Privacy Policy

Pathioo ("we", "us", "our") plans door-to-door journeys from live carrier and transit data. The controller responsible for your personal data (administrator danych osobowych) is:

We have not appointed a Data Protection Officer; RODO art. 37 does not require one for processing of this kind. Write to the address above and your request reaches the people who can act on it.

Data you provide:

• Travel search queries (start point, destination, date)
• Contact form submissions (name, email, message)

Data processed automatically:

• Your IP address and basic request metadata, processed server-side only to secure the service and enforce rate limits — we do not use it to profile you or build an analytics identity.

Only if you accept analytics cookies (section 6), we use Google Analytics to see how the site is used — pages viewed, roughly where visitors come from, which device, which outbound links to partner sites were clicked, and, when a page crashes, the technical error message so we can fix it (a short ErrorName: descriptionline — never a stack trace and never anything you typed). It is measurement in aggregate: we do not use it to identify you, and we never upload your searches, your contact details or anything you typed to it. Decline, and it is never loaded. Advertising & affiliate tags are covered by the same choice and may collect their own data — see section 4.

Local storage: Recent searches and your cookie-consent choice are stored in your browser's localStorage only. We never transmit them to our servers.

Each thing we do with your data has a purpose and a legal basis under the GDPR (RODO). They are paired here so you can see which is which:

We never sell your personal data, and none of the above involves automated decision-making that produces legal effects for you.

Pathioo uses the following third-party services that may process your data:

Some of the providers in section 4 are established outside the European Economic Area. Personal data may therefore be transferred to them, and the GDPR requires us to tell you what makes each transfer lawful:

• United Kingdom (Duffel) — covered by the European Commission's adequacy decision for the UK, so no additional safeguard is needed.
• Google Maps Directions (United States) — the routing calls we make for your journey. Google relies on the EU–US Data Privacy Framework and, where that does not apply, on the European Commission's Standard Contractual Clauses.
• Google Analytics — our contract for this is with Google Ireland Limited, inside the EEA, so the analytics data does not leave it by default. Where Google passes it on to Google LLC in the United States, that transfer is covered by Google LLC's certification under the EU–US Data Privacy Framework, with the Standard Contractual Clauses in Google's data processing terms applying to anything the certification does not. This only ever happens if you accept analytics cookies.
• Vercel and Upstash (United States) — both are certified under the EU–US Data Privacy Framework and rely on that certification as the primary mechanism, with the European Commission's Standard Contractual Clauses applying where it does not cover a transfer. Unlike the services below, these are not optional: hosting and rate limiting apply to every visit you make.
• Anthropic (United States) — transfers rely on the Standard Contractual Clauses (GDPR art. 46(2)(c)), as stated in Anthropic's own privacy policy. This only ever happens if you use the optional "Not sure which one?" feature.
• Resend (United States) — certified under the EU–US Data Privacy Framework (listed by the US Department of Commerce under its legal name, Plus Five Five), with the European Commission's Standard Contractual Clauses in its data processing addendum covering anything the certification does not. This only ever happens if you write to us through the contact form.
• Advertising & affiliate networks (Travelpayouts, Impact/Partnerize, emrldco) — these load only if you accept them in the cookie banner, and each relies on its own transfer mechanism, described in the privacy policy linked beside it in section 4. Decline, and no data reaches them.

You can ask us for a copy of the safeguards relied on for any of these transfers — write to the address in section 1.

We use the following categories of cookies and similar technologies:

• Essential: Your cookie-consent choice (stored in localStorage). Always active — the site can't work without it.
• Analytics: Set by Google Analytics (_ga and _ga_3Y6N71J361, which last two years) to count visits and see which pages and partner links are used. These load only after you click "Accept" in the cookie banner. If you decline, they are never loaded.
• Advertising & affiliate: Set by Travelpayouts, Impact/Partnerize and emrldco to attribute a booking you make on a partner site back to Pathioo, so we earn a commission. These load only after you click "Accept" in the cookie banner. If you decline, they are never loaded.

You can change or withdraw your choice at any time via the "Cookie settings" link in the site footer, which reopens the consent banner — withdrawing is as easy as giving consent. Your choice, whether it was an accept or a decline, is remembered for six months and then asked again, so consent stays current without us pestering you into it.

The banner gives "Accept" and "Decline" the same size, colour and prominence, on purpose. Declining is one click, exactly like accepting, and closing the banner without choosing counts as no consent — the advertising and affiliate tags stay unloaded.

Contact form submissions are retained for up to 12 months in our own inbox, to allow us to respond and follow up. Resend, which delivers them, keeps its own copy for 30 days and then deletes it. The rate-limiting counter keyed to your IP address is deleted automatically two minutes after your last request. It holds a number of requests and nothing else — no history of what you searched for. Server logs held by our host are kept for a short period and then discarded. Data stored in your browser's localStorage stays there until you clear it.

Google Analytics data, if you accepted analytics cookies, is retained for 14 months and then deleted by Google. The cookies it sets in your browser last two years, and you can clear them at any time — or withdraw consent via "Cookie settings" in the footer, after which they are no longer set.

If you are in the EU / EEA, you have the right to:

• Access personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Object to processing
• Data portability
• Withdraw consent at any time (e.g. for advertising & affiliate cookies), without affecting processing carried out before withdrawal

To exercise any right, email contact@pathioo.com. We will respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa — uodo.gov.pl.

Pathioo is not directed at children under 16. We do not knowingly collect data from children.

We may update this policy periodically. We will notify users of significant changes by updating the date at the top of this page. Continued use of Pathioo after changes constitutes acceptance.

Pathioo is free to use. Some outbound links to travel partners (for example flights via Kiwi, airport transfers via Welcome Pickups, eSIMs via Airalo, rail & bus via Omio, activities via GetYourGuide) are affiliate links. If you book through one of them, the partner may pay us a commission — at no extra cost to you.

This never changes the prices, times, airlines or routes you see: those come only from the live Duffel and Google APIs. Affiliate arrangements do not influence the ranking of your travel options.

Questions? Email us at contact@pathioo.com.