Privacy policy

Last updated: 28 July 2026

Wegweit plans trips. For that we need a few details from you — and we pass some of them on to service providers who help us with computing, storing and displaying. This page sets out exactly which ones those are. We have deliberately listed every recipient individually instead of disappearing behind blanket wording.

1. Controller

The controller for the data processing on wegweit.com is:

Represented by the managing director René Bauer. Further details in the Legal notice.

Data protection officer

2. Overview

The most important points up front:

• Your trip data are held in a database in Frankfurt am Main.
• For the planning, your trip description goes to an AI service in the USA (Anthropic). Your email address is not sent with it.
• We set no advertising or tracking cookies and we do not embed any advertising networks. That is why there is no cookie banner on Wegweit either.
• We do not sell your data and we do not use them to serve you advertising.
• Your entries are not used to train AI models.

3. Access data and hosting

When you call up wegweit.com, our hosting provider processes technically necessary access data: IP address, date and time, the address called up, the volume of data transferred, browser type and operating system, referrer. Without these data the site cannot be delivered and cannot be secured against attacks and misuse.

4. Account and signing in

You need an account in order to save your trips and find them again. You sign in with a 6-digit code by email or with your email address and a password. For that we process: your email address, in the case of password sign-in additionally a password hash (we never store the password itself in plain text), the sign-in code as well as timestamps for registration and sign-in.

From the part of your email address before the @ sign we automatically generate a display name for your account. If your address contains your name, it therefore also appears in the display name.

Legal basis: Art. 6 Abs. 1 S. 1 lit. b DSGVO — the processing is necessary for the performance of the user contract.

5. Payment and subscription

Wegweit can be used free of charge. In addition there is the paid subscription “Wegweit Plus” and the one-off unlocking of a single trip — what that costs and what each of them includes is set out on the Pricing page. We only process payment data if you decide on a paid offer; merely looking at the pricing page does not trigger anything.

The payment process is handled by our payment service provider Stripe on a page hosted by Stripe. We do not embed any Stripe script in our pages for this — contact with Stripe only arises when you start the purchase process and are redirected there. Afterwards, all that is stored with us is what is listed under “Data” in the block below.

6. Planning and saving a trip

When you plan a trip we process what you enter in the form and in the free-text field:

• your trip description in free text,
• starting point (by GPS if you wish, see section 8), destination or region,
• travel period and trip duration,
• travelling party: the number of adults as well as the number and ages of the children,
• vehicle, type of accommodation, budget, travel pace, interests, languages,
• the trip plan generated and all later revisions,
• optionally: booking details entered by you, such as accommodation, price and booking number.

Legal basis: Art. 6 Abs. 1 S. 1 lit. b DSGVO — without these details we cannot plan the trip.

Do you have to provide these data? You are under no statutory or contractual obligation to provide any of them. Without an email address, however, no account can be created, and without the key facts of your trip no trip plan can be calculated — to that extent the details are necessary in order to use the service. All other fields are voluntary; if you leave them out, the plan simply becomes less precise.

7. Trip planning with AI

The trip plan is generated by a language model from Anthropic. For that we transmit the details from section 6 from our server — that is, your free text, start and destination, the period, the travelling party including the ages of the children, vehicle, budget, pace, interests and languages. If you use GPS, your starting coordinate is only sent rounded to about 100 metres — including when you revise the trip later and we send the existing plan along again.

Not transmitted: your email address, your account identifier and your IP address. The request is made by our server, not by your browser — so Anthropic does not see you directly.

There is no automated decision within the meaning of Art. 22 DSGVO: the trip plan is a suggestion which has no legal effect for you.

8. Your location

You can set your starting point by GPS and have yourself shown on the map. Your browser only asks you for permission once you tap that. On the map your position is updated continuously for as long as the feature is active — this also includes the direction your device is facing, so that the map turns with you.

