Privacy Policy

Last updated: May 1, 2026

Welcome to Aimee. We are committed to protecting your personal data in accordance with the EU General Data Protection Regulation (GDPR) and Dutch data protection laws.

1. Who We Are

For privacy-related questions, data requests, or concerns, contact info@aimee.travel.

2. What Personal Data We Collect

We collect only the information necessary to provide and improve Aimee's services. The data we collect depends on how you use Aimee and what permissions you grant.

2.1 Information You Provide Directly

Account Information:

• Email address
• Password, processed securely and never visible to us in plain text
• Display name, optional
• Age verification confirming you are 16 or older

Profile Information:

• Country or region
• Travel preferences
• Activity constraints
• Companion information

Conversations with Aimee:

• Your questions, requests, links, and feedback when interacting with our AI assistant
• Activities you've saved, liked, or marked as completed
• Ratings and reviews you provide

Payment Information:

• Billing name and address
• Payment card details processed securely by Stripe, with no full card numbers stored by us

2.2 Information We Collect Automatically

Device and Usage Data:

• Device type, operating system, and app version
• IP address used to determine approximate location or region
• How you use Aimee, including features clicked, time spent, and frequency of use
• Error logs and crash reports

Cookies and Similar Technologies:

• See our Cookie Policy for details
• We use essential cookies for functionality and, with your consent, analytics cookies

2.3 Information We Collect With Your Permission

Location Data:

• Precise location through GPS coordinates when you use near-me features
• Approximate location at city or region level from IP address, which is always collected
• Location history for places you've visited if you mark activities as completed

You can enable or disable location access anytime in your device settings or Aimee app settings.

Calendar Data:

• Free and busy times only
• We do not access event names, attendees, locations, or descriptions

You can disconnect calendar access anytime in Aimee settings.

Photo or Media Access:

• Only if you choose to upload photos to activities or share trip memories
• We do not access your photo library without explicit permission

3. How We Use Your Personal Data

3.1 To Provide Aimee's Core Services

Legal basis: Contract. We use your data to create and manage your account, generate personalized activity suggestions and itineraries, remember your preferences and past activities, process payments, and provide customer support.

3.2 To Improve and Personalize Your Experience

Legal basis: Consent. We analyze your activity preferences to improve suggestions over time, learn patterns, and build a profile of your interests to tailor recommendations.

You explicitly consent to AI learning during onboarding. You can view what Aimee has learned about you, edit or delete any preference or pattern, or opt out of AI learning entirely and receive generic suggestions instead.

3.3 To Improve Our Service

Legal basis: Legitimate Interest. We analyze aggregated, anonymized usage patterns, fix bugs, improve app performance, and conduct research to develop new features.

You can object to this processing at any time by emailing info@aimee.travel.

3.4 To Communicate With You

Essential communications are sent under legitimate interest and include account security alerts, service updates, and responses to support requests.

Optional communications are sent only with consent and may include weekly inspiration, tips for using Aimee, and partner offers.

You can unsubscribe from optional emails anytime via the unsubscribe link in every email or via Settings → Notifications in the app.

3.5 For Legal Compliance

Legal basis: Legal Obligation. We may use your data to comply with court orders, legal processes, or regulatory requirements, and to prevent fraud, enforce our Terms of Service, or protect rights and safety.

4. Legal Bases for Processing

Under GDPR, we must have a lawful basis to process your personal data. The main bases we rely on are Contract, Legitimate Interest, Consent, and Legal Obligation.

Your consent rights:

• Consent can be withdrawn at any time
• Withdrawal does not affect processing done before withdrawal
• You can still use Aimee if you withdraw consent for optional features

5. Who We Share Your Data With

We never sell your personal data.

We only share data with trusted partners who help us operate Aimee, and only to the extent necessary.

5.1 Service Providers and Processors

AI and Technology Infrastructure:

• OpenAI powers Aimee's AI suggestions
• Receives your conversations with Aimee, pseudonymized where possible
• We do not allow OpenAI to use your data to train general models

Hosting and Cloud Services:

• AWS EU and Google Cloud EU store app data
• Data is stored on EU-only servers in Amsterdam or Frankfurt regions

Maps and Location Services:

• Google Maps API provides maps and location search

Calendar Integration:

• Google Calendar API reads free and busy times only if you connect it

Payment Processing:

• Adyen processes subscriptions and payments
• We never see your full card number

Analytics:

• PostHog tracks app usage patterns if you consent

Email Communications: Sender sends transactional and marketing emails on our behalf.

5.2 Third-Party Booking Partners

When you choose to book through Aimee's affiliate links, booking details may be shared with services such as Booking.com, GetYourGuide, Travelpayouts, TheFork, Tiqets, Civitatis, Fever, DesignMyNight, Viator, OpenTable, Ticketmaster, and Eventbrite.

