Privacy Policy

We collect information you provide directly: your name, email address, public username (@handle), profile photo, travel preferences, and the year of birth you enter at sign-up to verify the minimum age of 14. We also collect the content you create (trip plans, saved destinations, photos, comments, messages, crowd reports, conversations with the AI assistant) and usage data (app interaction patterns) to operate and improve your experience.

Your data is used to personalize your travel experience, provide crowd-level insights, generate recommendations, power the AI travel assistant, keep the service secure, and improve our services. We do not sell your personal information to third parties. Marketing communications are only sent with your explicit opt-in consent and you can withdraw at any time via notification preferences in Settings.

We process your data under the following legal bases as defined by the General Data Protection Regulation: • Account data (name, email, username, profile) and the content you create: Contract performance — processing is necessary to provide you with our services (Art. 6(1)(b)). • AI travel assistant: Contract performance for delivering the assistant (Art. 6(1)(b)); legitimate interest for evaluating and improving it (Art. 6(1)(f)). • Location data: Consent — we only process your location when you explicitly grant permission (Art. 6(1)(a)). You may withdraw consent at any time via Settings or your device settings. • Analytics and usage data: Legitimate interest — we analyse usage patterns to improve app performance and user experience, and we produce anonymous aggregate statistics (Art. 6(1)(f)). • Security and abuse prevention (email verification, device attestation, anti-spam rate limits, content moderation): Legitimate interest (Art. 6(1)(f)). • Marketing and push notifications: Consent — we send promotional communications only with your opt-in consent (Art. 6(1)(a)). You may withdraw consent at any time via notification preferences in Settings. • "How you travel" profile: contract performance for the items you set yourself (Art. 6(1)(b)); legitimate interest for the preferences learned from your conversations (Art. 6(1)(f)). Sensitive data you choose to add (food requirements, accessibility needs): explicit consent (Art. 9(2)(a)), which you can withdraw at any time; the data is then deleted immediately. • Trip memory ("The assistant remembers"): legitimate interest (Art. 6(1)(f)); you can object as described in "Trip Memory".

Every account has a unique public username (@handle). Your public profile data — display name, profile photo and username — is visible to other users on your profile and next to the content you publish. You can change your username from Settings, subject to anti-abuse limits; the previous username then becomes available to other users. Your username is included in your data export and is deleted when you delete your account. Legal basis: contract performance.

Each photo or video you add to a trip has a visibility you choose: "Everyone", "Followers" or "Only me". You can change it at any time: the change applies immediately, but screenshots or copies already made by others cannot be recovered. • Trip companions: in the trip album they see your "Everyone" and "Followers" photos. Your "Only me" photos are seen only by you. • People outside the trip: they can see one of your photos only if they can also see the trip, and never beyond what your choice and your account allow. In practice: – "Everyone": anyone on Wandermi can see it if the trip is public; if the trip is visible to followers only, at most the followers of the person who created the trip; – "Followers": your followers can see it if the trip is public, or if it is your trip and it is visible to followers; otherwise only your companions; – photos in a private, draft or deleted trip are not visible to anyone outside the trip; – if your account is private, your photos never go beyond your companions and your followers. • Where they appear: photos visible outside the trip may appear on your profile and in the Home feed of people who can see them, with your name. On place pages, in the "From people who've been" section, we only show "Everyone" photos (not videos) from public trips of accounts that are not private; if there are no photos of the exact place, we may show photos taken within about 1.5 km, labelled "Taken nearby". For Home and your profile we use a copy of the photo that follows it: it changes when you change the visibility and is deleted when you delete the photo. • Blocking: people you have blocked, or who have blocked you, do not see your photos on your profile, in Home, on place pages or when opening a single photo. • Location: with each photo we store only an approximate location (about 1 km) and the place name, taken from the photo data or chosen by you. Current versions of the app never save the exact position; if an older version sends it, our server immediately rounds it to about 1 km. Photo files do not contain GPS coordinates. People who can see one of your photos (companions, followers or everyone, according to your choices) may also receive the place name, the approximate location (about 1 km) and a reference to the place; people who cannot see it receive none of this. Place pages never show coordinates. • People in your photos: if you publish photos showing other people, make sure you are allowed to. Legal basis: performance of the contract (Art. 6(1)(b)). Retention: as for trip data (see "Data Retention Periods").

