Privacy policy

Last updated: March 1, 2026 · Version 1.0.1

Overview

ReseAssistenten (a service from Mindtravel) takes your privacy seriously. This page describes what personal data we process, why, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR).

Data controller

The data controller is Mindtravel, contactable at support@reseassistenten.se. Mindtravel operates the ReseAssistenten service (also known as Award Planner).

Purposes and lawful bases

We process data for the following purposes:

Providing the service (account, trips, bookings) – Lawful basis: contract (GDPR Art 6(1)(b)). Without this data we cannot provide the service.
Subscription and payment handling – Lawful basis: contract (GDPR Art 6(1)(b)) and legal obligation for accounting (GDPR Art 6(1)(c)).
Sending service-related email (booking updates, password resets, alerts) – Lawful basis: contract (GDPR Art 6(1)(b)).
Security and fraud prevention (login risk scoring) – Lawful basis: legitimate interest (GDPR Art 6(1)(f)). See dedicated section below.
Processing booking confirmations you submit to the service – Lawful basis: contract (GDPR Art 6(1)(b)). The content may be processed by third-party providers - see Recipients below.

What data we process

We process the following categories of data:

Account data: name, email, password (hashed), language preference.
Billing data: handled by Stripe - we only store a Stripe customer id, not the card number.
Trips and bookings you add or import.
Security data: technical information about your sign-in used to detect suspicious activity.

Recipients and sub-processors

We use the following sub-processors. We never sell your data and never share it for marketing purposes.

Provider for payments and subscription handling.
Provider for email delivery.
AI provider used in some cases to process content you submit yourself.
Provider for security scoring.
Provider for web hosting.

Retention periods

We retain data only as long as necessary:

Account data: as long as your account is active. Inactive accounts may be removed after notice.
Invoice data: 7 years (Swedish accounting law).
Trips and bookings: removed when you delete them or your account.
Security/session data: retained for a limited time and purged on objection or account deletion.

Security and fraud prevention

We collect a hash of your device type, IP address and approximate location to detect suspicious activity on your account. We do this on the basis of legitimate interest (GDPR Art 6(1)(f)). You have the right to object to this processing - contact us at support@reseassistenten.se.

In practice, technical information about your sign-in is used to detect unusual patterns, such as a login from a new device or suspicious activity. The result is only visible to administrators.

No automated decisions are made based on the score - a human always reviews before any account is blocked. You have the right to request human review (GDPR Art 22) and the right to object (GDPR Art 21) by emailing support@reseassistenten.se.

Cookies

We use only strictly necessary cookies. No cookies are used for marketing, profiling, or cross-site tracking.

Session cookie - keeps you signed in.
Security cookie - protects forms.
Payment cookie - set during payment.

Strictly necessary cookies do not require consent under the Swedish Electronic Communications Act, Chapter 6 §18.

Your rights

Under the GDPR you have the right to:

Access the data we hold about you (Art 15).
Have inaccurate data corrected (Art 16).
Have your data erased (Art 17), unless other law requires us to keep it.
Request that we restrict processing (Art 18).
Receive your data in a machine-readable format (Art 20).
Object to processing based on legitimate interest (Art 21).
Lodge a complaint with the Swedish Authority for Privacy Protection (IMY) - https://www.imy.se.

Automated decision-making

We do not make any solely automated decisions that produce legal or similarly significant effects on you (GDPR Art 22). The risk scoring described above is decision support for a human administrator - it never blocks an account automatically.

International transfers

Some sub-processors may be located outside the EU/EEA. Transfers are made with appropriate safeguards in accordance with the GDPR.

Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email or via an in-service banner. The date above shows when the policy was last changed.

Contact

Questions about how we process your personal data? Email us at support@reseassistenten.se.