI; RevenueCat, Apple, and Google for mobile subscriptions; Sentry for essential error monitoring; PostHog and Microsoft Clarity for consent-based analytics; Resend for transactional email; Nuitee for live hotel or flight search and supported hotel-booking updates; and the map, place, routing, weather, activity, flight, or accommodation provider selected for a request. Provider privacy terms also apply when you open an external provider link.

For venue searches and stop details, Wheee! may send the place name, approximate coordinates, language, or a short public travel query to Brave Search. Map searches use LocationIQ, which searches OpenStreetMap data. These requests do not include your name, email, account details, or private booking references. See the Brave Search API Privacy Notice and the LocationIQ Privacy Policy. To select a useful place photo, Wheee! sends public photo candidates and the place name, address and coordinates to TensorX in the European Union for image analysis. No account details or private trip conversation are included. These photos are processed temporarily and are not generated or stored by Wheee!.

A trip is private unless you create an invitation or share it. People who receive a valid link can receive the view or edit access chosen by the trip owner. Group-chat proposals and poll answers are visible to the trip group as indicated in the app. Private traveller preferences and private assistant context are not made group-visible merely because a trip is shared.

Account and trip data is retained while the account or relevant shared trip remains active. Operational logs, support records, usage records, and security events are kept only for the period reasonably needed for their stated purpose. You can delete the account in the app or follow the account-deletion instructions. Limited billing, fraud, dispute, legal, and backup records may remain for their applicable retention periods.

Usage records showing on which days you used Wheee are deleted after 13 months.

Some providers may process data outside Austria or the European Economic Area. Where required, transfers are protected through an adequacy decision, Standard Contractual Clauses, or another valid transfer mechanism. Core account and application data is configured for EU hosting where supported.

Subject to the conditions of applicable law, you may request access, rectification, erasure, restriction, portability, or object to processing, and may withdraw consent without affecting earlier lawful processing. You may also complain to the Austrian Data Protection Authority. Contact contact@steadygo.app to exercise a right.

Wheee! uses transport encryption, access controls, row-level database security, managed secrets, and monitoring intended to protect the service. No online service can guarantee absolute security. Wheee! is a general-audience travel-planning product and is not directed to children. A person who cannot lawfully consent to data processing in their country should use it only with the involvement of a parent or guardian.

Material changes will be reflected on this page and, where required, communicated in the app. The date at the top shows the latest update.