From a place's page you can upload your own photo of that place, if you are at least 16 and your account is at least 7 days old. Place photos are public: everyone using Wandermi, and anyone who opens the place's page (also via a link), can see them, with your username as the author; users you have blocked can see them too. The "Conditions for photos of places", which you accept at your first upload, apply. The feature is being switched on gradually: while it is off, place photos are not shown. • What we collect: – the photo. Before sending, the app removes all metadata from the file, including the GPS location; our server then re-encodes the photo, removing any remaining metadata, and creates the smaller sizes. We store three sizes, the largest at most 1600 pixels on the long side; – your username and the place the photo is linked to; – only if you choose "Taken on site" (off by default): the indication "taken within about 300 m of the place" and the month and year the photo was taken (never the day or time). The app reads the location and date from the photo on your phone and sends only whether the photo is near the place and the month/year; the photo's location is never sent. The month and year are shown publicly only 30 days after publication; the upload date is never shown. We use them only for the label: if you remove it, we delete them and they cannot be added again. If you do not choose the label we receive neither proximity nor date; – the result of the automated check and, if the photo is not published, the reason; – a record of your acceptance: user identifier, digital fingerprint of the file (not the photo), date and time, version and language of the Conditions with a fingerprint of the accepted text, the sign-in method of your account (for example email, Google or Apple). After your first published photo we send you a confirmation email with a link to the accepted version; – to check your age we use your year of birth (see "Year of Birth, Minimum Age and Minors"). • If you report a photo: your user identifier and your account email, the reason, the optional text you write and your good-faith declaration. We do not tell the author who reported, unless required by law or by an order of an authority. • Purposes and legal bases: – publishing the photo on the place's page with your username, and showing the "Taken on site" label and the month when you choose them: performance of the contract (Art. 6(1)(b) GDPR). The location and date in the photo are read on your phone and only as strictly necessary to provide the label or date you ask for (Art. 5(3) ePrivacy Directive; Art. 122 Italian Privacy Code); – handling reports, suspensions and removals, and informing author and reporter: legal obligation (Art. 6(1)(c) GDPR; Articles 16 and 17 of Regulation (EU) 2022/2065, the "Digital Services Act"); – the automated check and upload limits to prevent abuse, and keeping the acceptance record after removal: our legitimate interest in protecting other users and in being able to prove the licence in case of a dispute (Art. 6(1)(f) GDPR). You can object by writing to privacy@wandermi.com. • Automated check: before publication an artificial intelligence system checks the photo, as already re-encoded by our server, to make sure it shows the place and contains no recognisable people (in places of worship and health facilities, not even by their figure), licence plates, readable personal data (documents, screens, names on signs, doorbells, letterboxes) or inappropriate content. When in doubt, the photo is not published. – The model runs on Google Cloud Vertex AI in the European Union (region europe-west1). Google acts as our processor (Art. 28 GDPR) and does not use the photos to train its models. – If the photo does not pass, it is not published: we tell you the reason and that the check is automated. You can ask a person on our team to review it by writing to legal@wandermi.com. – If the check cannot be completed, the photo stays pending and is not published; after 7 days it is discarded. – The check only concerns publishing that photo and does not produce legal effects concerning you (it is not a decision under Art. 22 GDPR). • Reports and moderation: normally a report from the app suspends the photo immediately; we do not suspend it automatically if the same person had already reported it, if the photo had already been checked and restored (except for "I am in this photo", copyright and site-custodian reports), or if the reporter's account is less than 7 days old. In every case a person on our team decides, normally within 48 hours. The author receives in the app and, if the address is verified, by email the reasons for every suspension or removal; the reporter receives an acknowledgement and the outcome. For emails we use Microsoft Ireland Operations Ltd (Microsoft 365), acting as our processor. • People in photos: if you appear in a published photo, use "Report this photo" → "I am in this photo" (normally the photo is hidden right away). If you do not have an account, write to privacy@wandermi.com (personal data, "I am in this photo") or to legal@wandermi.com (copyright) with the link to the photo, the reason, your name and your email: a person on our team will examine the request, normally within 48 hours. • Retention: – published photos: until you remove them from "My place photos" (they stop being shown within a day) or delete your account; – photos not published by the check: files deleted immediately, the rest within 24 hours; – suspended photos: until the decision; if removed, files deleted immediately; – reports and decisions: 12 months from the decision; – service emails (notices and acknowledgements): 30 days from sending; – acceptance record: while the photo is published and for up to 10 years after removal, only to prove the licence; – if you delete your account we delete your place photos and the reports you made; only the acceptance record remains. • Recipients: Google Cloud (Firebase and Vertex AI, in the EU) and Microsoft (emails), as processors; the public, for published photos. We do not use your photos in advertising or paid products without your separate consent. • Your rights: access, rectification, erasure (including removing the photo with one tap), objection, restriction and portability. Place photos and the acceptance record are included in "Export my data". See "Your Rights".

