← Back to Xemxi

Privacy Policy.

Last updated: July 2026

Xemxi is a trading name of Xemxi Technologies Ltd, a company registered in Malta ("we", "us"), which operates the travel planning service at xemxi.com and is the data controller for the personal data described here. This policy explains what personal data we collect, why we collect it, and your rights under the General Data Protection Regulation (GDPR). You can reach us at support@xemxi.com, or by post at 5, The Haven, Triq il-Gibjun, Attard, ATD2085, Malta.

Our legal basis for processing is legitimate interest (providing the service you requested) and, where required, your consent (e.g. marketing emails, analytics cookies).

What we collect

  • Trip profile data, your travel preferences (group type, trip length, interests) entered during plan generation. Used solely to build your itinerary. Not linked to your identity unless you create an account.
  • Email address, collected on the Free plan before revealing your itinerary, when you create an account, and if you register interest in Premium. Used to send your plan summary and, with your consent, to let you know when Premium launches. You can unsubscribe or ask us to remove it at any time.
  • Usage data, pages visited, buttons clicked, features used. Collected via PostHog analytics only after you accept cookies.
  • Server logs, standard Vercel hosting logs (IP address, request timestamps). Retained for 30 days.

Third-party processors

We share data with the following processors, each bound by their own GDPR-compliant Data Processing Agreements:

Anthropic

Your trip profile is sent to Anthropic's Claude API to generate your itinerary. Data is processed in the US under Anthropic's data processing addendum. Anthropic does not use your data to train models.

Resend

Confirmation and reminder emails (your plan confirmation, your register-interest confirmation, and the free-plan expiry reminder) are delivered through Resend. To deliver a message, Resend receives your email address and that message's content, under Resend's Data Processing Agreement. Our sending domain is configured in Resend's EU region. We do not keep a mailing list with Resend, your email address is stored in our own database (see Supabase below), so you can ask us to delete it at any time.

Supabase

Your account, your saved plans, and (if you register interest in Premium) your email address are stored in our Supabase database, under Supabase's Data Processing Agreement.

Stripe

If you purchase Premium, your payment is handled by Stripe. Xemxi never sees or stores your card details, Stripe processes them under its Data Processing Agreement. We store only a Stripe customer and session identifier to reconcile your purchase and handle refunds.

Google (Places and Maps)

Place identifiers, coordinates, ratings and photos for the locations we recommend come from the Google Places API and are cached in line with Google's terms. We do not send your trip profile to Google. If you open a location in Google Maps, that request is handled by Google under its own privacy policy.

OpenFreeMap

When you open the map view, map tiles are loaded from OpenFreeMap (tiles.openfreemap.org). As a third-party tile provider it receives your IP address and the map area you view in order to serve the tiles.

PostHog

Analytics events (page views, feature usage) are sent to PostHog only after you accept cookies. No personally identifiable data is sent to PostHog unless you are signed in, in which case a pseudonymous user ID is used.

Vercel

The app is hosted on Vercel's infrastructure. Vercel's servers process all HTTP requests and retain standard server logs for 30 days.

Sentry

If the app hits an unexpected error, a diagnostic report (the error and its stack trace, the page address, and your browser and operating system version) is sent to Sentry so we can find and fix the fault. We do not enable session recording, and we do not send your name, email address, or trip details. Data is processed under Sentry's Data Processing Agreement.

Data retention

  • Account data and saved plans: retained while your account is active, then deleted 12 months after last login.
  • Free plans in an account: automatically deleted a set period after they are created, and we email you a reminder 7 days before. Premium plans do not expire.
  • Plans made without an account: kept for 30 days and then permanently deleted, along with the trip details you answered to build them. The link we email you works for that period. Signing in from your plan moves it into your account, where the rule above applies instead. These plans get no expiry reminder, because we only ever send one email about them.
  • Register-interest emails: retained in our own database until you unsubscribe or ask us to delete them. Deleting your account also removes them.
  • Emails given to save a plan without an account: kept for up to 90 days and then deleted automatically. We use them only to send you your plan link and to avoid sending it twice. Deleting your account also removes them.
  • Server logs: 30 days.
  • Analytics events: 1 year (PostHog project setting).
  • Purchase records and the consent you give at checkout: 6 years, because we need them to establish, exercise or defend legal claims (Article 17(3)(e)) and to meet accounting obligations. If you delete your account, these are unlinked from you rather than erased, so they no longer identify you.
  • Support and withdrawal requests: 24 months after the request is closed. Deleting your account unlinks them from you straight away.

Your rights

Under GDPR you have the right to:

  • Access, request a copy of your personal data.
  • Rectification, correct inaccurate data we hold.
  • Erasure, request deletion of your data (Article 17). We will process this within 30 days.
  • Portability, receive your data in a machine-readable format (Article 20).
  • Object, opt out of marketing emails at any time via the unsubscribe link or your account settings.
  • Withdraw consent, reject or revoke cookie consent at any time; this does not affect processing already done.

To exercise any of these rights, email support@xemxi.com. You do not need an account to ask. If you made a plan without one, tell us the email address you gave us to save it, because that is the only way we can find it.

Cookies

We use one functional cookie (your cookie consent choice, stored in localStorage) and, after consent, PostHog analytics cookies. We do not use advertising or tracking cookies. You can change your consent choice at any time by clearing your browser's localStorage for this site.

California residents, Do Not Sell My Personal Information (CCPA)

Under the California Consumer Privacy Act (CCPA), California residents have the right to opt out of the "sale" of their personal information. Xemxi does not sell personal information to third parties for money. We share limited data with service providers (Anthropic, Resend, Supabase, Stripe, Google, OpenFreeMap, PostHog, Vercel, Sentry) solely to operate the service, which does not constitute a "sale" under CCPA.

To opt out of analytics data collection, reject or withdraw your cookie consent (see Cookies section above). To request deletion of your personal data, email support@xemxi.com with "CCPA Delete Request" in the subject line.

Contact & complaints

Data controller: Xemxi, Malta. support@xemxi.com

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information and Data Protection Commissioner (IDPC), Malta's data protection authority.

XemxiPremiumTerms of ServiceWithdraw from contractPhoto creditsDo Not Sell My Info