Privacy Policy

1. Controller

Email: hello@mevaya.eu

2. What we process, and why

Account data

When you create an account we store your email address, a hashed password and the display name you choose. This is necessary to give you a login and to associate your saved plans and passes with you. Legal basis: Art. 6 (1) (b) GDPR — performance of a contract.

Plans and trips

City, date and the stops in the day plans you save are stored so you can return to them. Building a plan without an account does not create a stored record tied to you. Legal basis: Art. 6 (1) (b) GDPR.

Purchases

We store the order (product, amount, date, the cities it unlocks) and the identifier of the corresponding payment at our payment provider. We never receive or store your card number. Legal basis: Art. 6 (1) (b) GDPR, and Art. 6 (1) (c) GDPR for the retention periods German tax law imposes on invoice-relevant records.

Support reports

If you send a report through the help page, we store the topic and message text so we can investigate. Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in correcting errors in our data.

Server logs and abuse prevention

Our hosting provider processes technical request data (including IP address) to deliver the site and to rate-limit abusive traffic. Legal basis: Art. 6 (1) (f) GDPR.

3. Processors

We use the following providers, each under a data processing agreement:

• Supabase — database, authentication and storage of account, plan and order records.
• Vercel — hosting and delivery of the website.
• Stripe — payment processing. Stripe acts as an independent controller for the payment data it collects; see stripe.com/privacy.
• Resend — delivery of transactional email (account and purchase confirmations).

Where a provider offers EU-region hosting we select it. Where data is transferred outside the EU/EEA, the transfer is covered by the European Commission’s standard contractual clauses.

4. How long we keep things

Account, plan and trip data are kept for as long as your account exists and are deleted when you delete it. Order and invoice records are kept for the statutory retention period under German commercial and tax law, currently ten years, even after account deletion — we are required to keep them and cannot delete them earlier.

5. Your rights

Under Art. 15 to 21 GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted, subject to the retention periods above;
• restrict processing;
• receive your data in a portable format;
• object to processing based on legitimate interest.

You can export your data and delete your account from your account page, or write to hello@mevaya.eu.

6. Complaints

You have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work, or the place of the alleged infringement.

7. Cookies

We set a session cookie when you sign in, which is required for the site to work and does not need consent. We do not use advertising or cross-site tracking cookies.