Their privacy policies apply once you leave Aimee, and we may receive commission if you complete a booking at no extra cost to you.

5.3 Legal Requirements

We may disclose your data if required by law, including court orders, regulatory investigations, or to prevent fraud or protect safety.

6. International Data Transfers

Some of our service providers are located outside the European Economic Area, primarily in the United States.

For transfers outside the EEA, we use EU Standard Contractual Clauses approved by the European Commission to require recipients to protect your data at EU standards.

• OpenAI: SCCs and zero data retention mode
• Google: SCCs and encryption in transit and at rest
• Stripe: SCCs and PCI-DSS compliance

If you object to data transfers outside the EEA, certain features such as AI suggestions or payment processing may not be available.

7. How Long We Keep Your Data

We retain personal data only as long as necessary for the purposes described in this policy and in compliance with legal requirements.

7.1 Active Accounts

While your account is active:

• Account information: stored indefinitely while you use Aimee
• Activity preferences and history: 18 months, then anonymized
• Location history: 12 months
• Chat conversations with Aimee: 12 months, anonymized after 6 months

7.2 Inactive Accounts

• After 18 months of inactivity, we email you asking if you want to keep your account
• After 24 months of inactivity, the account is automatically deleted unless you log in
• You can reactivate by logging in before deletion

7.3 Deleted Accounts

• Personal data is deleted within 30 days
• Some data may be retained for legal compliance, such as payment records for tax purposes for 7 years
• Anonymized analytics data may be retained because it cannot be linked back to you

7.4 Specific Data Retention Periods

8. Your Rights Under GDPR

You have the following rights regarding your personal data. To exercise any of these rights, contact info@aimee.travel or use the in-app tools.

8.1 Right to Access

You can request a copy of the personal data we hold about you. Use Settings → Privacy & Data → Download My Data, or contact us by email.

8.2 Right to Rectification

You can correct inaccurate or incomplete data through your profile settings or by contacting us.

8.3 Right to Erasure

You can request deletion of your personal data through Profile → Delete My Account. Some data may be retained for legal compliance.

8.4 Right to Restrict Processing

You can stop certain uses of your data, such as pausing AI learning, location tracking, or analytics.

8.5 Right to Data Portability

You can get your data in a portable JSON or CSV format to transfer to another service through Settings → Privacy & Data → Export Data.

8.6 Right to Object

You can object to specific processing, including marketing, AI learning, or analytics. Marketing emails can be stopped with the unsubscribe link in any email.

8.7 Right to Withdraw Consent

You can withdraw consent for location, calendar, and marketing at any time through device settings, app settings, or email unsubscribe links.

8.8 Right to Lodge a Complaint

You may file a complaint with the Dutch Data Protection Authority at autoriteitpersoonsgegevens.nl.

How to Exercise Your Rights

The fastest way is through the in-app tools at Profile → Settings → Privacy & Data → Contact Us. You can also send an email request to info@aimee.travel with your registered email, specific request, and verification info.

We respond to all requests free of charge unless requests are manifestly unfounded or excessive.

9. Automated Decision-Making and Profiling

Aimee's AI analyzes your behavior and preferences to predict what activities you might enjoy. This is profiling under GDPR Article 22.

What we profile:

• Activity preferences
• Behavioral patterns
• Constraints such as budget preferences

How we use profiles:

• Generate personalized suggestions
• Improve match quality over time
• Save you time by filtering options

Safeguards include your ability to turn off AI learning, edit or delete profile data, and rely on human review if you believe a suggestion was inappropriate.

10. Children's Privacy

Aimee is intended for users aged 16 and older in accordance with Dutch law.

We do not knowingly collect data from children under 16.

• Parents may use Aimee to plan family activities
• We do not collect a child's name, photo, or contact information
• No separate child profiles are created
• If we discover data from a child, we delete it immediately

11. Security Measures

We implement appropriate technical and organizational safeguards, including encryption in transit and at rest, secure authentication, role-based access controls, and security monitoring.

We also maintain staff training, data processing agreements with vendors, an incident response plan, and regular security audits.

If a breach occurs, we will notify the Dutch DPA within 72 hours and affected users without undue delay.

12. Cookies and Tracking Technologies

We use cookies and similar technologies. For full details, see our Cookie Policy.

• Essential cookies are required for app functionality
• Analytics cookies help us improve and require your consent
• Affiliate cookies track bookings for commission and require your consent

13. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or new features.

• Minor changes are posted on the website with an updated Last Updated date
• Material changes receive email notification and in-app notice
• Continued use after notification means acceptance

Version history is available upon request.

14. Contact Us

By using Aimee, you acknowledge that you have read and understood this Privacy Policy.

This policy is effective as of May 1, 2026. Previous versions are available upon request.