Privacy Policy

Last updated: February 8, 2026

1. Data Controller

Itinera Planner is operated by a company based in Croatia, European Union. For the purposes of the General Data Protection Regulation (GDPR) and applicable data protection laws, we act as the Data Controller for your personal data.

Contact: support@saasykit.com

2. Categories of Personal Data We Collect

We collect and process personal data from two categories of individuals:

Agency Users (our customers):

• Account information: name, email address, company name
• Billing information: payment details processed by Stripe (we do not store card numbers)
• Usage data: login activity, feature usage, AI token consumption
• Agent configuration: custom agent settings, prompts, and business information you provide

End Users (visitors to your agents):

• Chat conversations with AI agents
• Technical data: IP address (anonymized), browser type, device information
• Any personal information voluntarily shared during conversations

3. Legal Bases for Processing

We process your personal data based on the following legal grounds under GDPR:

Contract Performance (Article 6(1)(b)): Processing necessary to provide our services, manage your subscription, and deliver AI agent functionality.

Legitimate Interests (Article 6(1)(f)): Processing for service improvement, security monitoring, fraud prevention, and analytics. We balance our interests against your rights and freedoms.

Consent (Article 6(1)(a)): Where required, such as for marketing communications. You may withdraw consent at any time.

Legal Obligations (Article 6(1)(c)): Processing required to comply with tax, accounting, and other legal requirements.

4. Third-Party Services and Data Processors

We use the following third-party services to operate Itinera Planner:

• OpenAI (USA): AI language model provider for agent conversations. OpenAI processes conversation data to generate responses. OpenAI does not use data submitted via API to train their models.
• Stripe (USA): Payment processing. Stripe handles all payment card data under PCI-DSS compliance.
• Cloudflare (USA): CDN, DDoS protection, and security services.
• Mailgun (USA): Transactional email delivery.
• Laravel Forge / DigitalOcean (USA/EU): Server infrastructure and hosting.

5. International Data Transfers

Some of our service providers are located in the United States. For transfers of personal data outside the European Economic Area (EEA), we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements with appropriate safeguards
• Privacy frameworks and certifications where applicable

You can request copies of relevant safeguards by contacting us.

6. Data Retention

We retain personal data for the following periods:

• Account data: Duration of your account plus 30 days after deletion request
• Billing records: 7 years (legal requirement for tax purposes)
• Chat conversations: 90 days, unless you configure shorter retention
• Server logs: 30 days
• Analytics data: 26 months (aggregated and anonymized)

7. Your Rights Under GDPR

As a data subject in the EU, you have the following rights:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate personal data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Restrict Processing: Limit how we use your data
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at support@saasykit.com. We will respond within 30 days.

You also have the right to lodge a complaint with your local data protection authority.

8. AI and Your Data

Important: Conversations processed through our AI agents are sent to OpenAI's API to generate responses. OpenAI's API data usage policy states that data submitted through the API is not used to train their models.

Your agent configurations, business information, and conversation data are used solely to provide the service you requested. We do not sell your data or use it for advertising purposes.

9. Cookies and Tracking

We use essential cookies required for the service to function (authentication, session management). We may use analytics cookies with your consent to improve our service.

10. Security

We implement appropriate technical and organizational measures to protect your personal data, including encryption in transit (TLS), secure server infrastructure, access controls, and regular security reviews.

11. Children's Privacy

Our service is not intended for individuals under 18 years of age. We do not knowingly collect personal data from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through our service. Continued use of the service after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at support@saasykit.com.