Privacy policy

Last updated: October 5, 2026

ViaLooma is built to collect as little data as possible: no advertising, no data resale, cookieless audience measurement and no trackers requiring consent. This page describes precisely what data we process, why, with whom and for how long.

1. Data controller

The data controller is Waypoint Factory SAS, 180 chemin du Plateau, 73240 Avressieux, France (further details in the legal notice). Privacy contact: our contact form, or the email address given in the legal notice.

2. Data we process, purposes and legal bases

We process the following data, by category:

  • Account — your email address, your password (stored only as a hash, never in plain text), your first and last name, your public username (the only name shown on content you share) and your profile picture if you upload one yourself (optional, removable at any time; none is ever imported from Google or Apple). Purpose: providing the service and authenticating you. Basis: performance of the contract. On the same basis we also keep two indicators derived from your address: whether it is confirmed, and whether its domain is a disposable-address service — the second caps the account's AI allowance.
  • Country — when the account is created, an approximate country code is derived from your connection (the ISO code only, e.g. "FR"), without your IP address being stored for that purpose; you can also state which country you would like us to open (correctable in "My account"). Purpose: prioritising the opening of new regions and — only with your marketing consent — notifying you when they open. Bases: legitimate interest (derived country) and consent (desired country).
  • Marketing consent — your opt-in choice (double confirmation), its timestamps, source and unsubscribe status. Basis: consent; keeping the proof is a legal obligation.
  • Sign-in data — the provider used at sign-up and at your last sign-in (email, Google or Apple) and the date of that last sign-in. Purpose: usage statistics and account security. Basis: legitimate interest.
  • Content you create — your itineraries (steps, dates), favourites, likes, free-text notes, your selection of places, and the places you create with their photos. Your private notes and itineraries are visible to you alone; shared content shows only your username. The selection of places — the places gathered before building a trip — holds only public data about those places (name, position, country, town, type) and the date each was added; a place removed from our data stays in it, marked unavailable, and at sign-in a place of your device's selection that our data no longer knows is copied in as your device described it, for display only. It is included in your data export and goes with your account. Basis: performance of the contract.
  • Place search — what you type to look for a place, a town or a region is used only to answer you: it is neither stored nor written to our logs. The region shown on the map when you create a trip is saved with it: a reference to our public catalogue of regions, which says nothing about you.
  • Conversations with the AI assistant — the messages exchanged with "Looma" are stored on our servers — in your account or, for a "Looma, inspire me" conversation opened without an account, in an anonymous thread kept for 48 hours — and transmitted to Anthropic to generate the replies (see section 3). Basis: performance of the contract.
  • Subscription — the status and period of your subscription, and the customer identifier assigned by Paddle. Your payment data (card, billing address) is processed by Paddle and never passes through our servers. Basis: performance of the contract.
  • Technical logs — your IP address appears transiently in our host's technical logs (kept 7 days), for security and anti-abuse purposes (rate limiting). Our sessions keep neither IP address nor browser fingerprint. One bounded exception: to limit the free Looma trial without an account to three exchanges a day, we keep until the next day a counter indexed by a keyed fingerprint of your address (an HMAC salted with the day) — never the address itself, and no identifier that is stable from one day to the next. Basis: legitimate interest (security).
  • Audience measurement — aggregated, anonymous statistics (Cloudflare Web Analytics), without cookies or individual identifiers. Basis: legitimate interest.

3. The "Looma" assistant

When you use the chat, the messages you type — together with the trip context needed for the reply (steps, places) — are transmitted to Anthropic (United States), the model provider, through the Cloudflare AI Gateway. We never add your name or email address to those requests. The transfer is covered by a data processing agreement and the standard contractual clauses; processing (inference) may take place outside the European Union, and Anthropic retains the exchanges only for a limited time. Conversations remain stored in your account so you can pick up the thread; they are deleted along with it. Without an account, the "Looma, inspire me" conversation (three exchanges at most) is kept in an anonymous thread, with no personal identifier, for 48 hours and then deleted; if you sign in in the meantime, it joins your account. You are talking to an artificial intelligence, whose answers may be inaccurate. Advice: do not enter sensitive data in the chat (health, religion, etc.) — it is never needed to plan a trip.

In a stop's chat, for information that changes (opening hours, prices, closures, works), Looma may run a web search. The query is worded by Looma from your question and the place concerned, and carried out by Anthropic with its web search tool — never with your name or your email address. The pages consulted are cited under the reply and kept with the conversation.

4. Cookies and local storage

No advertising and no analytics cookies: audience measurement works without cookies, and no tracker requiring consent is used — which is why there is no banner. All the cookies we set are functional:

  • session cookie (30 days) — keeps you signed in; strictly necessary;
  • signed session cache (5 minutes) — speeds up the check of your session; strictly necessary;
  • rt_lang (6 months) — your display language;
  • rt_draft (6 months) — finds your itinerary draft in progress;
  • rt_optin and rt_wish (30 minutes) — complete a sign-up (marketing choice, desired country);
  • rt_deleted (5 minutes) — shows the confirmation after an account is deleted;

Your browser's local storage (localStorage) keeps your display theme, your language and your local draft, as well as the usage-limit counters — the time of your latest actions, which lets a button grey out before the server would refuse. An email address never appears there in plain text, only as a hash, for a waiting period of a few minutes; whatever has expired is deleted. Session storage (sessionStorage) holds, for the life of the tab, the identifier of your current "Looma, inspire me" conversation.

