Tiagro

Privacy policy

Last updated: 26 October 2026

This is a translation provided for your convenience. In case of doubt or conflict, the German version is legally binding.

Summary

Tiagro stores your trips, including days and stops, on your device and backs them up to your account, so you have them on all your devices and they don't get lost. Documents, tickets and photos you keep in the app are also backed up to your account — transferred encrypted and visible only to you. We process personal data on our systems only to the extent necessary for the app's features, for bookings and for secure operation. Whatever you deliberately add to a shared trip — tickets at stops, photos in the trip album, polls — is visible to your travel companions.

Controller

Hussen Kalaf AI Tools (tiagro)
Owner: Hussen Kalaf
Neue Weinsteige 24b
70180 Stuttgart
Deutschland

Email: info@tiagro.app

What data we process and why

  • Account and profile: email address, login identifier and — if you enter them or sign in with Google or Apple — name, display name and profile picture. Purpose: signing in and providing the app (Art. 6(1)(b) GDPR).
  • Content you have analysed: trip requests and chat messages, scanned or uploaded tickets and documents, and emails you send to your personal forwarding address — manually or through a forwarding rule you set up in your email program. They are analysed automatically in order to create trip plans, suggestions and entries for your trips (Art. 6(1)(b) GDPR). We only receive the emails you send to this address; we do not access your mailbox. Of forwarded emails we store the sender, subject, the details recognised and the attachments, and the message text only in shortened form and only if the analysis fails. Attachments are kept in storage that only your account can access.
  • Location: only if you allow it, for features that need it — such as navigation, your position on the map, places near you, the weather or relevant suggestions in the AI chat. We do not store your location in your account. The legal basis is your consent (Art. 6(1)(a) GDPR); you can withdraw it at any time in your system settings.
  • Shared routes: if you create a share link, we store a copy of the route (title, days, stops). Anyone with the link can view it without signing in; documents, tickets and personal notes are not included (Art. 6(1)(b) GDPR).
  • Travel plans: we store your trips with days and stops, as well as the details of tickets, documents and bookings you enter in the app, in your account in order to make them available on your devices and protect them from loss. The same applies to the places you add by hand as visited in your trip history. We also back up the files that go with them (such as photos, PDFs or attachments from the email import, which may contain personal data such as passport or booking details) to your account: transferred encrypted, kept in non-public storage and visible only to you — except for tickets at stops and photos in the trip album that you add to a shared trip (see “Tickets, photo album and polls”) (Art. 6(1)(b) GDPR).
  • Bookings: if you buy a flight, a hotel or an eSIM through the app, we process the details required for it — for flights and hotels the travellers' names and contact details, for flights also date of birth, gender and seat and baggage choices — and transmit them to our booking partners and to the airline, the property or the eSIM provider so that the booking can be carried out. The booking and its receipt remain linked to your account so that you can see it on any device and cancel it (Art. 6(1)(b) and (c) GDPR).
  • Payments and subscriptions: payments are processed by payment service providers or by the App Store and Google Play. You enter your card details there; we do not hold them. We store whether and until when Tiagro Premium is active and where it was purchased (Art. 6(1)(b) and (c) GDPR).
  • Purchases in the travel shop and invoices: When you buy an eSIM in the travel shop on tiagro.app or in the app, we process your email address (for purchases without an account also your language), the selected plan, price, currency and time, the country of your request and, from the payment service provider, your name, the country of your payment method and, where applicable, your billing address. Payment is handled by our payment service provider; we obtain the eSIM through an eSIM wholesaler, which receives the order details for this purpose. We store the version and time of your consent to immediate performance as proof. After the purchase we create an invoice and send it to you by email. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR); we keep invoices, purchase records and the country details (proof of the place of supply for VAT) for up to ten years due to statutory obligations (Art. 6(1)(c) GDPR, Section 147 German Fiscal Code, Section 14b German VAT Act).
  • Shared trips and expenses: if you share a trip with travel companions, they see the trip with its days, stops, expenses and votes, as well as the first or display name of the other companions; those allowed to edit can also change it. Expenses you add belong to the trip and are visible to all companions. The trip stays assigned to the person who created it; if you leave it or are removed, it disappears from your devices (Art. 6(1)(b) GDPR).
  • Expense groups: under Travel tools → Expenses you can create groups (say for a flat-share holiday) and invite others by link or code. All members see the group's expenses including receipts, who paid what and who owes whom how much, as well as the first or display name of the other members. The group stays assigned to the person who created it. If you leave a group or are removed, your expenses and your first name remain there so that the settlement stays traceable for the others; your receipts are then no longer visible. If you delete your account, your name is removed there (Art. 6(1)(b) and (f) GDPR).
  • Tickets, photo album and polls on shared trips: tickets you add to stops, photos you add to a day's album, comments, polls you start and your votes are visible to all companions on that trip — with your name. We reduce photos in size before uploading; the files are stored in your account and can only be retrieved by members of the trip while you are part of it yourself. If you leave the trip or are removed, your tickets and photos are removed from it; polls and votes remain as part of the joint decision. The trip recap in the app also shows photos from the album; for the image you share, it only uses your own photos. You can also keep an album without travel companions — then only you can see it. Favourites you mark among destinations in a group are visible to all members of that group with your name; if you leave the group, they are removed. (Art. 6(1)(b) GDPR).
  • Invitations: if you invite someone or are invited, we store your invite code, who invited whom and when, and a non-reversible check value of the email address so that a gift cannot be redeemed more than once. For the long-trip voucher you both receive, we store when it was used for a plan (Art. 6(1)(b) and (f) GDPR).
  • Usage counters: how many plans, scans and imports you have used in the current month — for the monthly limits of free use (Art. 6(1)(b) GDPR).
  • Support: subject, text and email address when you write to us, plus any images or PDFs you attach — to answer your request (Art. 6(1)(b) or (f) GDPR). Attachments are kept in storage that only your account and our support team can access, and are opened only via time-limited links.
  • Operation and security: when the app and website are accessed, technically necessary connection data is generated (such as IP address, time, device or browser type). If a feature crashes, the app sends an error report with technical details and your account identifier. This serves our legitimate interest in stable, secure operation and in fixing errors (Art. 6(1)(f) GDPR).
  • Audience measurement: to understand how the website and app are used, we count page views and individual steps (such as whether the preview was used or a sign-up was started) anonymously as daily totals — with language, country, device type and referring website. We set no cookies, store neither IP address nor identifier and do not recognise you again; a marker in your browser's session storage only prevents double counting and disappears when you close the tab. In the app we also count steps such as planning, saving a trip or opening the Premium offer, likewise only as daily totals per platform (iOS, Android, web), language and app version; there the marker lasts until you close the app. We keep the daily totals for at most 24 months. The basis is our legitimate interest in improving our service (Art. 6(1)(f) GDPR).
  • Embedded partner offers: if the app shows offers from travel and booking partners (such as hotels, tours or tickets), these are loaded directly from the partner concerned. The partner receives your IP address, your language setting and the destination shown, and may set its own cookies; its privacy policy applies.

