Privacy Policy

Last updated: 23 October 2026

1. Controller and contact

Hein Gerrit Alberto Agel · Vivago
Hüttenstraße 45, 40215 Düsseldorf, Germany
info@vivago.net · Telephone +49 152 23932129

This notice explains purposes, legal bases, recipients and retention. Account details are necessary for an account, and contract and payment details for a paid contract. Without them the corresponding services cannot be supplied. Consent to optional analytics is not required.

2. Website operation and hosting

The application is hosted with Hetzner Online GmbH in Germany. Requests involve IP addresses, timestamps, requested addresses, and browser and technical connection information. Processing enables delivery, reliable operation and protection against abuse under Article 6(1)(f) GDPR; our legitimate interests are a secure, functioning service.

Operational and error logs are overwritten on a rolling basis. Retention depends on log volume and the need to investigate faults or security incidents. Relevant extracts may be retained until an investigation is complete. We do not promise blanket IP anonymisation of all server logs.

3. Accounts and emails

We process email addresses, usernames, optional names, secure password hashes rather than plaintext passwords, verification status, account and login timestamps, and settings. Registration/login information including IP addresses and technical rate limits may be processed to prevent abuse.

The legal bases are Article 6(1)(b) GDPR for providing accounts and Article 6(1)(f) for security. Technical factors such as email verification and account age may affect review trust weights. This is not a solely automated decision producing legal or similarly significant effects under Article 22 GDPR.

Transactional messages, including verification, password reset and contract emails, are sent using Resend (Resend, Inc., USA). Recipient addresses, message contents and necessary delivery information are processed under Article 6(1)(b), (c) or (f), depending on the purpose. No newsletter is currently offered. The application does not add its own open-tracking pixels or analytics link redirects to these messages.

Provider information: Resend privacy, Resend DPA.

4. Reviews, location and preferences

Review processing includes criterion values, optional comments, selected map coordinates, timestamps, status, weighting and account association. Published contributions and aggregated map results are accessible to other users. A username may be displayed with individual contributions. Do not publish confidential information or other people's personal data.

If you activate browser location access, coordinates may be used for map positioning and, where applicable, location checks. Permission can be withdrawn in browser or device settings. Technical browser permission does not replace information about subsequent processing.

Legal bases are Article 6(1)(b) GDPR for requested map, review and saved-preference features, and Article 6(1)(f) for abuse prevention and aggregated results. Voluntary location access is based on Article 6(1)(a). Filters, weights and display preferences may be stored in your account or on your device.

The methodology explains synthetic starting data and limits of interpretation.

5. External map services and libraries

Your browser requests background map images from CARTO. The provider receives IP addresses and technical request details. Requested tiles reveal the map area being viewed. The URL contains our public basemap API key, not your account credentials. The provider is CartoDB, Inc. (CARTO). See CARTO privacy.

Place queries use the OpenStreetMap Foundation's public Nominatim service. Search terms or coordinates and technical connection data are transmitted to that service. Do not enter confidential personal information in searches. See OSMF privacy.

Processing is based on Article 6(1)(b) GDPR for expressly requested map/search functions and Article 6(1)(f) for providing the public interactive map; our legitimate interest is a usable geographic display. These providers do not receive your Vivago login credentials through these requests.

Interface JavaScript and CSS libraries are served by Vivago itself. Google Web Fonts are not embedded as an external font service.

6. Payments and contract declarations

Payments use Stripe Payments Europe, Limited, Ireland, and the Stripe entities responsible for the particular payment. Stripe receives contact, billing, payment and transaction information. We retain contract status, plan, term, Stripe references and payment records, not full card or account access credentials. Legal bases are Article 6(1)(b) and Article 6(1)(c) GDPR for statutory retention. See Stripe privacy for its own responsibilities and transfers.

For cancellation and withdrawal declarations, we process name, email, contract reference, declaration and receipt timestamp, plus a termination reason or requested date where applicable. No account sign-in is required. Processing enables receipt, confirmation, contract administration and evidence under Article 6(1)(b) and (c), particularly sections 312k and 356a BGB.