If you set your starting point by GPS, we store the coordinate with your trip, and a rounded version goes into the AI planning (section 7). The continuous display of your position on the map, by contrast, stays on your device — we do not store it and it is not transmitted to us.

Legal basis: Art. 6 Abs. 1 S. 1 lit. a DSGVO and § 25 Abs. 1 TDDDG — your consent, which you give in the browser. You can withdraw it at any time in the settings of your browser or operating system for wegweit.com.

9. Map

The map is loaded from OpenFreeMap. Your browser fetches the map tiles directly from there — in doing so OpenFreeMap learns your IP address, your browser type and which section of the map you are looking at. From that section it can be inferred which region interests you; if you use the location display, also where you are.

10. Place information, images and routes

For the stops on your trip we fetch publicly available additional information from our server — descriptions, photos, addresses, telephone numbers, websites and opening hours. For that we transmit the place names and coordinates of the stops; data about you yourself only where the feature requires it — your starting point is additionally sent to openrouteservice so that the first stage can be calculated. We cache the results so that we do not have to fetch them again for every trip.

• Wikipedia and Wikidata — Wikimedia Foundation, Inc., USA: descriptions, images, coordinates, contact details.
• Overpass API (OpenStreetMap) — operator Roland Olbricht, Germany: addresses, telephone numbers, opening hours.
• Google Maps Platform (Places) — Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, where applicable Google LLC, USA (adequacy decision, Art. 45 DSGVO): place photos. Only for trips to which Wegweit Plus applies or which have been unlocked individually (see section 5); otherwise we do not query Google.
• openrouteservice — HeiGIT gGmbH, Schloss-Wolfsbrunnenweg 33, 69118 Heidelberg, Germany: road routes and driving times. The start and end coordinates of your stages are transmitted; the first stage begins at your starting point.

Legal basis: Art. 6 Abs. 1 S. 1 lit. b DSGVO.

Images in your browser

Your browser loads the photos for the stops directly from the respective source (Wikimedia Commons or Google's image server googleusercontent.com). In doing so these providers learn your IP address and your browser type. Only wegweit.com is transmitted as the origin, not the full address of the page — so with a shared trip the share link stays hidden.

Legal basis: Art. 6 Abs. 1 S. 1 lit. f DSGVO — legitimate interest in displaying the images without additional intermediate storage. We are currently examining whether to deliver the images via our own server in future, so that this contact ceases.

11. Booking and navigation links

For accommodation and stops we provide links to booking portals and navigation apps. These links are followed only when you tap them — before that, nothing flows. When you tap one, the page of the respective provider opens, which then receives your IP address, your browser type and the search parameters contained in the link, and can set its own cookies. The respective provider is itself responsible for that; its privacy policy applies.

Depending on the destination, the search parameters contain:

• Accommodation — Booking.com B.V., Amsterdam, Netherlands: the coordinates of the stop or the search location, the travel period, the number of adults and children as well as, where applicable, our partner identifier.
• Entrance tickets — Tiqets Nederland B.V., Amsterdam, Netherlands: the offer page you open and, where applicable, our partner identifier. Such links only appear at sights for which the provider actually sells tickets, and only if you did not switch them off when creating the trip.
• Navigation — Google Ireland Limited, Ireland; Apple Distribution International Ltd., Cork, Ireland; Waze Mobile Ltd., Israel (adequacy decision): the destination coordinates of the stop.
• Map search — Google Ireland Limited, Ireland: the name and place of the stop as a search term.

Legal basis: For the navigation and map links, Art. 6 Abs. 1 S. 1 lit. b DSGVO — they are part of the trip planning you have requested. For the booking links, Art. 6 Abs. 1 S. 1 lit. f DSGVO — our legitimate interest is the financing of the free offering through referral commissions.

12. Audience measurement

We use Vercel Web Analytics in order to see which pages are called up. The service is deliberately data-minimising: it sets no cookies, stores nothing on your device, assigns no recognisable user identifier and creates no cross-site profiles. An anonymous counter is formed from the page-view data. The data run via our own domain, so your browser does not make contact with any external server.

