Privacy Policy

This policy describes how Iovago, a service by IA’M, a brand owned by LP Holding S.r.l. a Socio Unico ("we"), collects, uses and protects users' personal data, in compliance with Regulation (EU) 2016/679 ("GDPR").

1. Data controller

The data controller is LP Holding S.r.l. a Socio Unico, registered office at Vicolo Molino 9, 12044 Centallo (CN), Italy, VAT IT 04005150042, certified email (PEC) lpholding@pec.lpholding.srl. For any privacy request: privacy@iovago.app.

2. Data we collect

• Account data: name, email address, login credentials.
• Trip data: itineraries, bookings, participants, notes, expenses and lists you create in the app.
• Uploaded documents: tickets, booking confirmations and other documents you choose to send to the concierge, which may contain sensitive data (e.g. passport numbers). See Data Security.
• Technical data: access logs, device type and aggregated usage data.

3. How we use data and AI

Documents and messages you send to the concierge are processed via Anthropic's Claude AI models, for the sole purpose of extracting travel information (flights, hotels, activities) and assisting you. Data sent to AI providers is handled under GDPR-compliant data processing agreements and is not used to train the models.

4. Legal basis

We process data to perform the contract (providing the service), to comply with legal obligations and, with your consent, for marketing communications. You can withdraw consent at any time.

5. Retention

Data is retained while your account is active. Upon account deletion, personal data and documents are removed within [30] days, unless the law requires otherwise.

6. Sharing and extra-EU transfers

We do not sell your data. We share it only with: technical providers (hosting, AI processing, payments) bound by processing agreements; the other participants of the trips you choose to join; authorities, where required by law.

The main data processors we rely on are:

• Google Cloud / Firebase (Google LLC): database and file storage, entirely in European Union data centers (multi-regions eur3 and eur4); part of the application processing (Cloud Functions) takes place in the United States.
• Anthropic PBC (USA): AI processing of the messages and documents sent to the concierge, in the United States.

Transfers to the United States are based on Standard Contractual Clauses (Art. 46 GDPR) and the data processing agreements in place with each provider. Data is processed, not stored, outside the EU.

7. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection (Articles 15–22 GDPR). You can exercise them by writing to privacy@iovago.app or delete your account directly in the app. You also have the right to lodge a complaint with your supervisory authority.

8. Changes

Material changes to this policy will be communicated via email or in the app.