Privacy Policy
Last updated: 10/26/2026
Who is responsible for your data
The controller of personal data processed by TripPal (trippal.pl) is Grzegorz Duda. Contact for all privacy matters: kontakt@trippal.pl.
What data we process and why
Account: name, e-mail address and profile photo from your Google account, used to sign you in. Profile: bio, languages, travel style and WhatsApp number you enter, shown to other travelers so they can decide whether to travel with you. Trips and requests: trips you publish and requests you send or receive. Your e-mail and WhatsApp number are shared only with the other side of an accepted request. Taxi sharing: name, e-mail, optional WhatsApp number and flight details you leave in the sign-up form, used to match you with travelers on the same flight. E-mail notifications about your trips and requests.
Legal basis
We process data to provide the service you use (Art. 6(1)(b) GDPR) and, for security and basic statistics on which campaigns bring visitors, on the basis of our legitimate interest (Art. 6(1)(f) GDPR).
Cookies and statistics
We use a session cookie to keep you signed in. When you arrive from a link with campaign parameters (utm_*), we store them in the tp_utm cookie for 30 days and save them with your account if you sign up then; it contains only the campaign names, not your browsing. Page statistics come from Vercel Web Analytics, which does not use cookies and does not identify you.
Who processes data for us
Vercel (hosting and statistics), Supabase (database, servers in the EU), Google (sign-in) and Resend (sending e-mails). They process data only on our behalf. Some of them are based in the USA and transfer data on the basis of the EU–US Data Privacy Framework or standard contractual clauses.
How long we keep data
As long as you have an account. After you ask us to delete it, we remove your profile, trips and requests within 30 days, except data we must keep by law.
Your rights
You can access, correct or delete your data, restrict or object to its processing, and move it to another service. Write to the address above. You can also lodge a complaint with the supervisory authority (in Poland: President of the Personal Data Protection Office, UODO).