Without an account, your selection of places is kept there too, under the key roadtrip:selection1: public places you chose, on your device only and for the service you asked for — functional storage, which needs no banner. It is emptied when a trip is built from it, when it joins your account at sign-in, and at sign-out. Keeping it is not guaranteed: Safari may clear this storage after 7 days without a visit to the site.

5. Recipients, processors and transfers

Your data is neither sold nor shared for commercial purposes. It is processed by the following providers — in line with the GDPR and the Swiss data protection act (nFADP), we state each one's destination country and the safeguards covering transfers outside the EU:

  • Cloudflare (United States) — hosting (servers, database, files), CDN, cookieless audience measurement, Turnstile bot protection (see Cloudflare's Turnstile Privacy Addendum), technical logs and AI gateway. Safeguards: Data Privacy Framework certification and standard contractual clauses.
  • Brevo (France, EU) — delivery of transactional emails and, with your consent, marketing emails.
  • Paddle (United Kingdom / United States) — our reseller (Merchant of Record): it collects payments and issues invoices as an independent data controller. It collects your email, billing address and payment method under its own privacy policy. When the Premium page shows the price in your currency, your browser queries Paddle, which infers your country from your IP address. Safeguards: UK adequacy decision, standard contractual clauses.
  • Anthropic (United States) — generation of the AI assistant's replies and, in a stop's chat, web search (section 3). Safeguards: data processing agreement and standard contractual clauses.
  • Oracle Cloud — host of our own route-calculation server (ADR-049): only the coordinates of the steps pass through it, without any account identifier. Should it be unavailable, calculation falls back to OpenRouteService / HeiGIT (Germany, EU), which then receives the same coordinates.
  • EOX (Austria, EU) — satellite basemap: your browser loads the tiles directly from EOX, which therefore sees your IP address.
  • OpenFreeMap (delivered by Cloudflare) — the map's vector data: roads, borders and place names over the satellite basemap, and the whole “map” basemap. As soon as a map is shown, your browser loads the tiles directly from OpenFreeMap, which therefore sees your IP address.
  • Wikimedia Foundation (United States) — place photos: most are re-hosted by us, but those not yet re-hosted are loaded directly by your browser from Wikimedia Commons, which therefore sees your IP address.
  • Google / Apple (United States) — only if you choose their sign-in, for authentication alone.

6. Retention periods

  • account and content: until you delete your account;
  • sessions: 30 days — a daily automatic clean-up purges expired sessions and expired verification tokens;
  • anonymous drafts (not attached to an account): 90 days of inactivity;
  • an account's selection of places: until a trip is built from it, you remove its places or you delete your account; without an account, on your device only (section 4);
  • counter of the Looma trial without an account (keyed fingerprint of the address, salted with the day): until the next day;
  • "Looma, inspire me" conversations without an account: 48 hours;
  • AI assistant usage counters: 2 months;
  • technical logs: 7 days;
  • aggregated statistics (without identifiers): 90 days;
  • proof of marketing consent: as long as the account exists;
  • billing: Paddle keeps invoices in line with its accounting obligations (around 10 years); deleting your account with us therefore does not erase the invoices held by Paddle.

7. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability (arts. 15 to 21 GDPR):

  • access and portability — "Download my data" button in "My account": a full, immediate export in a structured format (JSON);
  • rectification — directly in "My account";
  • erasure — "Delete my account": immediate and permanent effect, including cancellation of any ongoing subscription (the subscription alone can also be cancelled at any time from "My account" or via the cancellation page);
  • objection to marketing — unsubscribe link in every marketing email, or from "My account";
  • restriction and other objections — through our contact form.

We reply within one month. You may also lodge a complaint with the CNIL (cnil.fr), the lead supervisory authority, or with the supervisory authority of your country of residence.

8. Place data from open sources

The place profiles shown come from open databases: OpenStreetMap, Wikidata, Wikimedia Commons and GeoNames. They may contain professional contact details — the phone number, email or address of an establishment — which, when the business is run under its owner's own name, are personal data. Purpose: tourist information; basis: legitimate interest. If you are concerned, you can request the correction or removal of that information through our contact form (subject "A place").

9. Security

Encryption in transit (HTTPS), passwords stored only as hashes, Google/Apple sign-in tokens encrypted at rest, strict compartmentalisation of private content and restricted system access.

10. Minors

ViaLooma is not intended for anyone under 16, who must not create an account.

11. Changes

This policy may change; the date of the last update appears at the top of the page.