Privacy Policy and Terms of Service

Last updated: 16 October 2026 · version 2026-10-16 (beta)

This notice explains what personal data AmeryGo collects, why we process it, who we share it with and what rights you can exercise. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (the GDPR) and, as regards artificial intelligence, Regulation (EU) 2024/1689 (the AI Act).

AmeryGo uses artificial intelligence to build travel itineraries. Section 4 sets out plainly how it works, what data it works on, what it can get wrong and what control you keep over what it produces. If you read only one section, read that one.

1. Who processes your data

The data controller is the individual named below, who offers AmeryGo during its free trial phase (beta) and determines the purposes and means of the processing described in this notice. If AmeryGo is later run by a company, the processing will pass to that company and we will tell you beforehand.

Giorgio Capizzi — private individual, Catania (Italy)

For any matter concerning your personal data, and to exercise the rights described in section 8, write to privacy@amerygo.com. We reply within one month of your request, as required by Article 12(3) GDPR.

We have not appointed a Data Protection Officer: the conditions in Article 37(1) GDPR do not apply, because we are not a public authority, we do not carry out large-scale systematic monitoring and we do not process special categories of data on a large scale. Should this change, we will say so here.

2. What data we collect

We collect only the data the service needs in order to work. Here is the complete list, by category.

• Account data. Your email address and the user identifier assigned by Google Firebase. Your password never reaches our systems: Firebase handles it entirely and we can neither read nor recover it.
• Travel requests. Destination, departure and return dates, budget, number of travellers, chosen activity style, dietary preferences and the text of the messages you write in the chat.
• Itineraries. The complete plan generated and saved in your profile: stops, times, geographic coordinates, transfers, cost estimates and any changes you make to them.
• Tickets uploaded to the Wallet. The PDF files you upload (tickets, bookings, vouchers) and the text we extract from them to attach them to the right stop.
• No payment data. During the beta AmeryGo is free and no subscription is on sale: we do not collect card, account or transaction data.
• Usage data. The type of action performed (chat, flight search, itinerary generation, audio guide) and when it happened, plus the number of tokens consumed and the cost of each model call.
• Technical data. IP address and timestamp of requests, needed for authentication, to apply your plan's usage limits and to detect abuse.

Special categories of data (Article 9 GDPR). Some information you might enter — a halal or kosher dietary preference, or one tied to a health condition such as coeliac disease — can reveal religious beliefs or health data. We process it only if you enter it yourself, solely to select compatible restaurants and meals, and on the basis of your explicit consent under Article 9(2)(a) GDPR. You can remove it at any time from your trip preferences. We ask you not to enter other sensitive data in the chat (ethnic origin, political opinions, sexual orientation, genetic or biometric data): AmeryGo is not designed to process it.

3. Why we process it and on what legal basis

Every processing operation has a specific purpose and a legal basis among those in Article 6 GDPR. No data is used for purposes other than those set out here.

• Creating and managing your account. Legal basis: performance of a contract, Article 6(1)(b) GDPR.
• Generating, saving and editing itineraries, and attaching tickets to stops. Legal basis: performance of a contract, Article 6(1)(b) GDPR.
• Selecting meals and restaurants compatible with your dietary needs, where these reveal religious beliefs or health conditions. Legal basis: explicit consent, Article 9(2)(a) GDPR.
• Complying with legal obligations, for example answering lawful requests from public authorities and keeping proof that you accepted these terms. Legal basis: legal obligation, Article 6(1)(c) GDPR.
• Keeping the platform secure, preventing abuse and enforcing plan usage limits. Legal basis: legitimate interests, Article 6(1)(f) GDPR.
• Measuring the consumption and cost of the AI models, to keep the service sustainable and correctly sized. Legal basis: legitimate interests, Article 6(1)(f) GDPR.
• Asking for your opinion with a short questionnaire after your first saved trip. It is optional: the answers stay linked to your account and help us understand what to improve. Legal basis: legitimate interest, Art. 6(1)(f) GDPR. You can skip it or choose “No, thanks”.
• Sending you a single email reminder about the questionnaire, only if you ask for it with “Remind me tomorrow by email”. Legal basis: consent, Art. 6(1)(a) GDPR.