Sign in with Google and Apple

  • If you sign in with Google, we receive from Google only the details needed for signing in: your Google account identifier, your email address, your name and your profile picture (scopes “openid”, “email”, “profile”). If you sign in with Apple, we receive your Apple identifier, your email address or an address relayed by Apple and – only the first time and only if you agree – your name.
  • We use these details solely to sign you in, create your account and show your profile in the app. We do not access your mailbox, contacts, calendar, photos or any other data in your Google or Apple account.
  • The details are stored in your Tiagro account with our hosting provider, transmitted encrypted and kept only as long as your account exists. If you delete your account in the app, they are deleted too.
  • We do not sell these details, do not share them for advertising and do not use them to train AI models. They are only shared with the service providers needed to run your account (hosting and sign-in).
  • Tiagro's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Recipients

We only pass on data to the extent necessary for the purposes stated. Recipients are the following categories of service providers and partners:

  • Hosting, infrastructure and database providers, including sign-in and the receipt and sending of emails
  • AI service providers that analyse your input, tickets and documents on our behalf
  • Map, place, weather, image and travel information services (for example for flight status or exchange rates) — they receive search terms, location details or flight numbers; your device loads some maps and images directly, in which case the provider receives your IP address
  • Booking partners, airlines, properties and eSIM providers — when you make a booking
  • Payment service providers, subscription management services and Apple (App Store) and Google (Google Play) — when you make a purchase
  • Travel and booking partners whose offers are embedded in the app

Transfers to third countries

Some recipients are based outside the European Union or the European Economic Area, in particular in the USA, or process data there. Transfers are based on an adequacy decision of the European Commission — for the USA the EU-US Data Privacy Framework, where the recipient is certified under it — or on EU standard contractual clauses (Art. 45, 46(2)(c) GDPR). For bookings, the transfer to airlines and properties abroad may also be necessary for the performance of the contract (Art. 49(1)(b) GDPR).

Retention

We store personal data only for as long as the purpose requires: travel plans until you delete them, at the latest until your account is deleted; account, profile, bookings, subscription status as well as the stored details and attachments of forwarded emails until your account is deleted; shared routes until you revoke them, for no more than 90 days; support messages and error reports as long as they are needed for processing, at the latest until your account is deleted; connection data only briefly for operation and security. We do not permanently store content you have analysed unless you add the result to your account. Where statutory retention obligations apply — for example for tax-relevant records — we keep the data concerned until the retention period expires.

Obligation to provide data, no automated decisions

An email address is required for an account; without it you cannot use the app. For a booking we need the travellers' details. All other information is voluntary — if it is missing, only the feature concerned is unavailable. No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15–18, 20 GDPR) and the right to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw any consent at any time with effect for the future. You can delete your account and the associated data yourself in the app under Profile; how to do this and what is removed is explained at app.tiagro.app/konto-loeschen. You also have the right to lodge a complaint with a data protection supervisory authority.

Contact

Please send data protection enquiries to info@tiagro.app or to the address given in the “Controller” section.