• Year of birth: we ask for your year of birth when you sign up (or, if you signed up with Google or Apple without giving it, the next time you open the app). We use it only to apply the age rules set by law: at least 14 to use Wandermi, at least 16 to upload place photos, and the protections for 14- and 15-year-olds described below. When the year alone is not enough (the year you turn 14 or 16), we ask one more question (for example your birth month) and keep only the outcome, not your answer. Your year of birth is not visible to other users. – Legal basis: legal obligation (Art. 6(1)(c) GDPR, to respect the minimum age set by Art. 8 GDPR and Art. 2-quinquies of the Italian Privacy Code) and performance of the contract (Art. 6(1)(b) GDPR), because the age rules are part of the Terms of Service. – Retention: for the lifetime of your account; it is deleted when you delete your account. – It cannot be changed: once saved, your year of birth cannot be changed from the app, so that the age rules cannot be bypassed. If you made a mistake, write to privacy@wandermi.com and we will correct it (right to rectification, Art. 16 GDPR); we may ask you for some information to verify the request. • If you are under 14: Wandermi is not available to you. – If you say so when signing up, the account is not created and the data entered is deleted. – If it turns out that an existing account belongs to someone under 14, the account is suspended: all its public and followers-only content is hidden, and the AI assistant and push notifications are not available. We say so in the app and by email. If this is a mistake, write to privacy@wandermi.com within the 30 days: contesting stops the deletion, a person on our team reviews the case and, if the mistake is confirmed, restores the account and makes its content visible again. Without a contest, the account and its data are deleted automatically after 30 days, through the same procedure as "Delete account". – To prevent an immediate new sign-up, we keep for 90 days only a keyed fingerprint (HMAC, which cannot be reversed) of the Google/Apple account identifier or of the verified email address, and then delete it; if the age error is confirmed, we delete it immediately. Legal basis: our legitimate interest in enforcing the minimum age set by law (Art. 6(1)(f) GDPR). • If you are 14 or 15: – your profile and your trips are not public by default (you can still share them with your followers); if you wish, you can make them public yourself with one tap. If you already have an account, only the profile and trips that were public become non-public: those shared with followers stay as you chose. We tell you in the app, and you can make them public again with one tap; – you cannot upload place photos (you must be 16); – the limited licence described in the Terms of Service applies to your content: we show it only within the Service, to the audience you choose, and we do not use it for promotion outside the Service. • Featured sections: based on the year of birth you gave us, if you may be under 18, your content is not selected for the featured sections (featured trips, Discover, community photos on place and country pages). Photos uploaded with "I have a photo of this place" (from 16) are not covered by this exclusion: they follow the "Conditions for photos of places". If you are a minor, we encourage you to read this Policy together with a parent or guardian.