Providing your data is not a statutory requirement, but it is necessary to use the service: without an email we cannot create the account, without a destination and dates we cannot build an itinerary. Where the legal basis is legitimate interests, we have assessed that our interest does not override your fundamental rights and freedoms, and you may object at any time (section 8).

4. The artificial intelligence inside AmeryGo

AmeryGo is an AI system within the meaning of Article 3(1) of Regulation (EU) 2024/1689 (the AI Act). It is not among the practices prohibited by Article 5, nor among the high-risk systems listed in Annex III. The obligations that apply to us are the transparency obligations of Article 50, which we meet through this section.

• You are interacting with an AI system. The AmeryGo chat, the itinerary and the suggestions are generated automatically by language models. No person writes the replies. (Article 50(1) AI Act)
• The content is artificially generated. Activity descriptions, audio-guide scripts and proposed schedules are produced by a model. Audio-guide audio is a synthetic voice, not a recording of a real person. (Article 50(2) AI Act)
• What data the system works on. The model receives your destination, dates, budget, number of travellers, activity style, preferences and the messages you write in the chat, together with public information retrieved from the web. It does not receive your email address, your account identifier, your payment data or the holder's name on the tickets you upload: names and contact details on tickets are automatically redacted, across all supported languages, before the document reaches the model.
• What the system can get wrong. A language model can produce inaccurate information: an out-of-date opening time, a place that has been renamed or no longer exists, a stale price, a badly calculated distance. AmeryGo itineraries are a planning tool, not a booking: always check times, prices and availability through official channels before you travel or pay.
• You stay in control. No itinerary is executed, booked or paid for automatically. You can edit, reorder or delete any stop, regenerate the itinerary or discard it. We do not take solely automated decisions producing legal effects concerning you or similarly significantly affecting you: Article 22 GDPR therefore does not apply.
• Your conversations do not train the models. We use the models through the professional interfaces of the providers listed in section 5, configured so that the content sent is not used to train models. We neither give away nor sell your conversations to third parties for training purposes.
• The checks are not run by another model. Whether an itinerary holds together — times that work, transfers that are possible, a budget that adds up — is verified by deterministic checks written in code, not by a second AI model. They are repeatable, always return the same result on the same data, and are covered by automated tests.

AI literacy (Article 4 AI Act). Those at AmeryGo who design, configure and oversee how the models operate have an adequate understanding of how they work, of their limits and of the risks they pose to people.

5. Who we share your data with

To deliver the service we rely on suppliers who process data on our behalf as processors (Article 28 GDPR), bound by an agreement requiring them to process data only on our instructions. Each receives only the minimum its function needs.

• Authentication — Google Firebase Authentication. Receives your email address and account identifier. It does not receive your trips.
• Language models — DeepInfra, Inc. (2625 Middlefield Road #460, Palo Alto, CA 94306), United States; OpenRouter, Inc. (169 Madison Ave #2404, New York, NY 10016), United States, only as a fallback when DeepInfra does not respond. They receive the text of your requests and the trip data described in section 4, without your email, your name or your account identifier. DeepInfra states in its documentation that texts are held in memory only while they are processed and are not written to disk, that it does not use them to train models or share them with third parties, and that its logs keep only technical data (request ID, cost, parameters), never the content. On OpenRouter, requests go only to Zero Data Retention providers, which neither retain the texts nor use them to train models.
• Speech synthesis — Google AI (Gemini); for audio guides in English, DeepInfra. They receive only the audio guide text to turn into speech.
• Flight and accommodation search — Travelpayouts (Aviasales), Ignav and Google Hotels via SerpAPI. They receive origin, destination, dates and number of travellers. They do not receive your identity.
• Restaurant and public-information search — SerpAPI, Tavily, Wikipedia. Receive search terms built from your destination and preferences. They do not receive your identity.
• Maps, geocoding and routing — Nominatim / OpenStreetMap, OSRM, Mapbox. Receive place names and coordinates, to position stops on the map and calculate transfers. They do not receive your identity.
• Images — Unsplash. Receives the name of a city or activity and returns a public photograph.
• File storage — Cloudflare R2. Stores, in encrypted form, the ticket PDFs you upload and the audio-guide sound files.
• Error monitoring — Sentry. When something goes wrong it receives the technical details of the error (requested page, browser type, the part of the code involved). It is configured not to receive your email or your IP address.
• Service emails — Brevo (Sendinblue SAS, France, European Union). Delivers account emails, such as the welcome email, the survey reminder and the deletion confirmation, sent from hello@amerygo.com and support@amerygo.com. It receives your email address and the text of the message.
• Hosting and database — Scalingo (France, European Union). It hosts the site and stores on our behalf, on servers in the European Union, the account and trip data described in section 2.

