Legal

Privacy Notice

What MERRE does with your data, who else can see it, and the choices you have. Written to be read, not to be survived.

Status: Effective
Version: 1.2.0
Effective date / last updated: 10 October 2026
Controller: KRISZTIÁN PALLAGI, currently operating MERRE as an individual
Full service/contact address: Strada Constantin Noica 7, 410490 Oradea, Romania
Privacy contact: wander.travel.app1@gmail.com
General contact: wander.travel.app1@gmail.com

This Privacy Notice explains how the controller identified above (referred to as “MERRE,” “we,” “us,” or “our”) processes personal data when you visit merre.app, use the MERRE mobile application, create or manage an account, use AI-assisted trip planning, purchase or manage MERRE+, use the cloud backup included with an active MERRE+ entitlement, contact us, or exercise privacy rights.

This Notice does not apply to third-party websites, stores or services that have their own privacy notices, including Google Play, social-media sites, or a travel partner site that you deliberately open.

1. Privacy at a glance

This summary gives the essentials. The sections below give the full detail.

On your device first: MERRE keeps its runtime travel record and app settings on your phone. Your live location is not stored in MERRE's cloud. Photos you explicitly select for Memories can also be saved privately to your account's cloud allowance.
Sent to AI: when you request a trip plan or refinement, the selected planning details are sent to Google Gemini. Booking document extraction is performed on-device, not by Gemini. Do not include unnecessary sensitive information.
In the cloud: completed generated plans and their attached Guides are saved to your signed-in account, including free accounts, so they can be restored on another device. MERRE+ separately provides eligible travel-history backup. Cloud Memories are separate from compact backup and depend on the available account allowance.
Analytics: product analytics and crash diagnostics are off unless you switch each one on, and you can switch them off at any time.
No ads, no selling: MERRE shows no ads, collects no advertising identifier and does not sell your personal data.
Adults only: MERRE is for people aged 18 or older. You sign in with Google.
Your control: you can export your data or delete your account in the app, or at merre.app/delete-account.

2. Data we process

The data actually processed depends on the features you choose.

2.1 Website and network data

When you visit merre.app, the hosting and delivery infrastructure necessarily receives ordinary web-request data such as IP address, date and time, requested URL, HTTP headers, browser/device information and possibly referrer information.

The website uses or may trigger:

Cloudflare hosting and bot-management, including the __cf_bm cookie;
a first-in-page technical guard that blocks Lovable's hosting-injected analytics script, its session-id or analytics_events storage, and transmission to its analytics endpoint before those operations can occur;
browser sessionStorage for router scroll restoration;
your browser's preferred language and, where the hosting provider supplies it, the country derived from your IP address, used only to show the website in English or Romanian and not stored by MERRE;
a merre_lang cookie, set only when you choose English or Română on the website, which remembers that choice for one year;
same-origin fonts, styles, scripts and decorative images;
server and client error reporting when a failure occurs, including an error message, stack or route where available; and
user-initiated links to Google Play, Instagram and TikTok.

MERRE does not enable or offer non-essential website analytics on its website. The hosting layer may inject the analytics tag downstream of MERRE's source, but MERRE's guard blocks its execution, identifier storage and analytics transmission. A same-origin request for the blocked script file may still be visible in essential hosting logs. MERRE will not enable website analytics without first asking for your consent and updating this Notice. Hosting and security providers may retain essential request and security records under their documented retention rules.

2.2 Account, authentication and legal records

When you choose Google Sign-In, MERRE and Firebase Authentication process identifiers made available through that sign-in flow, which may include your Firebase user identifier, Google account identifier, name, email address and profile image. MERRE does not request a Google birthday solely to establish age.

When you create or continue an account, MERRE records evidence that you confirmed you are at least 18 and accepted the then-current Terms and acknowledged this Notice. The record contains the user identifier, Terms and Privacy versions and hashes, displayed-copy hash, adult assertion, app version, locale, authentication provider, server timestamp and an acceptance identifier. We do not collect an IP address or device fingerprint solely for this evidence.

The app also stores your purpose-specific privacy choices and their history, including policy version, choice states, source and server timestamp.

2.3 Profile and preferences

Depending on what you provide, MERRE may process your display name, profile image, language/locale, travel intent, planning goals, travel style, home base, map appearance and preferences, saved-place preferences and notification settings.

