Privacy policy

Who we are

This website is run by ALKIKI. We are the data controller for personal data collected through it. Contact: support@alkiki.com.

What we collect

• Trip requests: your name, email and questionnaire answers (which may include travel dates, nationality, budget, health or accessibility needs you choose to share). While you fill in the form, your answers are kept only in your own browser so you don't lose them; they reach us when you press “Send my request”. We then email you a link to confirm your address, and we only read your request once you've confirmed it. To stop spam we briefly keep a one-way scrambled (hashed) version of your IP address, never the address itself. We also keep short internal notes about your request, which only we can see.
• Client accounts: if we accept your request, we create an account for your email address. You choose your own password from a one-time link we email you (we never send passwords), and can turn on an emailed sign-in code. The account holds your name, email, trip plans, comments and favourites.
• Newsletter: your email and the date and wording of your consent.
• Contact form: your name, email and message.
• Technical data: only the cookies the site needs to work, such as keeping you signed in. We don't use analytics or tracking. See our cookie policy.

Why we use it (legal bases)

• To review your request and deliver your plan (steps before and performance of a contract).
• Health or accessibility needs you choose to share are used only to plan your trip, with your explicit consent, which you can withdraw at any time.
• To send the newsletter (your consent, which you can withdraw at any time).
• To reply to messages and keep the service secure (our legitimate interests).

Who can see your data

Your questionnaire answers and plans are visible only to us (the ALKIKI team) and to you. We never sell your data. We use trusted providers to run the service, who process data only on our instructions:

• Supabase: database and sign-in.
• Vercel: website hosting.
• Resend: sending emails.
• ImageKit: storing and delivering photos.
• Cloudflare: our domain and forwarding emails sent to us.

Some of these providers may store or process data outside your country. Where they do, they use recognised safeguards such as standard contractual clauses.

How long we keep it

• If you don't confirm your email, your request and answers are deleted automatically after 7 days.
• Requests, plans and messages are kept while your account is open or while we may need them to answer questions about your trip, then deleted.
• Newsletter details are kept until you unsubscribe.

You can ask us to delete your data sooner at any time.

Your rights

You can ask to access, correct, export or delete your data, object to or restrict processing, and withdraw consent at any time. Email us (or, with an account, use “Ask us to delete my data” in your portal) and we'll respond within one month. An export is a file of everything we hold about you. Deleting removes your account, requests, plans, comments and messages for good. You also have the right to complain to the data protection authority in your country.

Changes to this policy

If we make important changes, we'll update the date above and, where appropriate, let you know by email.