Privacy notice

Who is responsible

The controller responsible for the processing described on this page is:

Privacy questions and requests:

support@aryaren.com

No data protection officer has been formally appointed. Privacy questions and requests go to the address above.

[Legal review required: whether a data protection officer must be appointed]

What this notice covers

Aryaren is a web app for planning trips. The public pages are at aryaren.com; the planning app, sign-in and API are at app.aryaren.com.

Aryaren currently runs as a closed pilot. Accounts are created only by invitation; there is no open registration.

Sign-in and your account

Sign-in is handled by Amazon Cognito, an AWS service running in the eu-central-1 region (Frankfurt). Cognito holds:

• your email address, which is also your username;
• whether your email address is verified;
• your password. You enter it only on the Cognito sign-in page; Aryaren never receives or stores it.

Aryaren itself stores:

• an internal account ID linked to your Cognito identifier, and your account status (active or disabled);
• a display name derived from the part of your email address before the at sign;
• your language;
• a copy of your verified email address, refreshed each time you sign in, and the time of your last sign-in.

Aryaren does not ask for your name and does not collect a phone number. Multi-factor authentication is currently switched off.

Planned, not active: for public registration, sign-in security codes sent by SMS are planned. They would require a mobile phone number. This notice describes the current system and has to be updated before that change goes live.

When you sign in, Aryaren creates a session that is valid for 12 hours. The database keeps only a hash of the session ID, its validity times and whether it was revoked: no IP address and no browser information. Signing out ends the Aryaren session and then the Cognito sign-in session.

The sign-in tokens issued by Cognito are checked once on the server and then discarded. They are not stored, not logged and never sent to your browser.

Invitations and email

Aryaren does not run its own mail service. Invitation and account-recovery emails are sent by Cognito’s default email sender. Aryaren sends no newsletters and no marketing emails.

An invitation email contains generic text with your username, a temporary password and a sign-in link. It contains no trip details and does not name the person who invited you.

For each invitation Aryaren stores the invited email address, the role, the invitation and delivery status, and timestamps. Invitations that have ended (accepted, revoked or expired) are deleted 30 days after they end.

Trips, plans and sharing

What you enter for a trip is stored in Aryaren’s database:

• title, dates, destination, currency, language and home time zone;
• the travel party: the number of adults and, for each child, only an age band (0–1, 2–4, 5–11 or 12–17), never names or dates of birth;
• budget limit, pace and interests;
• plan items you approve: kind, title, timing, place description and notes.

Only the owner of a trip can share it, and only with active members of the same workspace. The people you share with see the trip according to their role. The owner of a trip or workspace sees the display names and email addresses of its members.

AI-generated proposals

When you ask for a proposal, Aryaren sends a minimised request to the AI model Claude Haiku 4.5 by Anthropic, through Amazon Bedrock. Only an EU inference profile is allowed, so the request may be processed in one of these AWS regions in the EU:

• eu-central-1
• eu-north-1
• eu-south-1
• eu-south-2
• eu-west-1
• eu-west-3

Sent: your request text, the trip constraints (destination, travel party with child age bands, budget, pace, interests), the trip dates, the destination’s time zone, the display currency, the output language and your fixed plan items (kind, title, place description, timing).

Not sent: names or email addresses of you or other members, internal IDs, the trip title, notes, booking references, imported files and unreviewed import candidates.

The model has no tools: it cannot browse the web, book or pay for anything.

The model’s answer is checked and stored as a proposal for you to review. Your request text is deleted as soon as the run ends.

[Legal review required: the AI provider’s data retention and model-training position]

Imported files

You can upload files such as booking confirmations as .txt or .ics files of up to 256 KiB each. Each file is scanned for malware on Aryaren’s own server; it is not sent anywhere else for scanning.

The original file is stored encrypted in Amazon S3 in the eu-central-1 region.

Aryaren extracts candidate plan items from the file. The full extracted text is not kept, booking references are reduced to their last two characters, and email addresses and phone numbers in the text are masked.

You can delete an import at any time; the stored file is then permanently deleted. Files of rejected or failed imports are deleted after 7 days, infected files immediately. Files of successful imports are kept until you delete the import.