Current location, home base, map preferences, saved map locations and device-derived location state are kept out of MERRE's compact cloud backup. Mapping, search or routing providers may nevertheless receive the request data technically necessary to return a map tile, destination, search result or route when you request those online features.

2.4 Travel record and trip content

MERRE can process countries, regions, cities, airports and places marked Been, Lived or Wish; visit dates and ratings; trip names and dates; itineraries and stops; transport and accommodation information; companions; comments and notes; trip expenses and currencies; saved places; and generated or edited plans.

Travel history and future plans can reveal sensitive facts about your movements and private life even when they are not a GDPR special category. Do not enter information that is not needed for planning.

2.5 Planning inputs and AI content

When you request an AI-assisted plan, MERRE may process destination, dates or duration, origin or accommodation area, number and type of travellers, child age bands where relevant to an adult's trip, pace, budget, interests, desired atmosphere, saved places, prior travel history and free-text instructions. The selected information is sent to Google Gemini and may be combined with mapping, place or search-grounding information.

Planning preferences can include accessibility or dietary requirements. These choices or free text may reveal health information or religious beliefs. A general planning request or acknowledgement of this Notice is not explicit consent to process special-category data. Do not provide diagnoses, medical records, religious explanations, passport or payment-card data. Where special-category information is necessary, MERRE must establish an applicable GDPR Article 9 condition and present the required separate choice before that processing; until that safeguard is available, do not submit such information. You can contact us to remove information already submitted.

MERRE stores minimized AI audit metadata—such as feature, model, prompt/policy version, grounding status, token usage, fallback reason and timestamp—without intentionally storing raw prompts in the audit record. Completed generated plans and attached Guides are stored under your account independently of MERRE+. Booking imports remain in the local trip record. General destination Guides generated independently without Google Search grounding may be stored in a shared destination-and-language catalog. Only public destination and language information enters that catalog workflow; your questionnaire, private trip research, account identifier and personal notes are not reused for other travellers. Google-grounded information is not placed in this reusable catalog.

2.6 Booking imports and third-party personal data

If you deliberately import or share booking text, a PDF or an image for extraction, the material may contain passenger names, confirmation codes, routes, dates, accommodation, amounts, loyalty details, contact details or information about another person. Native document/OCR tools and a deterministic parser extract information on your device; the booking extraction workflow does not send the document or extracted text to Gemini. You review the result before adding it to the local trip record. If you later include accommodation or other booking details in an explicit AI planning request, the minimized details needed for that request can be sent to Gemini as described in Section 2.5; this is separate from extraction.

Only provide another person's data when you are authorised to do so and when it is reasonably necessary for the shared trip. Avoid passport scans, payment-card data, medical documents and unnecessary identifiers.

2.7 Photos and metadata

MERRE can keep trip photos and associated normalized information locally, including capture time and an optional normalized location used for sorting or map placement. Raw EXIF remains outside cloud backup, analytics and AI. Users can remove an assigned photo location.

Explicitly selecting photos for Memories can initiate a private, quota-controlled cloud save. MERRE creates minimized image derivatives, strips embedded metadata from the uploaded copies and uses a server malware-scanning/reconstruction workflow before admitting them to private Google Cloud Storage. Original files and raw EXIF/GPS remain on-device; no public gallery is created. Cloud photo display/recovery and deletion are authenticated and account scoped. Failed uploads retain the local copy and require an explicit retry; reinstalling, signing in or opening an album does not automatically upload photos. A cloud upload is not an AI-training request. Account cloud allowance and availability are shown in the app.

2.8 Location, calendar, notifications and files

If you choose a relevant feature, MERRE may request foreground precise or approximate location, calendar read/write access, notification permission, photo-picker access, or access to files you deliberately select or share. Depending on the Android version and installed build, the app also declares photo-library/media-image or legacy storage access and access to photo location metadata for local Memories import and placement. Declaring a permission does not grant it: the operating system controls the actual access you choose. MERRE does not request background location. Calendar events and local notifications are created on the device; raw photo location metadata is not added to cloud derivatives.

Permission denial does not prevent unrelated features. You can change permissions through device settings.

