Privacy policy
Last updated: 13 July 2026
1. Data controller
The data controller for heyotti.com is Xavier Boubés Bargalló (Spanish tax ID 46454627D). For any privacy question or to exercise your rights, write to hola@heyotti.com.
2. What data we process
We only process the data needed for the planner to work:
- Anonymous session identifier: a random code stored in your browser that links your trips to your device, with no sign-up required.
- Email, if you choose to verify it to generate more reports or receive them by email; and your name and profile picture if you sign in with Google.
- Your trip data: destinations, dates, preferences (traveller type, interests, budget, mobility), selected activities and generated itineraries.
- Technical anti-abuse data: a hash (irreversible digest) of your IP address to enforce reasonable usage limits.
- Usage events: our own aggregated metrics (e.g. "report generated") to understand how the service is used. We do not use third-party analytics tools.
- Delivery status of emails we send you (delivered, bounced), to diagnose delivery problems.
- Messages you send us through the feedback box or by email.
3. Purposes and legal bases
- Providing the service (planning, saving your trips, generating reports): performance of the usage contract.
- Sending you emails (verification code, your report): your consent, given when you provide your email.
- Preventing abuse of the service (usage limits): legitimate interest in protecting the platform.
- Improving the product with our own aggregated metrics: legitimate interest.
We do not use your data for advertising, and we never sell it.
4. Who we share data with
To operate, HeyOtti relies on providers acting as data processors or as independent services:
- Microsoft Azure: hosting of the application and database, email delivery (Azure Communication Services) and part of the AI models.
- Google: Google Sign-In (only if you use it), maps and place data (Google Maps/Places) and AI models (Google Cloud Vertex AI).
- AI providers (Google Cloud, Microsoft Azure, Anthropic, depending on configuration): they receive the trip data needed to generate recommendations and texts (destinations, dates, preferences, activities). They do not receive your email or your identity.
- Activity and accommodation providers (Viator, Tiqets, Stay22): we query their catalogue by destination and dates; we send them no personal data about you. If you click to book, you move to their website and their own policies apply.
- Open-Meteo (weather forecasts): it only receives destination coordinates and dates, no personal data.
5. Affiliate links
Links to activity, accommodation and transport providers are affiliate links: if you book through them, HeyOtti may earn a commission at no extra cost to you. The link includes an affiliate identifier that lets the provider attribute the booking; it does not transmit your HeyOtti identity.
6. How long we keep your data
We keep your trips and reports while you use the service. You can request deletion of your account and all its data at any time by writing to hola@heyotti.com. Technical anti-abuse data and usage events are kept for limited periods, in aggregated or pseudonymised form.
7. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to hola@heyotti.com. We will reply as soon as possible and, in any case, within the legal deadlines.
If you believe we have not handled your data correctly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es) or your local supervisory authority.
8. International transfers
Some of our providers (Microsoft, Google, Anthropic) are headquartered in the United States. Transfers are covered by the EU-US Data Privacy Framework and/or standard contractual clauses approved by the European Commission.
9. Cookies and local storage
HeyOtti uses no tracking or advertising cookies of its own. We store in your browser’s local storage only strictly necessary data: your anonymous session identifier and your preferred language.
Some integrated third-party services may set their own cookies when you use them: the map (Google Maps) and the "Continue with Google" button. They are governed by Google’s privacy policy.
10. Minors
HeyOtti is not aimed at children under 14. If we detect data from a minor without their guardians’ consent, we will delete it.
11. Changes to this policy
If we change this policy, we will update the date on this page. If the change is significant and we have your email, we will let you know.