Recipient: Vercel Inc., USA (processor; adequacy decision, Art. 45 DSGVO).
Legal basis: Art. 6 Abs. 1 S. 1 lit. f DSGVO — legitimate interest in understanding how the service is used in order to improve it. Because nothing is stored on or read from your device in the process, no consent under § 25 TDDDG is required.

13. Storage on your device

Wegweit sets no advertising, tracking or analytics cookies. Only what is necessary for operation is stored — under § 25 Abs. 2 Nr. 2 TDDDG no consent is required for that:

14. Sharing trips

You can share a trip via a link. Anyone who has the link sees the trip without signing in — including the travel period, the stops, the travelling party and the details from your planning. The link contains a long random identifier and cannot be guessed; but nor is it secret: anyone it is passed on to can open the trip, and if it appears publicly, search engines can index the page.

So only share what you also want to show — and take private notes or booking numbers out of the trip beforehand.

Legal basis: Art. 6 Abs. 1 S. 1 lit. a DSGVO — your consent, which you give by creating the link. For as long as you cannot withdraw the link yourself, a message to us is sufficient (section 1); we will then deactivate it.

15. Feedback and bug reports

You can report bugs and send us ideas via a form in the app. If you use it, we process:

• your message in free text,
• optionally a category chosen by you (bug, idea, other),
• optionally a contact email address that you enter in the form (pre-filled with the account address for signed-in users, changeable or deletable by you),
• the identifier of your account as well as a short note as to which area of the app the feedback came from.

Purpose: Fixing bugs and improving Wegweit, replying to your queries and — if your feedback is particularly helpful to us — contacting you about a free unlock of Wegweit Plus (at our discretion; there is no entitlement to it).

Legal basis: Art. 6 Abs. 1 S. 1 lit. f DSGVO — our legitimate interest in learning from feedback and in dealing with it. Giving feedback is entirely voluntary; we only need the contact email address if you would like a reply.

Your feedback is stored in our database at Supabase in Frankfurt (see section 4). We notify ourselves internally by email when it arrives (Resend, see section 4); neither your free text nor your email address is sent with it — only the category and a note to look in the admin area.

16. Retention periods

• Account and trips: for as long as your account exists. If you delete a trip, it is gone immediately.
• After deletion of the account: The account and all trips attached to it are deleted. Payment and invoicing data are excepted: They remain stored for up to ten years because of the retention obligations under commercial and tax law (see section 5).
• Cached place information and routes: no reference to you, therefore permanently.
• Access data at the hosting provider: short-term, in accordance with their periods.
• Enquiries by email: until the matter has been dealt with, then deleted, in so far as no statutory retention obligation exists.
• Feedback and bug reports: for as long as we need them in order to deal with them and to improve the service; on request we will delete them sooner.

If you would like your account and your trips deleted, just drop us a line at info@e-networkers.de — we will take care of it.

17. Transfers to third countries

In summary, which data leave the EU:

• Adequacy decision (Art. 45 DSGVO) — here the EU Commission has established a level of protection equivalent to that of the EU: Vercel, Resend and Google (each via the EU-US Data Privacy Framework) as well as Waze (Israel). Likewise Stripe, safeguarded there additionally by EU standard contractual clauses (only in the case of a purchase, see section 5).
• EU standard contractual clauses (Art. 46 Abs. 2 lit. c DSGVO) — here we have safeguarded the protection contractually: Anthropic and Supabase.
• Booking and ticket links — the providers these links lead to (Booking.com and Tiqets, both Netherlands) are based in the EU. No transfer to a third country arises from them.
• Without a specific safeguard — Wikimedia Foundation, Inc. (USA), when your browser loads an image from Wikimedia Commons. For Wikimedia there is neither an adequacy decision, nor can standard contractual clauses be agreed with the foundation. Only your IP address and your browser type are transmitted in the process — no trip data and no details about your account. We are working on delivering these images via our own server in future, so that the contact ceases (see section 10).

