Privacy Policy

Sujova ("Sujova", "we", "us") is operated by EiCapp, based in Finland, Business Address available upon request. Our website is https://sujova.com. We act as the data controller for personal data processed through the service.

• Account email and authentication identifiers
• Profile / display name
• Trip content you enter (destinations, notes, preferences)
• AI-generated itineraries linked to your account
• Email addresses of collaborators you invite
• Support messages you submit through /help
• Privacy-friendly analytics events (page views, feature usage)
• Payment / subscription status received from our payment processor
• Product feedback you submit through the in-app feedback launcher, including the message text, the category you choose, an optional sentiment, the interface language, a normalized page-context identifier, and (only if you tick the contact-permission box as an anonymous submitter) an optional contact email
• For signed-in feedback submissions, an association between the feedback record and your account identifier. Your account email is not copied into the feedback record.
• The normalized page-context identifier is a short, allow-listed label such as home, trip_plan or alignment_participant. It does not include raw URLs, query strings, trip IDs, group IDs, invite tokens or Trip Alignment participant tokens.

• Create and secure your account
• Generate, save, and adapt itineraries
• Enable trip sharing and collaboration
• Process subscriptions and unlock paid features
• Provide customer support
• Understand product usage in aggregate to improve Sujova
• Protect the service against abuse and fraud
• Comply with legal obligations
• Review product feedback to identify problems and confusing experiences
• Evaluate feature requests and other suggested improvements
• Respond to a submitter only when they have granted contact permission

When you submit product feedback, Sujova transiently processes your IP address to derive a one-way hashed identifier used solely for abuse prevention. The raw IP address is not retained in the product-feedback database. The hashed identifier is stored separately in a short-lived rate-limit log and removed automatically after 48 hours. Hashing reduces linkability but does not by itself make the identifier anonymous, and this statement is limited to what Sujova stores in the product-feedback database. Hosting infrastructure may still process request metadata elsewhere in the ordinary course of operating the service.

If you submit feedback anonymously, an optional contact email is stored only when you tick the contact-permission box and choose to provide it. A one-way hash of that email may also be stored temporarily in the same short-lived rate-limit log for abuse prevention, on the same 48-hour terms.

If you submit feedback while signed in, the feedback record is linked to your account identifier. Sujova administrators may retrieve your current account email only when you granted contact permission for that submission. Administrators may also record an internal status, priority and notes to help triage the feedback queue.

We rely on the following legal bases, depending on the activity:

• Performance of a contract (providing the service you signed up for)
• Legitimate interests (security, abuse prevention, product improvement)
• Consent (where required, e.g. optional communications, and your contact permission when you submit product feedback and choose to be reachable about it)
• Legal obligation (tax, accounting, lawful requests)

• Supabase / Lovable: hosting, authentication, and database
• Resend: transactional email (invites, support replies)
• Paddle: Merchant of Record and payment processor
• Plausible: privacy-friendly product analytics
• AI model providers: itinerary generation based on your prompts

These providers process data on our behalf under appropriate agreements and only as needed to deliver their part of the service.

We retain account and trip data for as long as your account is active. Support messages are kept as long as needed for support and legal purposes. Payment records are retained by Paddle in line with their own retention obligations. Analytics data is aggregated in Plausible and does not identify you individually. You can request deletion of your account at any time via /help.

Product feedback marked as resolved or dismissed is deleted automatically 12 months after resolution. All product feedback is deleted automatically no later than 18 months after submission. Records in the separate rate-limit log described above are deleted automatically after 48 hours.

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Export your data in a portable format
• Object to or restrict certain processing
• Withdraw consent where processing is based on consent
• Lodge a complaint with your local supervisory authority

To exercise any of these rights, contact us through the in-app support page.

We use reasonable technical and organizational measures, including encryption in transit, access controls, and audit logging, to protect personal data. No system is perfectly secure, and we cannot guarantee absolute security.

For privacy questions or data requests, please use our in-app support form.