Privacy Policy

1. Controller

Avamundo, Patrick Kieber, Heiligwies 6, 9486 Schaanwald, Liechtenstein
Email: legal@avamundo.com

This policy applies to AnnaMundo (annamundo.com) and covers data collected when you use our city guides, create an account, submit tips, or purchase an itinerary pass. It also applies to our language learning subdomains — mandarin.annamundo.com, japanese.annamundo.com, and any future language subdomains.

2. Data We Collect and Why

Account data

When you register, we collect your email address, password (stored as a bcrypt hash), and optionally your first and last name. Legal basis: contract performance (Art. 6(1)(b) GDPR).

User-generated content

Tips you submit to city guides, itinerary preferences (travel dates, interests, budget, group type, personal notes), and generated itineraries are stored and linked to your account. Legal basis: contract performance (Art. 6(1)(b) GDPR).

Payment data

When you purchase an itinerary pass, payment is processed by Stripe, Inc. We never see or store your card details — Stripe handles all card data directly. We store only the Stripe session ID and pass type to activate your pass. Legal basis: contract performance (Art. 6(1)(b) GDPR).

Newsletter subscription

If you subscribe to our newsletter, we store your email address to send you travel updates and content. Legal basis: explicit consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the unsubscribe page.

Server logs

Our hosting provider automatically records standard server access logs (IP address, browser type, pages visited, date/time). Logs are retained for a maximum of 7 days for security purposes and are not linked to your identity.

3. AI Processing (Mistral)

To generate personalised itineraries, we send your travel preferences (number of days, travel month or dates, group type, interests, budget level, and any personal notes you enter) to Mistral AI (mistral.ai). Mistral processes this data on servers located in the EU to generate your itinerary text.

Submitted local tips are also reviewed by Mistral AI to check quality before publication.

We do not send your name, email, or account details to Mistral — only the travel preferences required to generate the itinerary. Legal basis: contract performance (Art. 6(1)(b) GDPR). Mistral's privacy policy is available at mistral.ai/privacy.

4. Infrastructure & Data Processors

Your data is processed by the following third-party services:

• Hetzner Online GmbH (server hosting) — Industriestr. 25, 91710 Gunzenhausen, Germany. Data stored on servers in Germany (EU). Privacy Policy
• Stripe, Inc. (payment processing) — 354 Oyster Point Blvd, South San Francisco, CA, USA. Stripe is certified to PCI DSS Level 1 and is an EU-approved standard contractual clauses processor. Privacy Policy
• Mistral AI SAS (AI processing for AnnaMundo itineraries) — 15 rue des Halles, 75001 Paris, France. Privacy Policy
• Infomaniak Network AG (email hosting) — Rue Eugène-Marziano 25, 1227 Geneva, Switzerland. Privacy Policy
• Microsoft Azure Cognitive Services (text-to-speech, for our language learning subdomains) — data processed in the EU West region. Privacy Policy
• AI language model providers (lesson and content generation, for our language learning subdomains) — third-party AI providers used to generate lessons and learning content.
• Avatar and media generation services (teacher avatar content, for our language learning subdomains) — third-party services used to generate teacher avatar media. Generation is one-time; the resulting media is stored on our own infrastructure.

We do not use any analytics, advertising, or tracking services.

5. Cookies & Local Storage

AnnaMundo does not use tracking or advertising cookies. We use your browser's localStorage for the following purposes only:

• Authentication tokens — to keep you logged in across sessions
• Bookmarks — to save city guides locally on your device
• Language preference — to remember your chosen language

This data is stored only on your device and never transmitted to third parties.

6. Data Retention

• Account data: retained while your account is active. Deleted within 30 days of account deletion.
• Itineraries & tips: retained while your account is active.
• Payment records: retained for 10 years as required by Liechtenstein and EU financial law.
• Newsletter emails: retained until you unsubscribe.
• Server logs: deleted after 7 days.

7. Your Rights

Under GDPR (applicable in Liechtenstein as an EEA member state), you have the right to:

• Access — request a copy of all personal data we hold about you
• Portability — receive your data in a machine-readable format
• Rectification — correct inaccurate data
• Erasure — request deletion of your account and data
• Object — to processing based on legitimate interests at any time (Art. 21 GDPR); contact us to exercise this right
• Withdraw consent — unsubscribe from the newsletter or withdraw AI personalisation consent at any time
• Lodge a complaint — with the Liechtenstein Datenschutzstelle (DSS) at datenschutzstelle.li, or your national supervisory authority

You can exercise your right to access and erasure directly in your account settings using the "Download my data" and "Delete account" functions. For other requests, contact us at legal@avamundo.com. We respond within 30 days.

8. Changes to This Policy

We may update this policy as the service evolves. We will note the date of the last update at the top of this page. Continued use of AnnaMundo after a policy update constitutes acceptance of the new policy.