Privacy statement

Etaply is offered by [naam of bedrijfsnaam] ([adres], Chamber of Commerce no. [KvK-nummer]). We are responsible for processing your personal data as described in this statement. Questions? Email [e-mailadres].

When you plan a trip without an account:

• A GPX file you upload is read in your own browser. The file itself never reaches our server.
• To find places to stay, supermarkets and restaurants, our server requests the places in the area around your route from the Overpass API, a public search service for OpenStreetMap data (without your name or IP address). We keep these places for up to 30 days, so routes through the same area load faster. This contains only places, nothing about you.
• If our server cannot reach the Overpass API, your browser requests the places directly. The Overpass API then sees your IP address and which area you request, just like when the map is loaded.
• Your preferences (such as km per day) stay in your browser and are not stored.
• If you click Share, we store the route, the name of the trip and your preferences under a random code, so the link works. Nothing about you is included. Anyone with the link can see the plan, so only share it with people you choose.

If you create an account to save trips, we store:

• your name and email address;
• your password, encrypted (we cannot read it ourselves);
• the trips you save: the route, your preferences, the number of km and days;
• if you plan together: the name you or your companions enter with a change, so everyone can see who changed something. Anyone with the link to plan together can view and change the trip; you can switch the link off at any time;
• if you switch on a reminder before departure: that you want it, in which language, and which emails have been sent. We then send two emails to your email address: 3 weeks and 2 days before your start date. You can switch it off at any time;
• each time you log in: the IP address and type of browser, to secure your account. This session expires after about a week.

We only use this data to let you log in and to keep your trips. We do not send newsletters and never sell or rent out your data.

• Your account and saved trips: to provide the service you ask for (performance of a contract).
• Security and keeping the site working properly, such as sessions and short technical logs: our legitimate interest in a safe and reliable website.

We do not use cookies to track you or for advertising. We only use necessary cookies: one that remembers that you are logged in (only if you log in), and one that remembers your choice of language. These do not require consent, which is why you do not see a cookie banner.

If we count visitors, we do so with Cloudflare Web Analytics. It works without cookies and without following you on other websites.

To improve Etaply we count how often something happens, for example how often a page is viewed, a route is chosen or someone clicks through to a booking site, and through which website or campaign visitors arrive. We only keep the total per day. There is no cookie, we do not store IP addresses or browser data, and nothing can be traced back to you. If "Do Not Track" or "Global Privacy Control" is switched on in your browser, you are not counted.

We use a few other parties to make Etaply work:

• Cloudflare hosts the website and keeps the database with accounts and trips. Cloudflare processes the data on our behalf and may also do so outside the European Union. Cloudflare takes part in the EU-US Data Privacy Framework, which keeps the data protected according to European rules.
• OpenStreetMap: your browser loads the map directly from the OpenStreetMap Foundation, which therefore sees your IP address and which part of the map you view. See the OpenStreetMap privacy policy.
• Resend sends the reminders before departure, if you switch them on. For that, Resend receives your email address and the text of the email, and processes them on our behalf (also in the United States, under the EU-US Data Privacy Framework).
• Overpass API (overpass-api.de and two other public servers): receives which area is requested. Usually via our server, without your IP address; sometimes directly from your browser (see above).

If you click a link to another website, such as Booking.com, Google Maps or a railway company, that website's privacy policy applies from then on.

• Your account and trips: until you delete them.
• Shared plans: as long as the link may be needed. To have one removed, email us the link.
• Login sessions: about a week.
• Technical server logs: a few days.
• Places from OpenStreetMap: 30 days (without any data about you).

You may ask us which data we hold about you, and have it corrected, deleted or handed over to you.

• You can delete trips yourself in My trips.
• You can also delete your whole account with all trips there, at the bottom of the page. This is immediate and permanent.
• For other questions or requests: email [e-mailadres]. We respond within a month.

If you are not happy with how we handle your data, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your own country.

The connection to Etaply is always encrypted (https). Passwords are only stored encrypted. Only we have access to the database.

Etaply is intended for people aged 16 and over. If you are younger, ask your parents whether you may create an account.

If Etaply changes, we update this statement. The date at the top shows when that last happened. We announce major changes on the website.

[naam of bedrijfsnaam]
[adres]
Chamber of Commerce no.: [KvK-nummer]
Email: [e-mailadres]