Security, logs and telemetry

All data is stored in the AWS region eu-central-1: the database on encrypted disks of a single server, files and backups in encrypted S3 storage.

Aryaren does not store your IP address or browser information in its database, and no web server access log is configured.

Operational telemetry (traces, metrics and logs) contains only IDs, status codes and counters, never message text, titles or other content. It is kept on the server for 14 days; operational logs in Amazon CloudWatch are kept for 30 days.

Security events for sign-ins and invitations and the audit trail of actions (who changed which item and when) contain no email address, IP address or content, and each is deleted after 90 days.

Access to the production systems is limited to Aryaren’s operators. They reach the server only through AWS Systems Manager; there is no open SSH access. Operator commands use a separate database role with minimal rights, and restoring a backup needs a separate role with multi-factor authentication. Anyone with operator access to the server can technically read the database.

Please report a suspected security or privacy incident to the address in “Who is responsible”. Internally, an incident is detected, contained, assessed and documented, and a decision is then made on notifying the authorities and the people affected.

[Legal review required: obligations and deadlines for notifying authorities and affected people after a data breach]

Backups

The database is backed up daily and continuously to encrypted S3 storage in eu-central-1. Backups are locked against deletion for 35 days and expire after about 36 days.

Data deleted from the live system therefore remains in backups until they expire.

How long data is kept

These deletion periods are implemented in the system today:

There is no automatic deletion period for your account and its email copy, workspaces and memberships, trips, constraints, proposals and plan items, and AI cost records. They are kept while your account exists and are deleted when your account is deleted on request (see “Your rights”); your Cognito user is deleted at the same time.

Service providers

Aryaren uses the following services. The table describes their technical role only.

[Legal review required: legal role of each service provider (processor, sub-processor or controller) and the agreements relied on]

[Legal review required: international data transfers and the safeguards relied on]

Legal bases

Each purpose described here (sign-in, invitations, trip planning, AI proposals, imports, security and audit logs, backups, operational telemetry, the language cookie) needs a legal basis under the GDPR and, where applicable, the Turkish data protection law (KVKK). These have not been determined yet.

[Legal review required: legal basis for each processing purpose]

Your rights

Depending on the applicable law, such as the GDPR or the KVKK, you may have the right to access your data, to have it corrected or erased, to restrict or object to processing, to data portability and to lodge a complaint with a supervisory authority.

In the app you can sign out and delete individual imports. All other requests – access to your data, correction, deletion of your account, or restriction of or objection to processing – are handled by an operator; send them to the address in “Who is responsible”.

To protect your account, we answer to the email address of the account concerned, or ask you to confirm the request from it, before we act. Each request is recorded together with the date it was answered.

[Legal review required: legal response periods for data-subject requests (GDPR, KVKK)]

When your account is deleted, an operator ends all of its sessions, deletes your Cognito user and your stored import files, and deletes your workspace with its trips, constraints, proposals, plan items and imports, your memberships and shares, and the copy of your email address. Trips in other people’s workspaces stay there. Your account remains only as an anonymous placeholder so that security records stay consistent; these records contain no email address, IP address or content and are deleted after 90 days. Backups keep the previous state until they expire after about 36 days.

Children

Aryaren accounts are only for people aged 18 or older. Aryaren is not directed at children and does not invite or encourage anyone under 18 to create an account.

There is no parental-consent process: a person under 18 cannot hold an Aryaren account, even with a parent’s permission.

Aryaren stores children’s data only as an age band that an adult enters for the travel party.

For trip planning, Aryaren never asks for a child’s name, exact date of birth or contact details. A child in the travel party is recorded only as an age band (0–1, 2–4, 5–11 or 12–17).

If we learn that an account belongs to someone under 18, an operator disables it immediately, which ends all of its sessions and blocks sign-in, and then deletes it as described in “Your rights”. Where appropriate we tell the account’s email address before it is deleted. A fingerprint (hash) of the email address is kept so that no new account can be created for it; the address itself is not kept.

Related pages

• Cookies & storage
• Terms of use
• Contact