Privacy policy
Last updated: 13 July 2026
1. Data controller
The data controller for heyotti.com is Xavier Boubés Bargalló (Spanish tax ID 46454627D). For any privacy question or to exercise your rights, write to hola@heyotti.com.
2. What data we process
We only process the data needed for the planner to work:
- Anonymous session identifier: a random code stored in your browser that links your trips to your device, with no sign-up required.
- Email, if you choose to verify it to generate more reports or receive them by email; and your name and profile picture if you sign in with Google.
- Your trip data: destinations, dates, preferences (traveller type, interests, budget, mobility), selected activities and generated itineraries.
- Technical anti-abuse data: a hash (irreversible digest) of your IP address to enforce reasonable usage limits.
- Usage events: our own metrics (e.g. "report generated") to understand how the service is used. We do not use third-party analytics tools.
- Where your visit came from: if you arrive through one of our campaign links, that link’s parameters (social network, campaign and post); otherwise the domain you came from (e.g. "instagram.com"), never the full address of the previous page.
- Delivery status of emails we send you (delivered, bounced), to diagnose delivery problems.
- Messages you send us by email.
3. Purposes and legal bases
- Providing the service (planning, saving your trips, generating reports): performance of the usage contract.
- Sending you emails (verification code, your report): your consent, given when you provide your email.
- Preventing abuse of the service (usage limits): legitimate interest in protecting the platform.
- Improving the product with our own aggregated metrics: legitimate interest.
We do not use your data for advertising, and we never sell it.
4. Who we share data with
To operate, HeyOtti relies on providers acting as data processors or as independent services:
- Microsoft Azure: hosting of the application and database, email delivery (Azure Communication Services) and part of the AI models.
- Google: Google Sign-In (only if you use it), maps and place data (Google Maps/Places) and AI models (Google Cloud Vertex AI).
- AI providers (Google Cloud, Microsoft Azure, Anthropic, depending on configuration): they receive the trip data needed to generate recommendations and texts (destinations, dates, preferences, activities). They do not receive your email or your identity.
- Activity and accommodation providers (Viator, Tiqets, Stay22): we query their catalogue by destination and dates; we send them no personal data about you. If you click to book, you move to their website and their own policies apply.
- Open-Meteo (weather forecasts): it only receives destination coordinates and dates, no personal data.
- Wikimedia / Wikipedia: source of the city photos shown in the planner and in your trip list.
- Google Fonts: the site’s typefaces are loaded from Google’s servers.
Note that the images shown (activity photos, maps, city photos, typefaces) are downloaded by your browser directly from those services, so they learn your IP address and browser type, even though we send them neither your identity nor your trip data.
5. Affiliate links
Links to activity, accommodation and transport providers are affiliate links: if you book through them, HeyOtti may earn a commission at no extra cost to you. The link includes an affiliate identifier that lets the provider attribute the booking; it does not transmit your HeyOtti identity.
6. How long we keep your data
We keep your trips and reports while you use the service. You can request deletion of your account and all its data at any time by writing to hola@heyotti.com. Usage events are deleted automatically after 12 months, except the minimal record of generated reports, which we keep while the account exists because it is what enforces the free allowance. Technical anti-abuse data is stored pseudonymised (an IP hash) and for short periods.
7. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to hola@heyotti.com. We will reply as soon as possible and, in any case, within the legal deadlines.
If you believe we have not handled your data correctly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es) or your local supervisory authority.
8. International transfers
Some of our providers (Microsoft, Google, Anthropic) are headquartered in the United States. Transfers are covered by the EU-US Data Privacy Framework and/or standard contractual clauses approved by the European Commission.
9. Cookies and local storage
HeyOtti uses no tracking or advertising cookies of its own. We store the following in your browser’s local storage:
- Anonymous session identifier and preferred language: required for the service to work and to recover your trips on this device.
- Where your visit came from (campaign parameters of the link you arrived through, or the referring domain) so we know which channels work. This is first-party measurement: it is not shared with anyone and we do not track your browsing on other sites.
- Interface preferences: whether you have seen the planner tour, and which variant of a design test you were assigned.
- Technical cache of city images, to avoid downloading them again.
Some integrated third-party services may set their own cookies when you use them: the map (Google Maps) and the "Continue with Google" button. They are governed by Google’s privacy policy.
10. Minors
HeyOtti is not aimed at children under 14. If we detect data from a minor without their guardians’ consent, we will delete it.
11. Changes to this policy
If we change this policy, we will update the date on this page. If the change is significant and we have your email, we will let you know.