Privacy in plain English.

Who we are

Ampersand (the company details are on the imprint) runs Ampersand and decides what happens to your data (the “controller”, in GDPR terms). Write to privacy@example.com about anything in this policy.

What we keep

• Your account: your name, username, email address, a securely hashed password, and whether you turned on two-step sign-in.
• Your profile, if you fill it in: a photo, phone number, home city and airport, languages, what you eat, allergies, birthday, nationalities and someone to call in an emergency. All optional, and only shown to the people on your trips.
• Your trips: everything you add to them: places, plans, notes, tickets, photos and journal pages, and who you’ve shared them with.
• A little activity: when you signed in and what changed on a trip, so trips can be restored and accounts kept safe. Wrong passwords are counted to stop guessing.
• The waitlist: if you joined it, your email, where you said you’re going next, and when you agreed to hear from us once, when we open.
• Reports: what you told us with the “Report a bug” button or about a public page, and your email if you left one.

We don’t keep your location. The app uses it only on your phone, when you ask it to (for example, “near me”).

Why, and on what basis

• To run the service you signed up for (performance of a contract): showing you your trips, sharing them with the people you invite, keeping them in sync and offline, and restoring them when something goes wrong.
• To keep accounts and the service safe (our legitimate interest): the activity log, limits on sign-in attempts, bot checks on public forms, and investigating misuse.
• The launch email (your consent): one email when we open, to people on the waitlist. You can withdraw it any time by writing to us.
• Your allergies and diet, if you add them, may count as health information. We use them only because you chose to add them (your explicit consent), to show on your emergency card and plan meals, and you can remove them at any time.
• When the law requires it (legal obligation): for example, keeping payment records for tax.

We don’t use your data for advertising, and we don’t sell or rent it to anyone. No decisions about you are made automatically.

Who else touches it

We use a few services to run Ampersand. Each sees only what it needs, and each is bound by a data processing agreement. The full, current list is on the sub-processors page.

• Cloudflare hosts the app and stores your trips.
• An email service sends account emails: confirming your address, resetting a password, trip invites.
• Map tiles and place search come from map providers; your phone asks them for the area on screen, and place names you search for are looked up on your behalf.
• Photos of places come from Unsplash or Wikimedia Commons.
• Fonts on this site are served by Google Fonts.
• The assistant, when you use it, sends your question and the relevant parts of the trip (and, for meal suggestions, the diets and allergies of the people on it) to the AI provider we use, under their terms for businesses, which don’t allow them to train on it.

Some of these companies are in the United States. Where data leaves the EU, it’s protected by the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

How long we keep it

• Your account and trips: until you delete them. Deleting your account deletes the trips only you are on and everything you uploaded to them, straight away. Backups roll over within 30 days.
• Trips you share: carry on for the others when you leave or delete your account; your name comes off them.
• The activity log: the newest 500 entries; older ones are dropped.
• One-time links (confirm, reset, invites): expire after an hour to 30 days.
• The waitlist: until the launch email is sent, then six months more, then deleted.
• Bug reports: until they’re dealt with and archived, then up to two years.

Your rights

You can see, correct, download or delete your data, and object to or restrict how we use it.

• Download everything: Account → Sign-in & privacy → Download my data.
• Delete everything: Account → Sign-in & privacy → Delete my account.
• Anything else, or if you can’t sign in: write to privacy@example.com. We answer within a month, usually much sooner.

If you think we’ve got it wrong, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or the one where you live. We’d appreciate the chance to put it right first.

Age

Ampersand is for people aged 16 and over. We don’t knowingly keep data about anyone younger; if you think we do, tell us and we’ll delete it.

Cookies

One: the cookie that keeps you signed in, which the service needs to work. No analytics cookies, no advertising cookies, nothing that follows you around the web. Your browser also keeps a copy of your trips so they work offline; that stays on your device.

Keeping it safe

Passwords are hashed with PBKDF2, connections are encrypted, admins sign in with a second step, and uploaded files are only shown to the people on their trip. If something ever goes wrong that affects your data, we’ll tell the authorities within 72 hours where the law asks us to, and tell you promptly and plainly.

Changes

If this policy changes in a way that matters, we’ll tell you in the app or by email before it takes effect.