Privacy policy

Overview

ReseAssistenten (a service from Mindtravel) takes your privacy seriously. This page describes what personal data we process, why, how long we keep it, who we share it with (including connected AI agents), and the rights you have under the EU General Data Protection Regulation (GDPR).

Data controller

The data controller is Mindtravel, contactable at support@reseassistenten.se. Mindtravel operates the ReseAssistenten service (also known as Award Planner).

Purposes and lawful bases

We process data for the following purposes:

• Providing the service (account, trips, bookings) – Lawful basis: contract (GDPR Art 6(1)(b)). Without this data we cannot provide the service.
• Subscription and payment handling – Lawful basis: contract (GDPR Art 6(1)(b)) and legal obligation for accounting (GDPR Art 6(1)(c)).
• Sending service-related email (booking updates, password resets, alerts) – Lawful basis: contract (GDPR Art 6(1)(b)).
• Enriching and updating travel data (flight times, booking status, places) – Lawful basis: contract (GDPR Art 6(1)(b)). We fetch flight times, award availability and place information from external travel providers - see Recipients below.
• Security and fraud prevention (login risk scoring) – Lawful basis: legitimate interest (GDPR Art 6(1)(f)). See dedicated section below.
• Processing booking confirmations you submit to the service – Lawful basis: contract (GDPR Art 6(1)(b)). The content is processed by OpenAI for automatic interpretation - see Recipients below.
• Giving a connected AI agent access to your trips (MCP) – Lawful basis: consent (GDPR Art 6(1)(a)). This processing only happens if you connect an AI agent yourself, and can be withdrawn at any time. See the AI agents section below.

What data we process

We process the following categories of data:

• Account data: name, email, associated email addresses, password (hashed), optional Apple ID (sub), language preference.
• Billing data: handled by Stripe - we only store a Stripe customer id, not the card number.
• Trips and bookings: trips, flight segments, accommodations, activities and transport you add or import.
• Travellers: names and details of co-travellers you save, as well as EuroBonus and other loyalty numbers.
• Travel documents: information about passports, national ID, visas, ESTA/ETIAS and health documents - including document numbers and expiry dates you enter yourself (sensitive data).
• Location data: cities and places linked to your trips.
• Booking references: booking numbers/PNR and surnames for flight bookings (sensitive data, stored encrypted).
• Security data: technical information about your sign-in used to detect suspicious activity.

Sensitive data

Some of the data you enter is especially sensitive - for example passport and ID numbers, health documents and booking references/PNR. This is stored encrypted, never shown in email or notifications, and never exposed to third parties unless you request it yourself. Revealing a full PNR requires an extra password-protected step and is off by default.

Recipients and sub-processors

We use the following sub-processors. We never sell your data and never share it for marketing purposes.

• Stripe – Payments and subscription handling. Card details are handled by Stripe, not by us.
• Mailgun – Email delivery (outgoing messages and incoming booking email).
• OpenAI – Interprets the content of booking confirmations you submit, to create bookings automatically.
• Amadeus – Flight times and flight schedule lookups on demand.
• SAS – Fetching SAS bookings (PNR) and award availability.
• Google Places – Autocomplete and lookup of places and addresses.
• TripIt – Importing trips and flights if you choose to connect your TripIt account.
• Apple – Sign in with Apple if you choose to use it.
• Push providers – Delivery of push notifications to your browser or device.
• IPinfo – Security scoring of sign-ins (IP/ASN).
• Connected AI providers – If you connect an AI agent (e.g. Claude or ChatGPT), your travel data is shared with that provider. See the AI agents section below.
• Web hosting – Operation and storage of the service.

AI agents and MCP

ReseAssistenten can be connected to AI agents (e.g. Claude or ChatGPT) via MCP (Model Context Protocol). When you connect an agent it can read - and, depending on the permissions you grant, change - your trips, bookings and documents on your behalf.

You decide which permissions (read, write, delete) the agent receives, and you can disconnect the agent or revoke its access at any time in your settings. Revealing a full PNR is off by default and requires an extra step.

The lawful basis for this sharing is your consent (GDPR Art 6(1)(a)). Purchases and subscriptions can never be made through an AI agent.

Retention periods

We retain data only as long as necessary:

• Account data: as long as your account is active. Inactive accounts may be removed after notice.
• Invoice data: 7 years (Swedish accounting law).
• Trips and bookings: removed when you delete them or your account.
• Travel documents and traveller data: removed when you delete them or your account.
• Security/session data: retained for a limited time and purged on objection or account deletion.
• Technical logs: maximum 90 days.

Security and fraud prevention

We collect a hash of your device type, IP address and approximate location to detect suspicious activity on your account. We do this on the basis of legitimate interest (GDPR Art 6(1)(f)). You have the right to object to this processing - contact us at support@reseassistenten.se.

In practice, technical information about your sign-in is used to detect unusual patterns, such as a login from a new device or suspicious activity. The result is only visible to administrators.

No automated decisions are made based on the score - a human always reviews before any account is blocked. You have the right to request human review (GDPR Art 22) and the right to object (GDPR Art 21) by emailing support@reseassistenten.se.

Cookies

We use only strictly necessary cookies. No cookies are used for marketing, profiling, or cross-site tracking.

• Laravel session cookie - keeps you signed in.
• XSRF-TOKEN - security cookie that protects forms.
• Stripe Checkout cookie - set only during payment.

Strictly necessary cookies do not require consent under the Swedish Electronic Communications Act, Chapter 6 §18.

Your rights

Under the GDPR you have the right to:

• Access the data we hold about you (Art 15).
• Have inaccurate data corrected (Art 16).
• Have your data erased (Art 17), unless other law requires us to keep it.
• Request that we restrict processing (Art 18).
• Receive your data in a machine-readable format (Art 20).
• Object to processing based on legitimate interest (Art 21).
• Lodge a complaint with the Swedish Authority for Privacy Protection (IMY) - https://www.imy.se.

Contact us at support@reseassistenten.se to exercise your rights.

Age limit

The service is not directed at children under 16. If we become aware that we are processing personal data about a child under 16 without a guardian's consent, we will delete the data.

Automated decision-making

We do not make any solely automated decisions that produce legal or similarly significant effects on you (GDPR Art 22). The risk scoring described above is decision support for a human administrator - it never blocks an account automatically.

International transfers

Some sub-processors may be located outside the EU/EEA. Transfers are made with appropriate safeguards in accordance with the GDPR.

Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email or via an in-service banner. The date above shows when the policy was last changed.

Contact

Questions about how we process your personal data? Email us at support@reseassistenten.se.