Wandermi includes a travel assistant based on generative AI (model provider: Google). • Data sent to the model: the text of your messages, the context of the trip you are planning (destinations, dates, interests) and a travel-preferences profile built from your previous conversations. We do not send your email address or your exact GPS position. • Where the model runs: the assistant runs on Google Cloud Vertex AI in the European Union (region europe-west1). Google acts as our processor under Art. 28 GDPR on the basis of the Google Cloud Data Processing Addendum, and does not use your prompts or the model outputs to train its own models. Your conversations are processed within the EU. • Memory: we store (i) your conversation history, (ii) a persistent traveller profile built from your conversations across trips, and (iii) a memory for each trip (see "Trip Memory" below), so that the assistant keeps context between sessions. You can archive or rename sessions in the app. • Retention and deletion: conversations and the traveller profile are retained while your account is active and are deleted when you delete your account; the trip memory follows its own retention rules (see "Trip Memory"). All of them are included in your data export. Separately, pseudonymised copies (without direct identifiers) are kept to evaluate and improve the assistant: conversation text for a maximum of 12 months, technical metrics for a maximum of 24 months — see "Analytics Warehouse" for what happens to those copies when you delete your account. • Accuracy: answers are generated automatically and may contain errors or out-of-date information. You can report any answer by long-pressing the message in the chat. • Legal basis: contract performance (delivering the assistant) and legitimate interest (evaluating and improving it). You can object to the improvement processing by writing to privacy@wandermi.com.

The AI assistant keeps a travel-preferences profile, which you can see and manage in the app under "How you travel" (from the conversations panel or from Profile → Preferences). • What it contains: who you usually travel with, travel style, interests, pace, budget, how you feel about crowds, places you love or prefer to avoid, accommodation and transport preferences. For each item the app shows where it comes from: the initial questions, set by you, or learned from your conversations (with the date). • How it is built: the assistant saves only lasting travel preferences that clearly emerge from your conversations and tells you in the chat each time ("I'll remember that…"), with an "Undo" button. What you set yourself always takes precedence and is never overwritten by the assistant; an item you remove does not come back. • Your control: you can change or remove each item at any time. If you switch off "Learn from chats", the assistant adds nothing new; what is already in the profile stays and continues to be used to tailor suggestions until you change or erase it. To object fully, also remove the learned items or use "Erase everything", which deletes the whole profile. Switching off "Learn from chats" also pauses the trip memory: no new items and no use of the saved ones (see "Trip Memory"). These choices take effect immediately. You can also write to privacy@wandermi.com. • Sensitive data (Art. 9 GDPR): food requirements (for example allergies, intolerances or diets, which may reveal information about your health or religious beliefs) and accessibility needs are saved only if you enter them yourself in "How you travel" and give your explicit consent with the dedicated checkbox. We keep a record of your consent (date and version). The assistant is instructed not to infer this information from your conversations and cannot save it to your profile. We use it only to tailor travel suggestions: it is sent to the AI model (Vertex AI, EU) only as part of your requests and is not copied to the analytics warehouse. Google acts as our processor and does not use this data to train its models. You can withdraw your consent at any time with "Withdraw consent and delete my needs": the data is deleted immediately. Withdrawal does not affect the lawfulness of the processing carried out before it. • Health or religious information written in the chat: if you mention it in a message, it remains part of that conversation and of the pseudonymised copies we keep for analytics for up to 12 months, but it is not saved in your profile. Please avoid sharing this kind of information in the chat and use "How you travel" instead. • No automated decisions: the profile is used only to suggest places and itineraries, never for decisions with legal or similarly significant effects on you. • Retention: the profile is kept while your account is active, until you erase it, and is deleted when you delete your account. It is included in "Export my data". • Legal basis: contract performance for the items you set yourself or answer in the initial questions (Art. 6(1)(b)); legitimate interest for the preferences learned from your conversations (Art. 6(1)(f)), to which you can object as described above; explicit consent for sensitive data (Art. 9(2)(a)).

