Your data, handled with care.
Last updated · June 13, 2026
We collect as little as we can and use it only to plan better trips for you. This policy explains what we gather, why, the legal bases we rely on, and the control you keep over it — in plain language.
01 Who we are
Ovinsa is operated by Calgie LLC, which is the data controller responsible for the personal data described here. For privacy questions or to exercise your rights, contact us at support@ovinsa.com.
02 What we collect
- Your email — when you join the waitlist, so we can tell you when Ovinsa opens.
- Trip details — destinations, dates, budgets, traveler counts, and preferences you enter to generate a plan.
- Referral data — the invite link you came from and the links you share, so we can place you in the queue and credit referrals.
- Locale & currency — the language and display currency you choose, so the site shows up the way you expect.
- Limited technical & usage data — device/browser type, pages viewed, and a coarse, approximate location. We store a salted, one-way hash of your IP address (not the raw IP) for security and abuse prevention.
03How we use it & our legal bases
Under the GDPR, we rely on the following legal bases (the equivalent applies under UK GDPR):
- Contract — to operate the waitlist, place you in the queue, and build and refine your trip plans.
- Legitimate interests — to keep the service secure, prevent abuse, and improve the product, balanced against your rights.
- Consent — for non-essential analytics and any marketing communications. You can withdraw consent at any time (see §06). We never run advertising profiles on you.
- Legal obligation — where we must retain or disclose data to comply with the law.
04 What we never do
- We don't sell or "share" your personal data — full stop.
- We don't disclose your itineraries to anyone outside Ovinsa, except the service providers below.
- We don't email you marketing you didn't ask for.
05 Service providers
We rely on a small set of vendors to operate. They process data only on our instructions, only as needed to provide their service, and are bound by contracts that protect your information.
| Provider | Purpose | Location |
|---|---|---|
| Vercel | Website hosting & content delivery | United States |
| Convex | Application database & backend | United States |
| Resend | Transactional & launch email delivery | United States |
| PostHog | Product analytics (consent-gated) | European Union |
| Google Analytics | Aggregate traffic measurement (consent-gated) | United States |
| Cloudflare Turnstile | Bot / abuse prevention on the signup form | United States |
06Cookies & consent
We use a little browser storage to remember your theme, language, and waitlist status so the site works smoothly when you return — these are strictly necessary and always on. Non-essential analytics load only after you opt in through our consent banner, and we don't use third-party advertising cookies. You can change your choice at any time:
07 International data transfers
Some of our providers are located in the United States, so your data may be transferred outside the EEA/UK. Where that happens, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum) to protect it.
08 Data retention
We keep waitlist emails until launch (or until you ask us to remove them) and trip details only as long as needed to provide and improve your plans. Security logs and hashed identifiers are kept for a limited period. When data is no longer needed, we delete or anonymize it.
09 Your rights (EU/UK — GDPR)
If you're in the EEA or UK, you have the right to:
- Access a copy of the data we hold about you.
- Correct anything that's inaccurate or incomplete.
- Delete your data ("right to be forgotten").
- Restrict or object to certain processing.
- Receive your data in a portable format.
- Withdraw consent at any time, without affecting prior processing.
- Lodge a complaint with your local data protection authority.
10 Your rights (California — CCPA/CPRA)
If you're a California resident, you have the right to know what personal information we collect and how we use it, to request access and deletion, to correct inaccurate information, and to be free from discrimination for exercising these rights. We do not sell or share your personal information as those terms are defined under the CCPA/CPRA.
11 Changes
If we update this policy in a meaningful way, we'll let you know by email or in the app before the change takes effect. The "last updated" date above always reflects the current version.
12 Contact
Privacy questions or requests? Reach a real person at support@ovinsa.com. You can also review our Terms of Service.