We do not sell your personal data and we do not share it with third parties for marketing purposes, whether ours or anyone else's. An up-to-date list of processors is available on request at privacy@amerygo.com. Data may also be disclosed to public authorities where the law requires it.

6. Transfers outside the European Economic Area

Some of the providers in section 5 are based, or have servers, outside the European Economic Area, in particular in the United States. For Google (Firebase and Gemini), Cloudflare, Sentry and Mapbox the transfer relies on the European Commission's adequacy decision for companies certified under the EU-U.S. Data Privacy Framework (Article 45 GDPR). For OpenRouter it relies on its data processing agreement (DPA), which includes the European Commission's Standard Contractual Clauses (Article 46(2)(c) GDPR); the same applies to the other providers that make them available. DeepInfra offers neither a DPA nor the Standard Contractual Clauses: for texts sent to DeepInfra the measures described in section 5 apply — we send neither your email, your name nor your account identifier, and DeepInfra states that it does not retain the texts, use them to train models or share them. For this reason we ask you not to write in the chat personal data that the trip does not need. You can ask for a copy of the safeguards applied to a specific provider by writing to privacy@amerygo.com.

7. How long we keep your data

We do not keep data longer than the purpose for which we collected it requires (Article 5(1)(e) GDPR).

• Account data. Until you delete your account, which you can do at any time from your profile. Deletion is immediate and irreversible.
• Saved itineraries. As long as you keep them in your profile: you can delete them individually at any time.
• Tickets uploaded to the Wallet. For the period you choose when uploading — 30, 90, 180 or 365 days. If you do not choose, 90 days applies. The file is deleted automatically on expiry.
• At the end of the beta. Your account and trips stay in your profile and you will find them when the service continues, unless you delete your account. If AmeryGo closes without continuing, we delete all data within 60 days and tell you by email beforehand.
• Technical and security logs. Twelve months.
• Model usage logs. Twenty-four months linked to your account, then in aggregate form no longer traceable to you.
• Questionnaire answers. Up to 24 months after you send them, then we delete them automatically; earlier if you delete your account.

When you delete your account we remove from our systems the data listed above and your Firebase user.

8. Your rights

The GDPR gives you the following rights. They are free of charge and you can exercise them at any time.

• Access (Article 15): find out whether we process your data and obtain a copy of it.
• Rectification (Article 16): correct inaccurate or incomplete data.
• Erasure (Article 17): delete your data. Your profile has a Delete account button: deletion is immediate and irreversible, and covers itineraries, tickets, audio guides and your Firebase user record.
• Restriction (Article 18): ask us to suspend processing pending a check.
• Portability (Article 20): receive your data in a structured, machine-readable format. We send a copy in JSON on request.
• Objection (Article 21): object to processing based on our legitimate interests.
• Withdrawal of consent (Article 7(3)): withdraw consent for sensitive dietary preferences and for notifications. Withdrawal does not affect the lawfulness of processing carried out beforehand.
• Automated decisions (Article 22): we do not take any. See section 4.

You can exercise access, rectification and erasure directly from your profile. For the other rights, write to privacy@amerygo.com: we reply within one month, extendable by two further months for particularly complex requests, telling you within the first month if we need the extension.