2.9 Purchases and subscriptions

Google Play and RevenueCat process an app user identifier, product/offer information, purchase status, entitlement state and renewal/cancellation/refund lifecycle needed to administer MERRE+. Superwall is used only to fetch and present paywall configuration. MERRE configures Superwall with SDK event tracking and purchase observation disabled, does not identify the user to Superwall or send profile attributes, and does not forward a Superwall/MERRE identifier to Google Play. Superwall may still receive ordinary network and device metadata needed to deliver paywall configuration. MERRE does not receive full payment-card details from Google Play.

MERRE+ is offered as an auto-renewing yearly subscription and, in some parts of the purchase flow, as an auto-renewing weekly subscription; eligible accounts may be offered a free trial or a discounted price. Google Play automatically supplies the applicable localized price, currency, tax display, regional availability and account eligibility through RevenueCat at runtime; MERRE does not permit checkout while the localized store price is unavailable.

Google Play presents the transaction-specific localized price, currency, applicable tax display, trial eligibility and renewal terms before purchase. Purchase and entitlement records are retained or deleted under the applicable store, processor, legal-accounting and dispute rules.

2.10 Analytics, diagnostics and measurement

In the mobile app, the following optional purposes are separate and off by default:

product analytics; and
crash diagnostics.

Privacy Controls also includes a separate personalized-recommendations preference, described in Section 4. Choices recorded for switches that earlier app versions offered and the current app no longer uses are treated as off and are never reused as consent for another activity.

These controls do not manage cookies set by third-party travel websites. Affiliate partner features are not currently available; if they are enabled later, MERRE will show a third-party and commission disclosure before any handoff, and opening a partner will not be treated as blanket consent to tracking.

An opt-in is not effective until recorded by the server; withdrawal disables collection locally immediately. Essential authentication, fraud/security, purchases and the eligible backup included with an active MERRE+ subscription are not switched off by these optional choices.

MERRE sends only the enabled purpose's approved event and technical fields. MERRE does not enable optional telemetry unless its configuration, retention, deletion support and transfer safeguards match this Notice.

Analytics and crash reporting do not start until you switch them on. Advertising ID collection and advertising signals are disabled, and product analytics records only the specific in-app events MERRE has chosen to measure.

2.11 Privacy, support and security requests

If you request access, export, correction, deletion, restriction, objection or support, MERRE processes the contact and request details needed to verify identity, understand the request, prevent fraud, track deadlines, communicate status and preserve a defensible audit record. Unnecessary identity documents should not be requested.

3. Why we process data and our legal bases

The legal basis depends on the purpose. MERRE applies the following mapping and records it in its processing register.

Purpose	Data	Legal basis we rely on
Create, authenticate and secure an account	Account identifiers and security events	GDPR Art. 6(1)(b), performance of the user contract; Art. 6(1)(f) for proportionate abuse/security controls, subject to a legitimate-interests assessment
Record legal acceptance and enforce current terms	Acceptance record and account identifier	Art. 6(1)(b); Art. 6(1)(f) for establishing and defending legal claims; Art. 6(1)(c) where evidence is required by law
Operate local travel and planning features	Profile, preferences, travel record and content	Art. 6(1)(b) when needed to provide requested features
Generate AI plans, Guides and refinements; save and restore completed account plans	User-selected planning inputs and generated results	Art. 6(1)(b) for the requested service; this does not replace a separately required Art. 9 condition for special-category data
Import booking documents locally and save selected Memories photos privately	Selected documents/images and minimized derivatives	Art. 6(1)(b) for the feature explicitly requested by the user; cloud photo saving remains quota and access controlled
Personalize recommendations from your profile and travel history, while that preference is on	Profile, preferences, travel history, saved plans and interaction signals	Art. 6(1)(f), our legitimate interest in showing relevant suggestions; you can object at any time by switching the preference off
Maps, place search, geocoding and routing	Search terms, coordinates and technical request data	Art. 6(1)(b) when needed to provide the feature you use
AI usage records for cost control, abuse prevention and quality	Minimized AI metadata, without raw prompts	Art. 6(1)(f), our legitimate interest in operating the AI features securely and sustainably
Support requests and feedback	Your message, contact details and case history	Art. 6(1)(b) where the request concerns your account or subscription; otherwise Art. 6(1)(f)
Provide MERRE+ backup and restore	Approved backup categories and entitlement	Art. 6(1)(b), because the eligible backup is an identified MERRE+ subscription feature activated by a verified entitlement
Process subscriptions and maintain statutory records	Purchase and entitlement data	Art. 6(1)(b) and, for legally required records, Art. 6(1)(c)
Optional mobile analytics and diagnostics	App events and minimized technical information	Art. 6(1)(a) consent where consent is required; no collection before the applicable choice
Website security, essential delivery and showing the website in your language	Request metadata, browser language, IP-derived country, the language cookie and strictly necessary security cookies	Art. 6(1)(f), subject to necessity/balancing; terminal-access exemption only where strictly necessary under Romanian Law 506/2004
Non-essential website analytics	Page-view/session data and analytics cookie	Not active; Art. 6(1)(a) consent and prior ePrivacy consent would be required before later enablement
Respond to privacy requests and disputes	Request, verification, communications and case record	Arts. 6(1)(c) and 6(1)(f)

