Privacy Policy

1. Introduction

NovaXplora ("we," "us," or "our") is an AI-powered trip planning web application. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use NovaXplora. By using our service, you agree to the collection and use of information in accordance with this policy.

Data Controller: Device Cortex is the data controller responsible for your personal data. For any questions about how your data is processed, or to exercise your rights under applicable data protection law, please contact us at [email protected].

2. Information We Collect

We collect the following categories of information:

• Account Information: Name, email address, and a confirmation that you meet our minimum age requirement. We deliberately do not collect your date of birth.
• Profile Information: Profile photo, display preferences, and any contact details you choose to add to your profile, such as phone numbers, postal addresses, and additional email addresses.
• Payment Information: If you purchase a subscription, payment is handled by a payment processor. We receive confirmation of payment and a payment reference; we never store your full card number.
• Trip and Travel Data: Dreams, trip plans, destinations, activities, notes, and comments you create within the app.
• Location Data: Locations you search for and save as destinations in your plans.
• Photos and Attachments: Images and files you upload to your trips and dreams.
• Usage Data: Login timestamps, feature interactions, and general usage patterns to help us improve the service.
• Authentication Data: Session information and, for social login users, limited data provided by your social login provider (e.g., Google, Facebook).
• Technical Data:Your IP address and basic request details, which your browser sends with every request to any website. We use these to keep the service secure — limiting how often a request can be repeated, blocking brute-force sign-in attempts, and confirming that automated notifications come from a source we expect — and to show you your own recent sign-in sessions so you can spot anything you don't recognize.

3. How We Use Your Information

• Provide the Service: To operate, maintain, and deliver the core trip planning features of NovaXplora.
• AI-Powered Suggestions: To generate personalized activity and destination recommendations using AI models (see Section 5 for details).
• Collaboration: To enable you to share trip plans and dreams with other users you invite.
• Account Security: To verify your identity, protect against fraud, and maintain the security of your account.
• Improvements: To understand how users interact with the service and make improvements.
• Communications: To send you emails about your account and the service. If we ever introduce optional product or marketing emails, they will be opt-in and you will be able to unsubscribe at any time.

4. Legal Basis for Processing

Under the General Data Protection Regulation (GDPR), we process your personal data on the following legal bases:

• Contractual Necessity (Art. 6(1)(b)): Processing necessary to provide the service you have signed up for, including account management, trip planning features (including AI-generated suggestions, described in Section 5), collaboration, and data export.
• Legitimate Interest (Art. 6(1)(f)): Processing necessary for our legitimate interests, such as service improvement, security monitoring, and abuse prevention, where those interests are not overridden by your rights.
• Consent (Art. 6(1)(a)):Where we ask for it — for example, before any future optional feature that needs data beyond what is described in this policy. Where processing is based on consent, you may withdraw it at any time (see Section 10).
• Legal Obligation (Art. 6(1)(c)): Where we are required to process data to comply with applicable laws.

5. AI and Automated Processing

NovaXplora uses third-party AI models to generate destination and activity suggestions for your trips. When you use AI-powered features:

• Data sent to AI providers:What we send depends on the feature. For suggestions and recommendations, it is trip context such as trip descriptions, trip type (e.g., adventure, relaxation), destination context, your travel preferences, and search text you enter. We never attach your account profile — your name, email address, or account identifier — to an AI request.
• Documents and emails you import: If you upload a travel document or forward a booking email to import it, its full contents are sent to an AI provider so the trip details can be extracted. Booking documents typically contain traveler names and reservation details, so those reach the provider as part of the document itself. Import only what you are comfortable processing this way.
• AI providers used: We use one or more third-party AI providers, and the specific provider used may vary. We may also run self-hosted models, in which case nothing leaves our systems and no data is sent to any third party.
• How outputs are used: AI-generated suggestions are presented as recommendations only. No automated decisions are made that produce legal or similarly significant effects on you.
• Data retention by AI providers:Our AI providers process data under business API terms that prohibit using your data for model training. Data sent via API calls is subject to each provider's data processing agreement and retention policies.

6. Information Sharing

• With Other Users:Content you share through collaboration features is visible to the people you invite. If you choose to share content by public link — such as a photo gallery — anyone with that link can view it, and you can stop sharing it at any time.
• At Your Direction:If you choose to export or send your content to another service — for example, exporting a trip to your calendar — the content you select is sent to that service and its own policy governs it there.
• Legal Requirements: We may disclose your information if required by law or in response to valid legal process.

We do not sell your personal data to third parties.

We use the following categories of third-party service providers who may process your data on our behalf:

See our Service Providers page for a current list of the specific providers within each category. You can also reach us at [email protected].

7. Affiliate Links and Outbound Bookings

Where available, some links on NovaXplora take you to a travel partner to complete a booking, and we may earn a commission if you book. Each of those links is marked where it appears. This section explains what happens to your data when you follow one.

We do not send your personal data to these partners.We never share your name, email address, account identifier, or anything else about your account with a booking partner. What travels in the link is the context of the search itself — for example a destination, dates, and the number of travelers — together with an affiliate identifier that tells the partner the visit came from NovaXplora. Where we show partner availability or prices inside NovaXplora, our servers request them using only that same search context, never your identity.