Complaint to a supervisory authority (Article 77 GDPR). If you believe the processing of your data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority. In Italy this is the Garante per la protezione dei dati personali — Piazza Venezia 11, 00187 Rome — garante@gpdp.it — www.gpdp.it. If you live in another EU country you may contact your national authority. Your right to seek a judicial remedy is unaffected.

9. How we protect your data

We apply technical and organisational measures appropriate to the risk (Article 32 GDPR): traffic encrypted in transit with TLS, authentication handled by Google Firebase with short-lived tokens, protection against cross-site request forgery (CSRF), request rate limits to prevent abuse, ticket and audio-guide files stored encrypted, automatic redaction of names and contact details before anything is sent to the models, and access to production data restricted to staff who genuinely need it. The platform code is covered by more than three thousand automated tests, run on every change. No measure removes risk entirely: were a breach to occur that poses a high risk to your rights and freedoms, we would tell you without undue delay (Article 34 GDPR) and notify the Garante within seventy-two hours (Article 33 GDPR).

10. Children

AmeryGo is reserved for people aged at least 18 and we do not knowingly collect personal data from anyone younger. If you are a parent or guardian and believe a minor has given us their data, write to privacy@amerygo.com and we will delete it without delay.

11. Cookies and browser storage

AmeryGo uses no profiling cookies, hosts no third-party analytics tools and does not track your browsing on other sites. We use your browser's local storage to remember the light or dark theme, your chosen language and your sign-in session: these are technical items necessary for the service to work, they stay on your device and they require no consent under Article 122 of the Italian Data Protection Code. You can clear them at any time from your browser settings. Some visual resources on the page (fonts and icons) are downloaded from Google Fonts and from public content delivery networks (jsDelivr, cdnjs): to deliver them, those servers receive your device's IP address, as happens for any web resource, but they receive no cookies and no data from your account.

12. Changes to this notice

If we change this notice we update the date and version number at the top of the page. If the change materially affects how we process your data we tell you by email and, where fresh acceptance is needed, we ask for it the next time you sign in. The previous version remains available on request.

Terms and Conditions of Service

By creating an account you accept the following.

• What AmeryGo is. A tool for AI-assisted travel planning. It is not a travel agency or a tour operator: it does not sell flights, accommodation or experiences, and it does not enter into travel contracts on your behalf.
• Bookings and affiliate links. The Book links take you to third-party sites: the purchase contract is concluded with them and on their terms, and we are not a party to it. Some links are affiliate links: if you book through one, we may receive a commission from the operator. Your price does not change and the commission does not decide which offers we show you.
• Accuracy of information. Prices, times, availability and descriptions are estimates gathered from public sources and processed by AI models at the moment of your request. They may be inaccurate or out of date: always check them against the official source before booking or travelling.
• Documents and entry requirements. Passports, visas, vaccinations and insurance remain your responsibility. Anything AmeryGo tells you is informational and does not replace official sources.
• Fair use. Do not use the service for unlawful purposes, to extract data automatically, to get around the beta limits (for example with several accounts) or to generate content that infringes the rights of others.
• Free beta. AmeryGo is in a free, invitation-only trial: no subscription is on sale and we ask for no payment. The service may change, contain errors or stop. Each account has these limits: 3 itineraries per calendar month (the count restarts on the first day of the month), 5 audio guides and 3 restaurant searches for the whole beta.
• Liability. We provide the service with care but, as it is a trial, we do not guarantee that it is error-free or always available. To the extent permitted by law we are not liable for damage arising from travel decisions made on the basis of the generated content. No clause limits liability for wilful misconduct or gross negligence, nor the mandatory rights the law grants consumers.
• Governing law and jurisdiction. Italian law applies to this contract. If you are a consumer, the courts of the place where you reside or have elected domicile remain competent.
• Account and age. To use AmeryGo you must be at least 18 years old and have a valid email address. The account is personal: do not transfer it and keep your access safe. You can delete it at any time from your profile.
• Changes. If we change these terms in a significant way we will tell you by email at least 15 days before they apply. If you do not agree you can stop using the service and delete your account.