Governing language. This Privacy Policy is provided in several languages for your convenience. The English version is the authoritative version, and in case of any discrepancy or conflict between translations, the English version prevails.
Ovvia is a travel information and planning platform operated by Chanducate LLC. This policy explains what information we collect when you use Ovvia (the website, app, and services), why, and what your rights are.
Important: Ovvia displays information and links out to third-party providers for booking. We do not sell, do not book, and do not charge for flights, hotels, or travel services — any booking happens on the provider's own site, subject to their terms.
Ovvia does not show advertisements. We do not sell, rent, or trade your personal information, and we do not build an advertising profile of you. Our revenue comes from paid subscriptions and affiliate commissions on outbound links — not from your data and not from advertising. A clear affiliate disclosure appears next to every such link.
Some Ovvia features (itineraries, place guides, recommendations) are generated automatically by artificial intelligence.
AI-generated content may be inaccurate, incomplete, or out of date. It is for inspiration and planning only, and is not professional advice (legal, medical, financial, safety, or otherwise). Verify critical details — opening hours, prices, visa requirements, safety, and emergencies — with official sources before relying on them.
We are not liable for loss arising from reliance on AI-generated content.
We use information to: provide the service and manage your account; sync your trips across devices; power AI features; enforce usage limits; and maintain security. Under GDPR, our legal bases are performance of a contract (providing the service), consent (for optional features), and legitimate interests (security and improvement). Under Israel's Amendment 13, we process data with consent and for the purposes for which it was provided.
We do not sell information. We use trusted service providers that process information only on our behalf:
| Provider | Purpose |
|---|---|
| Supabase | Account and data storage, authentication, sync |
| Vercel | Website and server hosting |
| Anthropic | Powering AI features |
| Stripe | Processing subscription payments |
| TomTom | Maps, location, and driving routes |
| Travelpayouts / Booking.com | Flight and hotel information and links (referral only) |
Some providers are located in the United States. Where information of EU/EEA users is transferred to the U.S., the transfer relies on recognized legal mechanisms (the EU-US Data Privacy Framework and/or Standard Contractual Clauses).
Depending on the law that applies to you, you have the right to access, export, correct, delete, object to certain processing of, and port your information. Some rights are built directly into the app (one-click data export and deletion). To exercise a right or ask a question — support@ovvia.app.
As a California resident (CCPA/CPRA) or a resident of another U.S. state with a privacy law, you have the right to know what personal information is collected and how it is used; to access and delete it; to correct it; and to opt out of the sale or "sharing" of personal information. Ovvia does not sell and does not "share" personal information as those terms are defined under the CCPA/CPRA — there is nothing to opt out of. You will not be discriminated against for exercising your rights.
Users in the EU/EEA (GDPR) and Israel (Amendment 13) have the rights above and may also lodge a complaint with their local supervisory authority (in the EU) or the Privacy Protection Authority (in Israel).
We do not set cookies at all. Your login state and app data are kept in your browser's local storage, on your device. We do not use advertising or third-party tracking technologies, and there is no third-party analytics. If this ever changes, we will update this section and add a consent mechanism first. We use privacy-respecting, first-party analytics: aggregate, anonymous counts (event name, referrer host, UTM tags, language) with no cookies and no third-party services.
We protect information with technical and organizational measures: row-level security (RLS) so each user accesses only their own data; encryption in transit; sensitive keys and services server-side only; and payments handled solely through Stripe. No method is 100% secure, but we follow accepted practices. In the event of a material security incident, we will notify as required by law.
We keep your information while your account is active. Upon account deletion, personal data is deleted within 30 days, except what we must retain by law (e.g., payment records, which are held by our payment processor).
Ovvia is not intended for users under 16 (or the applicable minimum age in your jurisdiction), and we do not knowingly collect information from children. If we learn of such information, we will delete it.
We may update this policy from time to time. We will notify you of material changes via the site or email, and update the "Last updated" date above.
Chanducate LLC is a U.S. company. This policy and the service are governed by the laws of the United States and the State of Wyoming, except for mandatory rights granted to you by your local law (such as GDPR in the EU or Amendment 13 in Israel), which continue to apply to you.
For privacy questions, requests, or complaints: Chanducate LLC (a U.S. company) · support@ovvia.app