Privacy notice

Xplore Mondo is the data controller for the account, planning and booking data described here. Contact privacy@xploremondo.com for any request. Each local operator is a separate controller for the traveller details we pass to them so they can run your experience.

• Account: name, email, sign-in provider (email, Google or Apple), and email-verification status.
• Trip planning: dates, city, group size, budget, interests and the itineraries generated for you.
• Bookings: traveller names, party composition, answers to operator questions, vouchers, and messages you exchange with the operator.
• Payments: Stripe holds the card data. We store only the payment reference, amount, currency and status — never a card number.
• Technical: device and browser information, IP address and error logs, plus optional analytics events if you accept optional cookies.

• Contract: creating your account, generating itineraries you request, taking payment, confirming bookings, issuing refunds and providing support.
• Legal obligation: tax and accounting records, and fraud and anti-money-laundering checks on partner operators.
• Legitimate interests: keeping the platform secure, preventing abuse and improving the product using aggregated data.
• Consent: optional analytics cookies and marketing email. You can withdraw consent at any time.

• The local operator delivering your experience — only the traveller details needed to run it.
• Stripe, for card processing and refunds.
• Our hosting, database and email providers, acting as processors under contract.
• Weather and mapping providers, which receive locations and dates but no personal identifiers.
• Authorities, where the law requires it.

Itineraries are generated by a large-language model using your trip inputs (dates, city, group size, budget and interests). We do not send your name, email, payment details or documents to the model, and model providers are contractually barred from training on your data. Every itinerary is a suggestion you are free to change or discard.

• Account and trip data: while your account exists, then 12 months.
• Booking and payment records: 10 years, as Italian tax law requires.
• Support messages: 24 months after the case closes.
• Analytics events: 14 months.

Our infrastructure is hosted in the EU where possible. Where a processor operates outside the EEA, transfers rely on the European Commission's Standard Contractual Clauses plus supplementary technical measures such as encryption in transit and at rest.

You can request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. Email privacy@xploremondo.com and we respond within 30 days.

You can also complain to the Italian supervisory authority (Garante per la protezione dei dati personali) or the regulator in your own country.

Access to traveller and operator data is enforced in the database with row-level security, not only in the interface. Operator identity documents, bank details and internal notes are stored in private buckets, are never public, and are readable only by that operator and reviewing administrators. Sensitive actions are recorded in an audit trail.