In the Travel Companion, the AI assistant can remember short facts you tell it about a specific trip, so that you do not have to repeat them in every conversation. You can see them in the Travel Companion menu under "The assistant remembers" and in "How you travel" → "Trip memories". • What it contains: only short facts you state explicitly about that trip — a decision about the plan (for example "no museums on day 2"), a practical constraint ("dinner by 8 pm", "no car"), a preference for this trip ("quieter beaches") or a suggestion you turned down ("don't suggest the Old Town again"). Each item is at most 120 characters, with a maximum of 30 items per person per trip. • How it is built: at the end of each reply, a lightweight AI model identifies these facts in your message and our code filters them before saving. The model is instructed not to save questions or hypotheses. The assistant usually tells you in the chat ("I'll remember this for your trip…"), with an "Undo" button, and you can always see everything in "The assistant remembers". The model runs on Google Cloud Vertex AI in the EU (region europe-west1); Google acts as our processor under Art. 28 GDPR and does not use this data to train its models. • What we don't save: information about your health; food requirements or diets; accessibility needs (these stay only in "How you travel", with your explicit consent); religious beliefs; information about other people; documents; identification, contact or card numbers; email or postal addresses. The model is instructed not to propose these items, and our code also discards items containing common terms for these categories; if anything slips through, you can remove it at once with ✕. • Who can see it: only you, and only while you are a member of the trip. Other members of the trip, including its organiser, cannot see your items. Items are written only by our servers; the app can only read them. In this version the memory is never shared with other members; if we introduce shared items, we will update this Policy and inform you in the app first. • Why and legal basis: to give the assistant continuity throughout your trip. Legal basis: legitimate interest (Art. 6(1)(f)). The memory is limited to facts you have stated about that trip, and you can see and remove it at any time. • How to object: switch off "Learn from chats" in "How you travel": the assistant then adds nothing new, either to your profile or to the trip memory. Items already saved stay visible in "The assistant remembers" but are not used while learning is off; you can remove them with ✕ or "Erase everything". These choices take effect immediately. You can also write to privacy@wandermi.com. • Retention: items are deleted automatically 90 days after the end of the trip (if the trip has no dates, counted from when the first item was saved), and earlier when you leave the trip or are removed from it, when the trip is permanently deleted (after the 30-day recovery period) or when you delete your account. When you remove an item with ✕ or "Undo", we keep only a fingerprint of it (a one-way hash, not the text) so that the assistant does not save it again; fingerprints are deleted when you leave the trip, when the trip is permanently deleted, when you delete your account and in any case 90 days after the end of the trip. • Your rights: the items are included in "Export my data". You can access, delete and object as described above and in "Your Rights". The items are kept only with the trip in our database and are not copied to the analytics warehouse; the messages they come from are part of your conversations (see "AI Travel Assistant"). • No automated decisions: the memory is used only to tailor the assistant's suggestions for that trip.

With your permission, we use your location for the following purposes: • Crowd reports: the report other users see stores approximate coordinates only (rounded to ~1 km precision). The exact coordinates of the point you reported are stored separately, in a restricted-access collection that client applications cannot read: they are never shown to other users and are never shared with third parties. They are included in your data export and are deleted when you delete your account. • Dwell detection: we derive aggregated time-spent-at-a-place values. We do not record your continuous GPS trail and we do not track your movements. • Statistics shared with public bodies are anonymous and aggregated only. You can disable location sharing at any time from Settings → Location or from your device settings; the app remains usable. Legal basis: consent (Art. 6(1)(a)), which you may withdraw at any time; legitimate interest for the production of aggregate statistics.

You can generate a public link to share an itinerary. Anyone holding the link can view the shared content (itinerary, stops, any photos included), including people without a Wandermi account and outside the app, for as long as the link is active. Consider carefully what you share and with whom. You can deactivate the link at any time from the sharing settings: deactivation makes the content immediately inaccessible through the link, but has no effect on copies already saved by third parties. Active links are included in your data export and are deleted when you delete your account. Legal basis: contract performance (a feature you request).

• Push notifications: with your permission we send you notifications (messages, invitations, crowding alerts, social activity). We store a notification token associated with your device, transmitted to our provider Expo (United States, under EU Standard Contractual Clauses); the token is removed when you log out. You can manage each category from Settings → Notifications or disable notifications from your operating system. • Notification language: we store your app language so that notifications reach you in the language you use. • Email verification: when you register with an email address we send you a verification message; verification is required in order to use the account, for security and abuse-prevention purposes. Legal basis: legitimate interest (Art. 6(1)(f)).

