XYVEL Trip: privacy policy
Version of 13 October 2026
The short version
XYVEL Trip is a web application at xyvel.ch/trip, which requires an account; a first programme is free, beyond that a subscription is required. What you write there is processed by XYVEL and by its artificial intelligence provider to build your programme, without your e-mail address. A Pro subscriber who clicks a booking link may, once informed, open a session in their name with the seller. The site sets a single cookie, which remembers the language you choose, and no measurement or tracking cookie. We count visits and the steps of the service as anonymous daily totals, with no identifier. Payment is handled by our payment provider. This policy applies under the Swiss Federal Act on Data Protection (FADP) and, for people living in the European Union, under the General Data Protection Regulation (GDPR).
What you choose to write
You describe your trip freely, and nothing obliges you to say more than you need to. Some details that genuinely help a programme are nevertheless sensitive data under art. 5 let. c FADP and art. 9 GDPR: a diet that reveals a religious belief, reduced mobility, a medical treatment, a trip tied to a membership. If you write them, they are treated like the rest of your text (kept for thirty days, sent to our artificial intelligence provider), and that processing rests on your explicit consent, which writing them expresses. You can delete the trip concerned at any time, which erases that text from our servers. If you would rather not entrust them, describe the need without the reason: a ground-floor room rather than the medical motive, no pork rather than the belief.
Account and subscription
The e-mail address you enter is sent to our server, which e-mails a single-use sign-in code. The server keeps the address, one token per connected device (stored in your browser, revoked by signing out), the state of the subscription, the counters of trips and messages, monthly for a subscription and permanent for the free programme, and, for a Pro subscriber who entered it, their first name and the date on which they were informed of the session with the seller and chose to continue. Payment is handled by our payment provider: XYVEL neither sees nor stores your card number.
Your trips and the artificial intelligence
What you write in the planner (trip criteria, conversation, choices) and the versions of the programme are kept by our server for 30 days after the last activity, then deleted automatically; you can delete a trip sooner from the application. To write the programme, those texts are sent to our artificial intelligence provider, Anthropic (United States), without your e-mail address or any account identifier, under contractual terms that do not allow training its models on this data. This transfer outside Switzerland and the European Union rests on those contractual safeguards, under art. 16 FADP and art. 46 GDPR.
Who we entrust processing to
XYVEL sells, rents and trades no data, and shows no advertising. Six providers are involved, each for a single task: a host for the public site; a host for our application server, in the European Union; a host for the database where accounts and trips live, in the European Union; our AI provider writes the programmes; our payment provider handles payment; our email provider sends the sign-in codes. The seller with whom the booking is made is not one of them: it processes nothing on our behalf and answers itself, as an independent controller, for the data it receives for a Pro subscriber (see "Session with the seller"). No other recipient of your account data; the price sources, which receive neither your address nor any identifier outside that session, are described below.
Session with the seller
When an XYVEL Trip Pro subscriber clicks a booking link for the first time, a screen informs them of what follows and asks for their first name; from then on, at each click, XYVEL sends the seller their e-mail address, their first name, a technical identifier specific to that seller, their language and their currency, so as to open a session in their name on the booking page and apply the members' rate there. The seller, a company established in Ireland whose identity appears on the booking page, then creates a customer account on its side, which it manages as an independent controller under its own privacy policy, reachable from that page. The booking page, although served under a subdomain of xyvel.ch, is operated by the seller. This transfer rests on the performance of the subscription (art. 6(1)(b) GDPR); it concerns only Pro subscribers who continued past that screen: nothing is sent for other accounts, nor for anyone who chooses "Open without a session". You can turn off automatic opening at any time from your account menu in the planner; the next click will show that screen again.
How long we keep what
The sign-in code: thirty minutes, then erased automatically. A device token: until it expires or you sign out. A trip and its versions: 30 days after the last activity. The technical trace of payment events (event identifiers, with no personal data): 30 days. An account with no sign-in for 24 months is deleted along with everything attached to it; a subscribed account is never deleted this way. The anonymous daily totals: 400 days, then erased automatically. Visits are also counted by hour; these hourly totals are erased after 14 days. At our payment provider, the customer and their invoices are kept for ten years: that is an accounting obligation (art. 958f of the Swiss Code of Obligations) neither you nor we can set aside, and it outlives the deletion of your account with us.