To create an account you must provide the Google sign-in information described in Section 2.2, because MERRE cannot provide an account without it. Everything else is optional; if you do not provide it, the feature that needs it may not work.

If MERRE later uses data for a materially different purpose, we will provide required information first and obtain consent where the law requires it. MERRE will not treat consent to this Notice as consent for every processing activity.

3.1 Necessary processing and your privacy choices

MERRE processes the account identifiers and security information needed to authenticate you, protect your account, and prevent fraud or abuse. The optional analytics and diagnostics switches in Privacy Controls do not switch off these necessary account and security operations. Their purposes and applicable legal bases are set out above; describing processing as necessary does not remove your applicable privacy rights.

Purchases and MERRE+ are optional and are not enabled for free accounts. If you choose to purchase MERRE+, purchase and entitlement information is processed to provide and manage that subscription, and a verified active entitlement automatically activates backup of the eligible travel categories described in Section 5. This backup is part of the subscribed service and is not based on analytics consent. Declining optional analytics or crash diagnostics does not prevent use of essential account services or MERRE+ backup.

You can manage optional collection and personalized recommendations through Profile → Privacy Policy → the settings button in the top-right corner → Privacy Controls. Information about access, correction, deletion, restriction, objection and other applicable rights appears below.

4. AI-assisted processing

MERRE uses Google Gemini-family models for itinerary generation, research, Guides, recommendation or ranking, and refinement. Model routes can vary by feature and subscription tier. Booking extraction is on-device and is not a Gemini workflow. MERRE labels relevant features as AI-powered or AI-assisted and supplies a first-use notice before sending trip details to Gemini. Independently generated general Guides do not use Google Search grounding, may be reused across travellers and are not represented as verified or current research. Separate grounded features can use Search for the requesting traveller; the shared catalog does not receive those results. Emergency and electrical facts may instead come from the app's bundled country tables.

AI output is probabilistic. It can be incomplete, inaccurate, outdated or unsuitable. It is not a binding immigration, legal, medical, financial, emergency or safety decision. Verify important information with official authorities and providers.

MERRE does not use its AI functions to make a decision producing legal or similarly significant effects about a person. Local personalization and recommendation ordering may constitute profiling. Privacy Controls provides a server-recorded “Personalized recommendations” preference: when disabled, Discover and Trip Landing omit the account profile, travel history, saved plans, interaction signals and home base from ranking, while retaining the user's current explicit trip brief, language and currency to provide the requested planning interaction.

The backend uses the Gemini Developer API, including grounded features. Under Google's published terms for paid services, prompts and responses are not used to improve Google's products; Google Search grounding may retain prompts, context and generated output for 30 days. The Gemini Developer API is a global service, so this processing may take place outside the EEA. MERRE does not use your content to train AI models. MERRE does not intentionally place raw prompts or responses in its own AI audit log. MERRE does not operate AI features under a billing or logging configuration that would make these statements inaccurate.

5. Local storage, account plans and MERRE+ cloud backup

MERRE encrypts sensitive data stored on your device, using a key protected by your device's secure key storage. Encryption protects stored data on the device; it does not mean data is end-to-end encrypted when a requested server feature needs to process it.

Completed generated itineraries and their attached Guides are saved to the authenticated account and can be restored on another device, regardless of MERRE+ status. Local encrypted copies remain the runtime cache. Explicit changes use bounded, deduplicated account checkpoints; opening screens does not save a new plan. These account plan records are distinct from subscription-gated broad travel-history backup. Cloud Memories are also a separate private, quota-controlled service described in Section 2.7, not an image payload in a compact backup document.