To protect the service against automated abuse (bots, scripts, fake accounts), the app uses device attestation mechanisms provided by Apple (App Attest / DeviceCheck) and Google (Play Integrity) through Firebase App Check. These services verify that requests come from a genuine copy of the app running on an authentic device, generating technical tokens that are not used to profile you and are not used for advertising. Legal basis: legitimate interest in the security of the service (Art. 6(1)(f)).

We share data only with trusted service providers who help us operate Wandermi. All partners are bound by strict data protection agreements. We do not sell your personal data.

We use the following sub-processors to deliver our services: • Google Firebase (Cloud Firestore, Authentication, Cloud Storage, App Check) — United States. Data transfers are governed by EU Standard Contractual Clauses (SCCs). • Google Cloud Platform (Cloud Functions, region europe-west1) — European Union. • Google Cloud Vertex AI (region europe-west1) — European Union. Provides the generative model that powers the AI travel assistant. Google acts as a processor under the Google Cloud Data Processing Addendum and does not use your prompts or the model outputs to train its own models. Processing takes place within the EU. • Google Cloud BigQuery (region europe-west1) — European Union. Used as an analytics data warehouse to understand and improve the app, evaluate and improve the AI travel assistant, and produce anonymous aggregated statistics. Covered by Google's Data Processing Addendum and EU Standard Contractual Clauses. Data is processed within the EU. • Expo (EAS) — United States. Used for push notification delivery. Data transfers are governed by EU Standard Contractual Clauses (SCCs). • Mapbox — United States. Used for map display and geolocation services. Telemetry data collection is optional and can be disabled in Privacy Settings. Data transfers are governed by EU Standard Contractual Clauses (SCCs). • RevenueCat — United States. Subscription management infrastructure. Paid subscriptions are not active in Wandermi (see "Paid Features"): the SDK is present in the app but no transaction or billing data is currently processed. Were paid features to be activated, RevenueCat would receive only an anonymous user identifier and Apple/Google transaction metadata — no email or other personal data. Data transfers are governed by EU Standard Contractual Clauses (SCCs). • Sentry — Germany (EU data residency). Used for error monitoring and crash reporting. Captures stack traces, app version, OS version, and an anonymised device identifier; no email or other personal data is captured unless explicitly attached. • Microsoft 365 (Outlook — hosted by Microsoft Ireland Operations Limited) — European Union. Used to host institutional mailboxes (support@, privacy@, legal@) and process inbound communications you send to us. The standard Microsoft Online Services DPA applies. • Microsoft 365 (Exchange Online, via Microsoft Graph — Microsoft Ireland Operations Ltd). Also acts as our processor for sending service emails: notices to our moderation team about reports, moderation outcomes, confirmations and notices about your account (for example the suspension of an account belonging to someone under 14). Service emails are deleted automatically 30 days after sending.

We retain your data for the following periods: • Account data (name, email, username, profile photo, travel preferences): retained while your account is active. Deleted when you delete your account. • Messages: retained for a maximum of 12 months; messages older than 365 days are deleted automatically. Messages you sent are also deleted when you delete your account. • Trip data (trip plans, saved destinations, photos): retained while your account is active. When you delete a trip it enters a 30-day recovery period during which it can be restored; after 30 days the trip and all associated data are permanently deleted. All trip data is also deleted when you delete your account. • AI assistant conversations and traveller profile: retained while your account is active. Deleted when you delete your account. • Location data: the approximate coordinates (~1 km) stored with the crowd reports you submit, and the exact coordinates held separately with restricted access, are retained until you delete your account. • Push notification token: removed when you log out. • Pseudonymised copies in the analytics warehouse: AI conversation text for a maximum of 12 months; AI technical metrics for a maximum of 24 months; other analytics events for a maximum of 26 months. See "Analytics Warehouse" below. • "How you travel" profile: you can erase it at any time with "Erase everything"; sensitive data is deleted as soon as you withdraw your consent. • Trip memory ("The assistant remembers"): deleted automatically 90 days after the end of the trip, or earlier — see "Trip Memory". • Year of birth: for the lifetime of your account. • Fingerprint of the sign-in identifier of someone under 14: 90 days. • Service emails sent through Microsoft 365: 30 days from sending. • Place photos, reports and acceptance records: see "Place Photos". • Backups: data deleted from our systems may remain in the database backups for up to 8 weeks (daily copies are kept for 7 days, weekly copies for 8 weeks); after that the backups are deleted automatically.