Prices and sources
Prices come from official and partner sources, queried by our server; they serve the programme of your session. Only older prices carrying no identifier (route or city, dates, amount, source, time) remain, for at most 12 months, in an anonymous price history; no new price is added to it. XYVEL books nothing: links open the seller's site and may carry an affiliate identifier, at no extra cost to you.
What the sources learn about you
To find a price, our server queries the sources for the kind concerned: hotel and flight booking platforms, an activities marketplace, map and places services, a weather service, open databases about countries, and a few public sources for public holidays and travel advice. They receive what the search requires (the destination, the dates, the number of travellers and, for a room, the age of the children), and never your e-mail address or any account identifier, with one exception: the session opened with the seller for a Pro subscriber, described above. For activities and restaurants they also receive keywords drawn from your criteria: an interest, a type of cuisine. Your sentences do not leave us: only our artificial intelligence provider reads them. Take this from it: if a criterion is what the previous section calls sensitive data, writing "no pork" may send it to a restaurant source. Each has its own terms.
City photos
To illustrate the cities where you sleep, three at most, our server picks a photo of each among the freely licensed images on Wikimedia Commons, copies it and serves it from xyvel.ch. To find it, the server queries Wikimedia (Wikidata and Commons) with the city's name, its country and the language of the page; never with your IP address, your account or anything you have written. Our artificial intelligence provider may help settle between candidates: it then receives only the city's name and public material, namely the candidate images or, when the name fits several places, their Wikidata entries. Your browser, for its part, does not contact Wikimedia to display these photos: neither your IP address nor any other data from your browser reaches it, unless you open the link to a file's page. Where the licence requires it, the photo carries its author's name and its licence; the full list of a programme's photos, each linked to its file page, sits under the programme.
Technical logs
Like any online service, our hosts (one for the site, one for the server) keep request logs containing an IP address, a timestamp and the path requested. These logs serve security and correct operation, nothing else; we can access them for seven days at most, and our hosts keep them under their own rules. We also use the IP address to rate-limit requests (sign-in codes, subscription starts, use of the planner): that is what stops someone from flooding your inbox or exhausting the service. It stays in the server's memory, never written to our database, for two hours at most; for the free programme, we instead keep a fingerprint of the address, computed with a secret key, for seven days at most, to limit the number of free programmes opened from one connection. Restarting the server erases it all. We also keep anonymous totals, by day and, for visits, by hour, to run the service and fix its flaws: how many visits reach the XYVEL Trip pages (landing page, language, and where the visit came from, reduced to a category: search engine, social network, Product Hunt, direct access or other) and how many times the steps of the service are reached (sign-in code, sign-in and account creation, programme started, delivered or failed, messages, access refused or reserved for subscribers, payment, click on a booking or service link). This count rests on our legitimate interest in running and improving the service (art. 6(1)(f) GDPR). The IP address is neither used nor kept for this count, apart from in memory, for two minutes at most, to limit the pace of requests, as described above; nothing links a total to a person.
Data in your browser
Your browser keeps the device sign-in token, the language you chose (in local storage and in a one-year cookie, the only one the site sets), the text of the request you are writing (in this tab only, erased when you send it or close the tab) and, in the page address, the trip you have open. Signing out erases the token. None of this is used to follow you from one site to another; the draft does not leave your browser before you send it.
Your rights
You can request access to your data, its correction, its deletion, a copy in a machine-readable format, a restriction of processing, or object to it. You can withdraw a consent at any time, without calling into question what was done before. Write to contact@xyvel.ch: we answer within one month (art. 25 para. 7 FADP, art. 12 §3 GDPR). You can also act alone and immediately: delete each trip from the application, sign out to revoke the device token, and ask for the account itself to be deleted. The customer account created with the seller is not deleted by XYVEL, which has no technical means to do so: ask the seller from its booking page. A browser that sends the Global Privacy Control or Do Not Track signal is not counted among the visits. The totals contain nothing that can be linked to a person. If our answer does not satisfy you, you may refer the matter to the Swiss Federal Data Protection and Information Commissioner (FDPIC, Bern) or, if you live in the European Union, to the supervisory authority of your country.