For MERRE+ accounts, server-authoritative entitlement controls eligible travel-history backup. When an active entitlement is verified, MERRE backs up approved visit/country history through guarded checkpoints after eligible changes. This compact backup does not contain app settings, current location, home base, map preferences, raw imported files, raw EXIF or photo binaries. A selected onboarding home base may be held separately in the account profile; this does not create a live-location history. Free accounts do not receive this broader subscription backup, but retain access to their account plans.

When MERRE+ expires, new subscription-backup writes stop. That backup has 30 days of read-only restore/export/delete access before scheduled deletion. Completed account plans are not deleted merely because MERRE+ expires. Account deletion is separate and removes account-associated plans, photo copies and backup data regardless of subscription, subject to lawful retention.

6. Recipients and service providers

We disclose data only as needed for the purposes above, subject to applicable contracts and safeguards. Recipients include:

Recipient/category	Purpose	Details
Google/Firebase	Authentication, App Check, Functions, RTDB/Firestore account plans and backup, private Storage photos and malware reconstruction, Remote Config, optional Analytics/Crashlytics	Firebase processing terms incorporate SCCs. Databases and most server functions run in EU regions; a small number of server functions run in the United States.
Google Gemini / Firebase AI Logic	AI-assisted planning, research, independent general Guides, recommendations and refinement	Gemini Developer API is global; Google's paid-service data terms and 30-day Search-grounding retention apply to configured grounded requests. Booking extraction is not sent to Gemini.
Mapbox and Geoapify	Maps, search, geocoding, place verification and routing	Mapbox uses US/global infrastructure and documents request-data practices. Geoapify identifies a Cyprus provider and EU hosting, with its published API-log retention rules.
RevenueCat and Google Play	Purchases, subscription and entitlement lifecycle	RevenueCat publishes processor terms and transfer clauses. Google Play controls payment collection and presents localized transaction terms; MERRE does not receive full payment-card details.
Superwall	Paywall configuration and presentation	Superwall SDK event tracking, purchase observation, MERRE user/profile synchronization and identifier forwarding are disabled. Superwall may receive ordinary network and device metadata needed to deliver paywall configuration; international transfers are covered by its DPA.
Unsplash	Destination images and required selected-photo reporting	CDN image loads disclose ordinary request data such as IP address. Server-side selected-photo reports send the public photo reference, not your account identifier or private itinerary. Image URLs and photographer credits are retained for display; MERRE does not operate a replacement Unsplash image archive.
Lovable and Cloudflare	Website build/hosting, delivery and security	They process ordinary website request/security data under their applicable terms; non-essential injected analytics is blocked.
Professional advisers and authorities	Legal, accounting, security, dispute handling or lawful requests	Conditional and limited to necessity/legal authority

Affiliate partners are not listed because partner features are not currently available. We will update this Notice before any partner that receives personal data is enabled.

7. International transfers

Some providers process data outside Romania or the European Economic Area. Firebase's processing terms, RevenueCat's DPA and Superwall's DPA incorporate EU Standard Contractual Clauses for restricted transfers. Mapbox publishes a DPA with transfer safeguards. Geoapify is an EU-based provider with EU hosting, although its delivery and security providers may create onward transfers. Some Firebase server functions, Gemini, RevenueCat, Superwall, Mapbox and Unsplash therefore involve international transfers.

Where a restricted transfer occurs, MERRE relies on an applicable adequacy decision, Standard Contractual Clauses incorporated into the provider agreement, or another lawful transfer mechanism, together with supplementary measures where required. Copies or information about relevant safeguards may be requested through the privacy contact, subject to necessary redactions.

8. Retention

MERRE keeps personal data only for as long as necessary for the stated purpose, including to provide the account/service, comply with law, resolve disputes, enforce agreements and maintain proportionate security evidence.