We use an analytics data warehouse (Google Cloud BigQuery, EU region europe-west1) for three purposes: (a) to understand how the app is used and improve it; (b) to evaluate and improve our AI travel assistant; and (c) to produce anonymous, aggregated statistics about tourist flows and overcrowding. • Pseudonymisation and residency: records sent to the warehouse do not carry your name, your email or your raw account identifier — the identifier is replaced by a pseudonym (a keyed hash). All processing takes place within the EU under Google's DPA and EU Standard Contractual Clauses. • AI improvement: conversations with the AI assistant may be used in pseudonymised form to evaluate and improve the assistant. Legal basis: legitimate interest. You can object by writing to privacy@wandermi.com. • Aggregate statistics (B2G): statistics shared with public bodies or destination management organisations are anonymous only — they contain no information that can identify you, and minimum aggregation thresholds are applied so that no individual can be singled out. We never sell your personal data. • Deletion — what actually happens when you delete your account: we delete your data from our operational systems (database and file storage) — profile, username, trips, photos, messages, AI conversations and memories, share links, and the exact coordinates of your crowd reports. The pseudonymised copies already transferred to the analytics warehouse are NOT individually removed at that moment: they no longer carry your account identifier and are retained until the end of their retention period (AI conversation text up to 12 months; AI technical metrics up to 24 months; other analytics events up to 26 months), after which they are deleted. Anonymous aggregates already produced are not personal data and are retained. If you want us to remove the pseudonymised records relating to you before that, write to privacy@wandermi.com before deleting your account, so that we are able to identify them.

To estimate how busy places usually are, we use our own estimation model. It combines: the typical daily pattern of each category of place; seasonal trends and popularity derived from the public, aggregate view counts of the related Wikipedia articles (Wikimedia and Wikidata, data released under CC0); national public holiday calendars; and, where available, the crowd reports and time-spent values sent by Wandermi users, in aggregate form, as described in this Policy. These third-party sources are aggregate and anonymous: they contain no personal information about you or any other identifiable person. We do not use Google Maps "popular times" data: we have stopped using the data of this kind collected in the past and have deleted it from the systems that run the service. Estimates describe a typical day ("usually"), not real-time conditions.

Wandermi includes an in-app messaging feature that allows you to communicate with other travellers and to share trip plans, photos, polls and locations. • Encryption: all messages are encrypted in transit (TLS 1.2+) and at rest (AES-256). End-to-end encryption is not currently implemented; this allows the server-side moderation and content reporting required by the EU Digital Services Act (Regulation (EU) 2022/2065). • Content stored: message text, attached media (photos), polls, locations, reactions, reply context, and edit/pin metadata. Read receipts are stored to power conversation unread counts. • Moderation: we apply automated rate limits (maximum 40 messages per minute and 300 per hour per sender) and we process user reports. Reported content is reviewed and may be removed; abusive accounts may be suspended. • Reporting illegal content: you can report any message via the long-press menu → Report. Reports are reviewed by our moderator, normally within 48 hours. • Editing and deletion: you may edit your messages within 15 minutes of sending and delete them at any time. Deleting your account deletes the messages you have sent. • Push notifications: message previews may appear in push notifications. You can disable previews via Settings → Notifications. • Minors: per GDPR Article 8 and the Italian implementation, the minimum age to use messaging is 14 years.

