Privacy policy
Last updated: November 2026
This is an English translation for your convenience. Only the German version is legally binding.
Controller
Timothy Kugler, In den Peterswiesen 16, 71566 Althütte, Germany
Email: contact@wanderwanda.com
In short
- You don't need an account. Wanda sets no cookies and uses no analytics or advertising trackers.
- Your messages are processed to plan your trip and deleted after 24 hours at the latest.
- To plan, your messages go to an AI service in the USA that doesn't store them. Please don't enter names, contact details or other personal information the planning doesn't need.
Hosting and server logs
Wanda runs on Google Cloud (Google Cloud EMEA Limited, Ireland) in a data centre in Belgium (region europe-west1). With every request, the server records technical data in log files: IP address, time, requested address, browser identifier and response code. This is needed to run Wanda securely and reliably and to find errors (Art. 6(1)(f) GDPR). The logs are deleted after 30 days. Google processes this data on my behalf (Art. 28 GDPR).
Trip planning in the chat
When you write to Wanda, I process your messages to create and adjust your trip plan (Art. 6(1)(b) GDPR). The conversation and plan are kept only in the server's memory and are deleted at the latest 24 hours after your last message, or earlier when the server restarts. For each conversation, the logs contain only a random identifier, duration and cost, not the content.
So that a conversation survives reloading the page, your browser stores its random identifier in local storage (localStorage). This is strictly necessary for the function you requested (§ 25(2) no. 2 TDDDG). "New trip" or clearing the site data in your browser removes it.
AI processing and web search
To create your plan, I send your messages together with travel data to OpenRouter, Inc. (USA), which forwards them to the provider of the language model (currently OpenAI). I only use endpoints without data retention ("zero data retention"): your input is not stored after the response and not used for training. For current information the model can search the web; the searches are handled by Exa Labs, Inc. (USA) via OpenRouter.
Transfers to the USA are based on an adequacy decision of the European Commission (EU-US Data Privacy Framework, Art. 45 GDPR) where the recipient is certified, and otherwise on EU standard contractual clauses (Art. 46(2)(c) GDPR).
Offers from travel partners
For prices and availability, Wanda's server queries partners such as Agoda (stays), Viator (activities) and Ferryhopper (ferries). Only travel details are sent, such as places, dates and the number of travellers, never your IP address or your messages.
Links to booking partners
Booking links lead to the partners' websites (for example Agoda, Viator, FlixBus or Ferryhopper). They are affiliate links: they contain my partner ID so the partner can attribute a booking to me and pay a commission. As soon as you follow a link, the partner processes your data under its own responsibility, possibly using cookies; its privacy policy applies. I receive no information from partners that identifies you personally.
If you email me, I process your message and email address to answer your request (Art. 6(1)(b) or (f) GDPR) and delete them once they're no longer needed for that.
Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21). To do so, write to the email address above.
You can also lodge a complaint with a data protection supervisory authority, for example the one responsible for me: the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (baden-wuerttemberg.datenschutz.de).