Retention criteria include:

local data remains until the user deletes it, clears app data, deletes the account, or uninstalls the app; uninstalling does not delete account plans, cloud Memories or MERRE+ backup;
account plans and private cloud photo copies remain until deleted through the applicable feature or account-deletion workflow, subject to legal holds; subscription expiry alone does not erase account plans;
independently generated public Guide topics have a 30-day logical refresh interval and can be replaced on an explicit request; this is not an automatic 30-day erasure of the catalog or the Guide attached to your plan;
expired MERRE+ backup enters a 30-day read-only lifecycle before scheduled deletion;
current raw AI prompts are not intentionally stored in MERRE's minimized AI audit metadata, while saved outputs remain until deleted under the applicable local/cloud lifecycle;
Google Search-grounded Gemini requests are retained by Google for 30 days under the current service terms; MERRE's own monitoring does not store raw prompts or responses;
Mapbox and Geoapify keep request logs, such as IP addresses, for short periods under their published retention rules;
where you enable crash diagnostics, Firebase Crashlytics keeps crash reports and associated installation identifiers for a limited period under Google's published retention rules; where you enable optional product analytics, Google Analytics user- and event-level data is retained for two months;
RevenueCat states customer-data retention by the service-agreement term, followed by return/deletion subject to contractual and legal exceptions; Superwall is used only to deliver paywall configuration, without SDK event tracking or MERRE user identification, and retains essential delivery and security data under its published rules;
acceptance and consent histories are kept while your account exists and afterwards for the applicable limitation period for legal claims, generally three years under Romanian law;
transaction records may be retained where tax, accounting or consumer law requires them; and
completed, minimized account-erasure job receipts are retained for seven days; unresolved erasure jobs retain the account identifier only as needed to finish deletion, and legally held evidence follows its separately documented basis;
the project's default Google Cloud operational log bucket has 30-day retention; Google's mandatory locked audit-log bucket has 400-day retention. These provider logs are distinct from MERRE's content-free AI usage metadata and three-year accountability evidence.

For categories without a fixed period above, MERRE applies documented criteria: account data is kept while the account is active; acceptance, consent, transaction, rights-request, security and dispute records are kept only for the applicable legal obligation or limitation period and then deleted or irreversibly minimized; temporary logs and backups are deleted or overwritten on their configured cycles unless a legal hold is required.

9. Cookies and similar technologies

The website uses:

__cf_bm, set by Cloudflare for bot/security management;
browser sessionStorage for scroll restoration;
merre_lang, set only when you choose a website language, holding en or ro for one year so later pages open in the language you chose.

Lovable's hosting layer may inject an analytics tag designed to create a short-lived session-id and buffer analytics_events. MERRE's first-in-page guard blocks that tag's execution, blocks those keys in cookies and browser storage, and blocks calls to the analytics endpoint. These analytics identifiers are therefore not authorised as active website processing. The public Privacy Choices page reports the guard status and can clear any matching residual client-side keys.

Strictly necessary storage/access may be used without consent only within the narrow exception allowed by Romanian Law 506/2004. Non-essential analytics storage/access requires clear prior information and consent. MERRE blocks non-essential hosting analytics outright and does not provide a control that enables it.

If MERRE introduces another non-essential cookie or similar identifier, it will update this Notice and obtain the required prior choice before enabling it.

10. Your choices and rights

Subject to applicable conditions and exceptions, GDPR rights include:

access to your personal data and processing information;
correction of inaccurate or incomplete data;
erasure;
restriction of processing;
data portability for eligible data;
objection to processing based on legitimate interests, and an absolute objection to direct marketing;
withdrawal of consent at any time, without affecting earlier lawful processing;
rights concerning solely automated decisions producing legal or similarly significant effects; and
a complaint to a supervisory authority.

The app's Privacy Controls screen provides data export, correction routes, account deletion, consent choices and restriction/objection intake. Cloud-backup and AI-processing information appears in this Notice; backup is governed by MERRE+ entitlement rather than a separate switch. Requests can also be submitted to the privacy contact above. We may request proportionate information to verify identity. We normally respond within one month under GDPR, subject to lawful extension and notification.

You may complain to the Romanian supervisory authority:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) B-dul G-ral. Gheorghe Magheru 28–30, Sector 1, 010336 București, Romania Website and complaint information: <https://www.dataprotection.ro/>

You may also complain to the competent authority in your habitual residence, workplace or place of an alleged infringement where the GDPR permits.

10.1 United Kingdom

People in the United Kingdom have substantially corresponding rights under the UK GDPR and Data Protection Act 2018 and may complain to the UK Information Commissioner's Office. Restricted transfers use UK adequacy regulations, the UK International Data Transfer Agreement/Addendum or another permitted safeguard.

