Privacy Policy

When you plan a trip with Iovago, you trust us with addresses, documents and sometimes personal details about your fellow travelers. This policy explains, in plain terms, what data we collect, how the AI concierge uses it, and what rights you have over it, in compliance with Regulation (EU) 2016/679 ("GDPR"). It is issued by Iovago, a service by IA'M, a brand owned by LP Holding S.r.l. a Socio Unico ("we").

1. Data controller

The data controller is LP Holding S.r.l. a Socio Unico, registered office at Vicolo Molino 9, 12044 Centallo (CN), Italy, VAT IT 04005150042, certified email (PEC) lpholding@pec.lpholding.srl. For any privacy request: privacy@iovago.app.

2. Data we collect

• Account data: name, email address, login credentials, preferred language.
• Trip data: itineraries, bookings, participants (including any minors added by a responsible adult), notes, expenses and lists you create in the app.
• Uploaded documents: tickets, booking confirmations and other documents you choose to send to the concierge, which may contain sensitive data (e.g. passport numbers). See Data Security.
• Conversations with the concierge: the messages you write, the AI-generated replies and their timestamps.
• Technical and usage data: access logs, device type, aggregated usage data and error reports.
• Beta waitlist: if you leave your email on the beta program page, we use it only to notify you when the service opens.

3. Special categories of data

Iovago is not designed to collect special categories of personal data (Art. 9 GDPR), such as health status, ethnic origin, religious beliefs or sexual orientation. If you share them yourself in messages to the concierge, for example a dietary requirement tied to religion, a mobility need at the airport, or a medical condition relevant to the trip, you give us explicit consent (Art. 9(2)(a) GDPR) to process them to the extent strictly necessary to fulfil that request. We do not use them to build profiles, for advertising, or for any purpose other than the one you shared them for, and you can ask for their deletion at any time by writing to privacy@iovago.app.

4. How we use artificial intelligence

The Iovago concierge is powered by Anthropic's Claude models. Here is, transparently, what happens when you use it.

You're always talking to an AI

When you write to the concierge or forward it a document, you are always interacting with an artificial intelligence system, not a person. The concierge reads your messages and the documents you upload to extract flights, hotels and activities, build your day-by-day itinerary, and suggest a few ideas when a day is still light.

Your data doesn't train the models

Messages and documents you send to the concierge are processed by Anthropic as a data processor (Art. 28 GDPR), under an agreement that limits the use of your data to providing the service: they are not used to train or fine-tune the AI models, nor retained by Anthropic beyond what's needed to generate the response.

No decision is made by an algorithm

The concierge suggests: you always confirm what goes into your itinerary. We do not make automated decisions that produce legal effects or significantly affect you (Art. 22 GDPR).

AI can make mistakes

Information extracted or suggested by the concierge may contain inaccuracies. Always check times, dates, amounts and requirements (e.g. visas) against official documents before you travel.

5. Legal basis for processing

Purpose	Legal basis
Providing the service: account, itineraries, AI concierge	Art. 6(1)(b) GDPR — performance of a contract
AI processing of documents and messages sent to the concierge	Art. 6(1)(b) GDPR — performance of a contract
Special category data you voluntarily share with the concierge	Art. 9(2)(a) GDPR — explicit consent
Security, abuse prevention, technical logs	Art. 6(1)(f) GDPR — legitimate interest
Beta waitlist and communications about Iovago	Art. 6(1)(a) GDPR — consent
Billing and tax compliance	Art. 6(1)(c) GDPR — legal obligation

6. How long we keep data

• Account, trips and conversations with the concierge: for as long as your account is active.
• Upon account deletion, personal data and documents are removed within 30 days, unless the law requires otherwise (e.g. billing).
• Technical security logs: for a limited period, needed to detect and prevent abuse.
• Beta waitlist emails: until the service opens or you request deletion.

7. Who we share data with

We do not sell your data. We share it only with technical providers bound by data processing agreements, with the other participants of the trips you choose to join, and, where required by law, with the relevant authorities. The main providers we rely on are:

• Google Cloud / Firebase (Google LLC): database and file storage, entirely in European Union data centers (multi-regions eur3 and eur4); part of the application processing (Cloud Functions) takes place in the United States.
• Anthropic PBC (USA): AI processing of the messages and documents sent to the concierge, in the United States.
• FormSubmit: forwards the email address you leave on the beta waitlist page; it receives no other data.
• Payment providers: once in-app payments are live, to process subscriptions; your card data never transits through or is stored on our servers.

8. International transfers

Transfers to the United States (Cloud Functions and Anthropic's AI processing) rely on Standard Contractual Clauses (Art. 46 GDPR) and the data processing agreements in place with each provider. Data is processed, not stored, outside the European Union.

9. Your rights

Under Articles 15–22 GDPR, you have the right to:

• Access: know which data we process about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request the removal of your data, including by deleting your account directly in the app.
• Restriction: ask us to temporarily suspend processing.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on our legitimate interest.
• Withdraw consent: withdraw any previously given consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

You can exercise these rights by writing to privacy@iovago.app; we respond within the timeframe required by law (typically one month). You also have the right to lodge a complaint with your supervisory authority.

10. Minors

Iovago is not designed to be used independently by anyone under 18. Profiles of minors participating in a trip can only be added by a parent or guardian who holds the account and remains responsible for that data.

11. Changes

Material changes to this policy will be communicated via email or in the app.