What the partner sees because your browser goes there.Following the link is a normal visit to another company's website, made by your browser and not by us. As with any site you visit, the partner will receive your IP address and browser details, and may set its own cookies on its own domain to record that the referral came from us. We have no access to those cookies and receive no browsing data back — only aggregate reports of whether a booking occurred. Once you leave, that partner's privacy policy governs, not ours.

We work with a small number of travel booking partners, covering categories such as accommodation, flights and other transport, tours and activities, and car hire. Each partner is a separate company responsible for its own site and its own policies; which categories we cover, and which partner covers them, may change as we add or replace partners over time.

You are never required to use these links. Booking directly with any provider works exactly the same for you, and nothing about your plans changes if you do.

8. International Data Transfers

Some of our service providers operate outside the European Economic Area (EEA). When your data is transferred to countries that have not been deemed to provide an adequate level of data protection by the European Commission, we ensure appropriate safeguards are in place:

• Providers outside the EEA:Some of our service providers operate outside the EEA, principally in the United States. Transfers to these providers are protected by Standard Contractual Clauses (SCCs) and/or the provider's Data Processing Agreement.
• Providers within the EU: Others are operated within the EU and do not involve cross-border transfers.

9. Data Retention

• Active Accounts: Your data is retained for as long as your account remains active.
• Deleted Accounts: When you delete your account, it enters a 30-day grace period during which you can contact us to recover it. After 30 days, your content and uploads are permanently deleted and your account record is irreversibly anonymized, so nothing that remains can be linked to you.
• Third-Party Results:Results from third-party providers — such as routes and place data — are cached temporarily to improve performance, for periods ranging from minutes up to about a month depending on the source. No user data is stored with these providers beyond their standard API request logging.

10. Your Rights

You have the right to:

• Access: View your personal data through your profile and trip history.
• Correction: Update your personal information via your profile settings. If something cannot be changed there, contact us and we will correct it for you.
• Deletion: Delete your account and all associated data at any time.
• Export: Download a complete copy of all your data at any time from your profile settings.
• Withdraw Consent: Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

If you are located in the European Union, you also have the right to data portability, restriction of processing, and objection to processing under the General Data Protection Regulation (GDPR). To exercise any of these rights, please contact us at [email protected].

11. Children's Privacy

NovaXplora is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will promptly delete that information from our systems.

12. Cookies and Local Storage

NovaXplora uses minimal browser storage, limited to what is strictly necessary for the service to function:

• nx_session: An HttpOnly, Secure, SameSite=Lax cookie that keeps you signed in, for up to 14 days. Strictly necessary and exempt from consent requirements.
• XSRF-TOKEN: A cookie used as a defence against cross-site request forgery on form submissions. Cleared when the browser session ends. Strictly necessary.
• Local Storage:Your display preferences, UI settings, and small pieces of short-lived working state — for example, a draft of a form you were filling in, held briefly while you re-authenticate. This stays on your device.
• Browser storage and caches:Trip plan and dream data, and recent responses from our own service, may be cached in your browser's storage (such as IndexedDB and the browser cache) so the app works offline and loads quickly. This data remains on your device and is not transmitted to any third party.

On NovaXplora we use no advertising cookies and no advertising or profiling trackers, and we set no third-party cookies. No cookie consent banner is required because all storage listed above is strictly necessary for the service to function.

One narrow exception to "nothing leaves your browser": when something on a page breaks, technical details of the error — such as the page and browser involved — are sent to our error-monitoring provider so we can find and fix the failure. It is configured not to include personal information, it sets no cookies, and it is not used to profile you. See the Error monitoring category in Section 6.

This remains true for outbound links generally — not just affiliate links, but also links to things like weather sources, maps, and reference pages such as Wikipedia. We embed no partner widgets, iframes, or scripts, so no third-party code ever runs on our pages and no third party can set a cookie through us. Following any of these links is an ordinary visit to another site: any cookie the destination sets is set on its own domain, after you have chosen to go there, and is governed by that site's own policy. See Affiliate Links and Outbound Bookings above for what travels with a booking-partner link specifically.

13. Security

We take reasonable measures to protect your information, including encrypting data in transit via HTTPS, enforcing Content Security Policy headers, and using industry-standard authentication protocols. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

14. Data Breach Notification

If a security breach affects your personal data, we will notify you and the relevant authorities as required by the laws that apply to you.

• United States: We will notify affected users, and state regulators where required, in accordance with applicable state data breach notification laws and within the timelines those laws set.
• European Union and United Kingdom: Where the GDPR or UK GDPR applies, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach that is likely to result in a risk to your rights and freedoms. If the breach is likely to result in a high risk to you, we will also notify you directly.

In every case, our notice will describe the nature of the breach and the steps you can take to protect yourself.

15. Changes to This Policy

We may update this Privacy Policy from time to time — for example, to reflect new features, new third-party providers, or changes in applicable law.

When we do, we will tell you what changed. The next time you sign in you will see a plain-language summary of each change, and we record which version you acknowledged and when. You can read every past summary, and see what you have acknowledged, at any time from Policy Updates in your profile.

We will not treat a change as accepted merely because a date on this page changed. If a change is significant, we will ask you to acknowledge it before you carry on using NovaXplora. The same applies to our Terms of Service.

16. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at [email protected].

Device Cortex has not appointed a Data Protection Officer (DPO) as it does not meet the thresholds requiring one under GDPR Art. 37. For all data protection inquiries, please use the email address above.