10.2 California and other United States privacy laws

MERRE does not sell personal information, share it for cross-context behavioural advertising, operate an advertising network or knowingly process child accounts. California residents may request access/knowledge, deletion and correction and may exercise any other right that applies to MERRE. MERRE will not discriminate for a valid privacy request.

10.3 Brazil

People in Brazil may request confirmation, access, correction, anonymisation/blocking/deletion where applicable, portability, information about sharing, consent withdrawal and review/information concerning qualifying automated decisions under the LGPD. The privacy contact above receives these requests.

10.4 Canada

Canadian users may request access and correction and challenge MERRE's privacy compliance through the contact above. KRISZTIÁN PALLAGI is the accountable privacy person for MERRE. MERRE applies purpose identification, meaningful consent where required, collection limitation, safeguards, openness, breach recording and retention limitation.

10.5 Other countries

Wherever you live, you can send access, correction, deletion and other privacy requests to the contact above. We will answer them under the law that applies to you, and you may also complain to your local data-protection authority.

11. Account deletion and export

You can export your data and delete your account in the app. Deletion starts automatically as soon as you confirm it. Deleting your account removes your sign-in record, the account and backup records on our servers and the encrypted data on the device you delete from, and asks our service providers to delete their copies. Records we must keep by law and copies in providers' routine backups are kept only as described in Section 8.

The website provides /delete-account and /privacy-choices. The public deletion page identifies MERRE, explains the deletion steps and retained categories, and provides the monitored contact route.

12. Security

Safeguards include encryption of data stored on your device, encrypted connections, app-integrity checks, authenticated and rate-limited server operations, access rules that limit each account to its own data, and minimized AI logging.

No system is perfectly secure. We do not guarantee absolute security. Access controls, vendor access, logging, credential rotation, backup restoration and incident response are reviewed on an ongoing basis.

13. Personal data breach response

MERRE maintains a documented incident process for prompt containment and assessment, provider escalation and evidence preservation. Where GDPR Articles 33 and 34 require it, MERRE notifies the supervisory authority within 72 hours and informs affected users without undue delay. KRISZTIÁN PALLAGI is responsible for incident response, and security concerns can be reported to the contact address above.

14. Adults only and other people's data

MERRE is not offered to people under 18 and does not knowingly create child accounts. A user confirms they are at least 18 as part of the Google account onboarding action. This is a contractual age assertion, not identity-grade age verification.

An adult may describe children travelling with them. MERRE uses age bands rather than dates of birth where practical and does not use companion information for advertising or unrelated profiling. If we learn that a child created an account contrary to the Terms, we will take proportionate steps to close it and delete data, subject to legal requirements.

15. Automated decision-making and profiling

MERRE uses automated models to generate and rank travel suggestions and may personalize results using user-selected preferences or travel history. These outputs assist planning; they do not determine eligibility for employment, credit, housing, education, insurance, healthcare, migration status or another legal/similarly significant outcome.

Users can edit generated plans, provide feedback, verify sources and disable history/profile-based recommendation ranking in Privacy Controls. Disabling it removes account profile, travel history, saved plans, interaction signals and home base from recommendation ranking; explicit inputs supplied for the current request may still be used to answer that request.

16. External services and links

When you deliberately open Google Play, Instagram, TikTok, an official-authority source or another external site, that third party processes data under its own notice. MERRE does not control third-party availability, content or privacy practices.

17. Changes to this Notice

We may update this Notice when the product, provider set or law changes. The website publishes the current effective date and version and archives prior versions. Where a change is material or the legal basis requires it, we will provide appropriate notice and request renewed acceptance or consent rather than relying only on continued use.

18. Contact

Controller: KRISZTIÁN PALLAGI, an individual operating MERRE Full service/contact address: Strada Constantin Noica 7, 410490 Oradea, Romania Privacy email: wander.travel.app1@gmail.com Support email: wander.travel.app1@gmail.com DPO: No data protection officer has been appointed because MERRE's processing does not currently meet the mandatory designation criteria in GDPR Article 37. Privacy enquiries are handled through the contact above. This determination is reviewed if MERRE's scale, purposes or data categories materially change.

Primary legal references

Back to MERRE Terms and Conditions