You can request a copy of the standard contractual clauses from us (contact details in section 1).

18. Your rights

In relation to us you have the following rights at any time:

• Access (Art. 15 DSGVO) — which data we process about you,
• Rectification (Art. 16 DSGVO) — having incorrect data corrected,
• Erasure (Art. 17 DSGVO) — having your data deleted,
• Restriction of processing (Art. 18 DSGVO),
• Data portability (Art. 20 DSGVO) — receiving your data in a common format,
• Withdrawal of a consent (Art. 7 Abs. 3 DSGVO) — with effect for the future, without the processing carried out up to that point thereby becoming unlawful.

For all such matters an informal message to info@e-networkers.de or to our data protection officer (section 1) is sufficient.

19. Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority at any time (Art. 77 DSGVO). The authority responsible for us is:

You can also contact the supervisory authority of your place of residence or place of work.

20. Security

The connection to wegweit.com is encrypted with TLS throughout — recognisable by the padlock in your browser's address bar. Your trips are secured in the database in such a way that other signed-in users cannot read them; only you and, if you share, whoever has your share link can get at them. We store passwords exclusively as a hash. Beyond that we take technical and organisational measures in accordance with Art. 32 DSGVO and adapt them continuously to the state of the art.

21. Photos you upload yourself

You can upload your own photos to your trips — per stop or per day, as a personal travel diary. That is entirely voluntary; the trip works just the same without photos.

• Your photos are held in private storage in Frankfurt am Main (Supabase, EU region eu-central-1, see section 4). They are not publicly accessible: your browser only loads them via short-lived, signed links which we generate specifically for you.
• Location and time data (EXIF) are removed from the image when it is uploaded. Many cameras store GPS coordinates and the time of capture directly in the image file. We read out these details once and then store the delivered image without this metadata. The time of capture and — where present — the location are stored only as separate values alongside the photo, in order to be able to place it in time; they are no longer contained in the file that is delivered.
• We use your photos exclusively in order to show them to you in your trip. We do not pass them on, do not analyse their content, and they are not used to train AI models.
• Deleting: You can remove each photo individually — the image and the entry are then deleted immediately. If you delete the trip or your account, the associated photos are deleted as well.

Legal basis: Art. 6 Abs. 1 S. 1 lit. b DSGVO — uploading and displaying your photos is part of the travel diary feature that you use.

22. Changes

If we develop Wegweit further or the legal position changes, we will adapt this policy. The version published here, with the date stated above, applies.

23. Emails to you

Besides the emails that are part of running the service (login code, purchase confirmation, cancellation confirmation), we occasionally write to you about news on Wegweit. They are sent via Resend (see section 4).

You can object to this at any time. Every such email contains an unsubscribe link that works without logging in and takes effect immediately. After that you will only receive the emails that belong to the contract — withholding a cancellation confirmation would not be data protection, it would be a mistake.

Click measurement: Links in such emails that lead to our own pages run through a redirect on wegweit.com. In doing so we record whether you clicked, when you first and last did so, and how often. From this we can see whether a message arrives and whether it was useful.

What we do not collect in the process: no IP address, no browser or device type, no location. We do not use a tracking pixel and therefore also do not measure whether you opened an email. Links to external sites are not rewritten, and the unsubscribe link is never measured.

Legal basis: Art. 6 Abs. 1 S. 1 lit. f DSGVO — our legitimate interest in recognising whether our messages are read, and in not sending more of them than is useful. For sending to you as an existing customer we additionally rely on § 7 Abs. 3 UWG. If you object, the measurement ends together with the sending.

The click data is stored in our database at Supabase in Frankfurt, together with the delivery log of the respective email. We delete it along with that log, at the latest when your account is deleted.