Under the General Data Protection Regulation, you have the following rights regarding your personal data: • Right of access and to data portability (Art. 15 and 20): use "Export my data" in Settings to download a complete JSON file of your data, including your conversations with the AI assistant. • Right to rectification (Art. 16): correct your personal data at any time via Edit Profile. • Right to erasure (Art. 17): use "Delete account" in Settings. This removes from our operational systems your account, content, messages, AI conversations and memories, username, share links and the exact coordinates of your crowd reports. For the pseudonymised copies in the analytics warehouse, see "Analytics Warehouse" above. • Right to object and to withdraw consent (Art. 21): you can disable location from Settings → Location and notifications from Settings → Notifications at any time. To object to the processing of pseudonymised data for analytics and for AI improvement, write to privacy@wandermi.com. To object to the trip memory, switch off "Learn from chats" or remove the items in "The assistant remembers" (see "Trip Memory"). • Right to lodge a complaint: you may lodge a complaint with the Italian supervisory authority (Garante per la protezione dei dati personali) or with the supervisory authority of your country of residence. • Changes to this Policy: if we make significant changes, we will inform you in the app before they take effect. We will ask you to accept again when the change concerns the Terms or when the law requires it (for example, a new processing based on your consent); if you do not accept, access to the service is suspended. • Right to object to profiling (Art. 21): in "How you travel" you can switch off "Learn from chats" and remove the learned items or erase the whole profile. To exercise any of these rights, contact us at privacy@wandermi.com or use the corresponding feature in the app.

Some of your personal data may be transferred to and processed in the United States, where some of our service providers are located (Firebase, Expo, Mapbox, RevenueCat). These transfers are safeguarded by EU Standard Contractual Clauses (SCCs) approved by the European Commission. The processing carried out by the AI assistant and by the analytics warehouse takes place within the European Union (region europe-west1).

Data controller: WANDERMI S.R.L., registered office Viale Umbria 128, 20135 Milano (MI), Italy · VAT no. and tax code (P.IVA e C.F.) 14880440962 · REA MI-2813220 (Milano Monza Brianza Lodi Companies Register no. 14880440962) · share capital €5,000.00 fully paid · certified email (PEC) wandermi@namirialpec.it · innovative startup registered in the special section of the Companies Register. We are not required to designate a Data Protection Officer under Article 37 GDPR: we are not a public authority, our core activities do not involve large-scale processing of special categories of data, and we do not carry out regular and systematic monitoring of data subjects on a large scale. We keep this assessment under review and will appoint a Data Protection Officer if the conditions change. For any question about how we handle your personal data, or to exercise your rights under the GDPR, write to privacy@wandermi.com. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the supervisory authority of your country of residence.

Wandermi is currently free: there are no active subscriptions or in-app purchases, and we do not process any payment data. Features shown in the app as "coming soon" (for example a premium subscription or printed photo albums) are not active. Our subscription management infrastructure (RevenueCat) is present in the app but processes no transactions while paid features are inactive. If paid features are activated, we will inform you in advance and update this Policy. In any case, payments would be processed exclusively by Apple (App Store) on iOS and Google (Play Store) on Android: we would never collect or store your payment card details or your billing address.

Wandermi plans to offer optional printed photo albums in a future release. When this feature becomes available: • Sharing: only the data strictly necessary to fulfil your order will be shared with our printing partner Peecho (based in the Netherlands, EU): your shipping name, shipping address, the photos you explicitly select for the album, and the order details. • No other data shared: we will not share your account email, travel plans, or any other personal information with Peecho. • Explicit opt-in per order: this feature requires explicit consent each time you place an order. No data is shared without an active order. • Current status: as of the current release this feature is not active. No data has been or is being shared with Peecho. We will update this Policy and notify users in-app before the feature becomes operational.

We implement industry-standard security measures including encryption in transit (TLS 1.2+) and at rest (AES-256) to protect your personal information from unauthorised access. The app sends a device attestation (Firebase App Check) with its requests to our backend, which we use to recognise traffic that does not come from a genuine copy of the app; we are gradually enabling the rejection of requests without a valid attestation. The exact coordinates of crowd reports are held in a restricted-access collection that client applications cannot read. Access to production systems is restricted to authorised personnel and protected by multi-factor authentication.