Receipts are accessible through an unlisted random access token. Anyone with the link can view the receipt, so keep it confidential. The receipt view loads no analytics or external services.

7. Cookies and device storage

Necessary cookies secure sessions and forms and retain expressly selected language, country or consent preferences. Necessary device access is based on section 25(2) TDDDG; subsequent processing relies on Article 6(1)(b), (c) or (f) GDPR as appropriate.

sessionid: sessions and sign-in, normally up to 14 days;
csrftoken: protection against forged form submissions, normally up to approximately one year;
django_language, vivago_country: selected language or country, up to one year;
vivago_consent: consent preferences, up to 365 days.

Local storage may retain map display and interaction preferences until reset or deleted in the browser. Session storage ends with the browser session. Storage for optional analytics requires prior consent under section 25(1) TDDDG and Article 6(1)(a) GDPR.

We use self-hosted Klaro for consent management. You can change preferences through “Cookies” in the site navigation. Rejecting optional services does not prevent browsing, cancellation or withdrawal. Withdrawing consent does not affect the lawfulness of earlier processing.

Only with the relevant consent does Vivago's own product analytics record defined events such as map views or starting a review. Records contain the event, timestamp, page path without query parameters, limited feature information, a pseudonymous session identifier and, where signed in, potentially an account association. These data are not anonymous.

The legal basis is Article 6(1)(a) GDPR. These event records are automatically deleted after no more than 395 days and are used to understand usability and improve the service, not as a condition for entering a contract.

9. Google Analytics

With consent to “Google Analytics”, we load Google Analytics from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Usage events, page views, device/browser information and identifiers are processed. Connections for this analytics service start only after consent. Legal bases are section 25(1) TDDDG and Article 6(1)(a) GDPR.

Google Analytics cookies such as _ga and _ga_* may be stored for up to two years. Event retention and longer-term aggregated reporting additionally depend on Google Analytics account settings and deletion rules. You can request information about the particular account settings. Cookie duration must not be equated with server-side retention.

Withdraw consent using “Cookies”. You may also use Google's browser add-on or browser protection features. See Google privacy and Google Analytics processing terms.

Google Ads conversion tracking, Google AdSense advertising, newsletter marketing, Google sign-in and AWS storage are not activated in the audited production configuration. Information and, where necessary, consent must be updated before enabling further services.

10. Recipients and transfers outside the EEA

Authorised persons working for the controller and necessary hosting, email, map, analytics and payment providers may receive data. Providers outside the EEA, particularly Resend, CARTO and, where applicable, Google and Stripe, may involve transfers to countries such as the USA.

Transfers require a basis under Chapter V GDPR, such as an applicable adequacy decision for covered recipients or appropriate safeguards including EU standard contractual clauses and any necessary supplementary measures. Merely naming a provider or the EU-US Data Privacy Framework does not establish certification or coverage of the particular processing. Information about safeguards used for a particular recipient and copies can be requested through the contact above.

11. Retention and erasure

Account data remain necessary for operating the account until it is actually deleted. Technical account deactivation is not full erasure. Send deletion requests to info@vivago.net. We also assess reviews, account associations and other personal information and erase or anonymise them unless overriding legal grounds require retention.

Support, complaint and moderation records are retained until handling is complete and, where necessary, to establish or defend specific claims. Contract evidence may be needed during the ordinary three-year limitation period starting at the end of the relevant year. Tax records follow document-specific statutory periods, particularly normally eight years for accounting vouchers; other mandatory periods remain applicable. Data must then be erased unless another documented retention ground applies.

12. Your rights

Subject to statutory conditions, you have rights of access (Article 15), rectification (16), erasure (17), restriction (18) and portability (20 GDPR). Consent can be withdrawn at any time for future processing.

Objection: You may object to processing under Article 6(1)(e) or (f) on grounds relating to your particular situation under Article 21 GDPR. You may object to direct marketing at any time without giving reasons.

You may complain under Article 77 GDPR to a supervisory authority, particularly where you live, work or consider an infringement to have occurred. The authority for our establishment is the North Rhine-Westphalia Commissioner for Data Protection and Freedom of Information, Postfach 20 04 44, 40102 Düsseldorf, Germany.