Xemxi ("we", "us") operates the travel planning service at xemxi.com. This policy explains what personal data we collect, why we collect it, and your rights under the General Data Protection Regulation (GDPR).
Our legal basis for processing is legitimate interest (providing the service you requested) and, where required, your consent (e.g. marketing emails, analytics cookies).
We share data with the following processors, each bound by their own GDPR-compliant Data Processing Agreements:
Anthropic
Your trip profile is sent to Anthropic's Claude API to generate your itinerary. Data is processed in the US under Anthropic's data processing addendum. Anthropic does not use your data to train models.
Mailchimp (Intuit)
Your email address and trip metadata (month, duration, group type) are stored in Mailchimp for transactional emails and, with consent, marketing sequences. Data processed in the US under Mailchimp's DPA. You can unsubscribe at any time.
Supabase
Your account, your saved plans, and (if you register interest in Premium) your email address are stored in our Supabase database, under Supabase's Data Processing Agreement.
Stripe
If you purchase Premium, your payment is handled by Stripe. Xemxi never sees or stores your card details, Stripe processes them under its Data Processing Agreement. We store only a Stripe customer and session identifier to reconcile your purchase and handle refunds.
Google (Places and Maps)
Place identifiers, coordinates, ratings and photos for the locations we recommend come from the Google Places API and are cached in line with Google's terms. We do not send your trip profile to Google. If you open a location in Google Maps, that request is handled by Google under its own privacy policy.
OpenFreeMap
When you open the map view, map tiles are loaded from OpenFreeMap (tiles.openfreemap.org). As a third-party tile provider it receives your IP address and the map area you view in order to serve the tiles.
PostHog
Analytics events (page views, feature usage) are sent to PostHog only after you accept cookies. No personally identifiable data is sent to PostHog unless you are signed in, in which case a pseudonymous user ID is used.
Vercel
The app is hosted on Vercel's infrastructure. Vercel's servers process all HTTP requests and retain standard server logs for 30 days.
Under GDPR you have the right to:
To exercise any of these rights, email support@xemxi.com.
We use one functional cookie (your cookie consent choice, stored in localStorage) and, after consent, PostHog analytics cookies. We do not use advertising or tracking cookies. You can change your consent choice at any time by clearing your browser's localStorage for this site.
Under the California Consumer Privacy Act (CCPA), California residents have the right to opt out of the "sale" of their personal information. Xemxi does not sell personal information to third parties for money. We share limited data with service providers (Anthropic, Mailchimp, Supabase, Stripe, Google, PostHog, OpenFreeMap, Vercel) solely to operate the service, which does not constitute a "sale" under CCPA.
To opt out of analytics data collection, reject or withdraw your cookie consent (see Cookies section above). To request deletion of your personal data, email support@xemxi.com with "CCPA Delete Request" in the subject line.
Data controller: Xemxi, Malta. support@xemxi.com
If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information and Data Protection Commissioner (IDPC), Malta's data protection authority.