Privacy Policy

1. Introduction and Data Controller

WNDR ("we", "us", "our") operates the travel social platform available at wndrtravel.com and on iOS and Android mobile applications.

WNDR acts as the data controller for the personal data processed through this platform. For any privacy-related inquiries, contact us at [email protected].

2. What Personal Data We Collect and Why

2.1 Data you provide directly

• Account data: username, email address, password (stored hashed — never in plain text)
• Profile data: profile picture, bio, age, gender, travel style, interests, languages, favorite destinations, origin and current country — provided voluntarily
• User-generated content: posts, photos, videos, comments, travel plans, blog entries
• Messaging: private messages and group chat content — used solely to deliver the messaging feature
• Trip planning requests: destination, travel dates, budget, preferences
• Payment data: processed exclusively by Stripe. WNDR never stores or accesses your card details

2.2 Data collected automatically

• Session and authentication tokens — to maintain your logged-in state
• Device type and operating system — for technical compatibility
• IP address — for security and fraud prevention
• Usage data — features used, to improve the service

2.3 Data we do NOT collect

• We do not collect sensitive data (health, sexual orientation, ethnic origin, religion, biometrics, political opinions)
• We do not use advertising trackers or third-party analytics
• We do not sell your data to any third party, ever

2.4 Legal bases (GDPR Article 6)

• Contract performance (Art. 6.1.b) — to provide the service you registered for
• Legitimate interests (Art. 6.1.f) — security, fraud prevention, platform improvement
• Consent (Art. 6.1.a) — optional profile fields
• Legal obligation (Art. 6.1.c) — compliance with Spanish and EU law

3. Data Retention Periods

• Account and profile data: retained while active, plus 30 days after deletion
• User-generated content: deleted immediately upon account deletion
• Private messages: deleted upon account deletion
• Payment records: retained for 7 years (Spanish tax law, Ley 58/2003)
• Security logs: retained for 12 months
• Trip planning requests: retained for 2 years after completion
• Data subject correspondence: retained for 3 years

4. Third Parties and Data Processors

WNDR does not sell, rent, or share your data for marketing purposes. Data is only shared with:

4.1 Technical service providers

• Railway (railway.app) — hosting and database. US-based. Data transferred under Standard Contractual Clauses (SCCs).
• Cloudflare R2 — image and media storage/CDN. US-based. Data transferred under SCCs.
• Resend (resend.com) — transactional email. US-based. Data transferred under SCCs.
• Stripe (stripe.com) — payment processing. Independent data controller. See Stripe's Privacy Policy.

4.2 Other cases

• When required by law or court order
• To protect rights, property, or safety of WNDR or our users
• In a business transfer — users will be notified at least 30 days in advance

5. International Data Transfers

Some service providers are located outside the EEA. All transfers are protected through Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914). Full list available upon request at [email protected].

6. Automated Decision-Making and Profiling

WNDR uses automated profiling to suggest travel buddy matches based on location, interests, and travel style you have voluntarily provided. This does not produce legal effects, does not involve sensitive data, and can be objected to at any time by contacting [email protected]. We do not use fully automated decision-making within the meaning of GDPR Article 22.

7. Your Rights Under GDPR

• Right of access (Art. 15) — obtain a copy of your data
• Right to rectification (Art. 16) — correct inaccurate data
• Right to erasure / 'right to be forgotten' (Art. 17) — request deletion
• Right to restriction (Art. 18) — limit how we use your data
• Right to object (Art. 21) — object to legitimate-interest processing
• Right to data portability (Art. 20) — receive your data in JSON format
• Right to withdraw consent (Art. 7.3) — at any time

Send requests to [email protected]. We will respond within 30 days. Exercising rights is free. You may also lodge a complaint with the AEPD.

8. Account and Data Deletion

Delete your account at any time from the app: Settings → Account → Delete Account. Deletion is immediate and irreversible (subject to legal retention periods above). You may also request deletion by emailing [email protected] with subject "Account Deletion Request".

9. Minimum Age

WNDR is exclusively for users aged 16 and older (GDPR Art. 8 and Spanish law). We do not knowingly collect data from anyone under 16. Discovered underage accounts are immediately deleted. Report underage users to [email protected].

10. Cookies and Local Storage

WNDR uses only technically necessary cookies and secure local storage tokens for authentication (JWT) and preferences. We do not use advertising, tracking, or analytics cookies. No cookie consent banner is required.

11. Security

Security measures include: HTTPS/TLS encryption, bcrypt password hashing, JWT token expiry and rotation, rate limiting, brute-force protection, access controls, and regular backups. In the event of a breach posing high risk to your rights, we will notify the AEPD within 72 hours and inform affected users without undue delay.

12. Changes to This Policy

We will notify you of material changes via email and in-app notification at least 14 days before they take effect. The current version is always available at wndrtravel.com/privacy/.

13. Contact

• Email: [email protected]
• Website: wndrtravel.com