Privacy Policy

Last updated November 5, 2026

Viarlo is a pre-launch project. Company details will be published here when we open in early 2027. Questions about your data: hello@viarlo.co.

This notice applies to every visitor, wherever you’re contacting us from. If your local law grants you rights beyond what’s described here, write to us and we’ll honor them.

1. What we collect

We collect only what each step of the journey actually needs:

• Contact details. Name and email, submitted through the Start form, contact form, newsletter signup, or lead-magnet download.
• Trip preferences. Destination, dates, budget, pace, interests, and any other detail you share through the intake questionnaire, so we can design your Blueprint around you.
• Payment records. Handled and stored by Stripe, our payment processor. We never see or store your card details ourselves. We retain only the order amount, tier, and status.
• Booking details. When you book an intro call or consultation via Cal.com, we receive your name, email, and the time you selected.
• Call notes. We use a transcription tool that runs on our own computer to turn the audio of an intro call or consultation into text, then delete the audio. We keep a short summary of what matters for your trip.
• Correspondence. Anything you send us directly by email or through a form, kept so we can respond and maintain a record of the conversation.
• Technical data, collected automatically. When you visit the site, our servers and hosting provider (Cloudflare) automatically log standard technical information: your IP address, browser type, device type, and the pages you request, for as long as needed to keep the site secure and working. This is separate from analytics (below) and happens regardless of any analytics tool, the same way it does for any website.
• Website usage. Aggregate, non-identifying traffic statistics only (see “Analytics” below). We do not build individual browsing profiles.

2. How we use it, and on what legal basis

Under GDPR we can only process your data when we have a valid legal reason. Here is what we do and which basis we rely on for each:

• Design and deliver your Travel Blueprint, process payments, and communicate with you about your order. Basis: performance of a contract, since this is what you’re asking us to do.
• Hold intro calls and consultations and keep notes from them. Basis: steps you ask us to take before a contract (intro calls), or performance of a contract (consultations).
• Respond to enquiries sent through the contact form or by email. Basis: legitimate interest in running a responsive business, or performance of a contract if you’re already a client.
• Send The Viarlo Edit, our occasional travel newsletter. Basis: consent, never pre-ticked. You can withdraw it at any time by unsubscribing, one click at the bottom of every email.
• Keep server logs, and prevent fraud and abuse (including via Stripe and Cloudflare Turnstile). Basis: legitimate interest in keeping the site and our payments secure.
• Keep a record of our dealings with you for accounting and legal purposes. Basis: legal obligation, since Spanish tax law requires it.

We never sell your data, and we never use it to train third-party AI models.

3. Who we share it with

We use a small set of trusted processors to run Viarlo. Each one only receives the data it needs to do its specific job:

• Supabase. Hosts our application database (client, trip, and order records) and file storage.
• Stripe. Processes payments. See Stripe’s privacy policy.
• Resend. Sends transactional emails (confirmations, receipts, delivery notices).
• Brevo. Sends The Viarlo Edit newsletter, only to those who have opted in.
• Cal.com. Powers intro call and consultation booking.
• n8n (self-hosted, on our own server). Connects the tools above. It does not store data beyond what it passes through.
• Cloudflare. Hosts the website and protects it from abuse, including Turnstile, our bot-detection tool.
• Internal tools. The standard team messaging and document-storage services we use to run the studio hold your enquiry details and call summaries.
• Sentry. Error monitoring, so we can catch and fix technical problems. We scrub personal data from error reports where practical.

We do not use Google Analytics or any advertising network. We do not share your data with third parties for their own marketing purposes, and we do not sell personal data to anyone.

If Viarlo is ever acquired or merges with another business, your data may transfer to the new owner as part of that transaction, under the same protections described in this notice.

4. Analytics

We use Plausible, a self-hosted, cookieless analytics tool, to understand aggregate site traffic. It does not use cookies, does not collect personal data, and cannot identify you individually. Full detail: our Cookie Policy.

5. Do Not Track

Some browsers send a “Do Not Track” signal. There is still no agreed technical standard for how sites should respond to it, so we don’t currently act on it specifically. In practice this makes little difference here: we don’t run tracking cookies or ad-tech to begin with (see our Cookie Policy).

6. Automated decision-making

We don’t use automated decision-making or profiling that produces legal or similarly significant effects on you. Every Blueprint is designed by a person, and pricing is fixed and published, not algorithmically personalised.

7. International transfers

Most of our processors are EU-based or EU-hosted for the relevant service (Supabase, Cloudflare, Brevo). Some, including Stripe, Resend, Cal.com, our internal tools, and Sentry, may process data outside the EU/EEA (typically the United States), under Standard Contractual Clauses or an equivalent safeguard as required by GDPR. We review this at each vendor’s onboarding.

8. How long we keep it

We keep your information only for as long as we have a reason to, and the periods are:

• Your client file (your client and trip records, our messages with you, your questionnaire answers, your Blueprint and our notes from your calls): 6 years after your last order, then we delete or anonymise it. A new order starts the period again. We keep it so we can look after you properly if you come back, and because accounting and commercial rules require us to keep order records for that long.
• Orders, invoices and VAT records: 6 years, as the law requires.
• Dietary, mobility and accessibility details, and any images you upload: 12 months after we deliver your Blueprint. If you book again we will ask you to confirm them afresh.
• Enquiries from people who do not become clients: 12 months after our last contact.
• Newsletter subscribers: until you unsubscribe. We keep a record that you unsubscribed so that we do not email you again.
• Call audio: deleted as soon as it has been turned into text.
• Backups: up to 90 days, so a deletion reaches our backups as they age out.

You can ask us to delete your data at any time. If we have no legal reason to keep it, we will do so.

9. How we keep it safe

We use reasonable technical and organisational measures to protect your data, including encrypted connections, access controls on our internal tools, and a small, vetted set of processors. No system connected to the internet can be guaranteed completely secure, so we can’t promise that no unauthorised party will ever defeat these measures, but we take the obligation seriously and review it as our stack changes.

10. Your rights

Under GDPR, you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data;
• Request erasure of your data, where we have no overriding legal reason to keep it;
• Restrict or object to certain processing;
• Receive your data in a portable format;
• Withdraw consent at any time, where processing is based on consent (for example, the newsletter);
• Lodge a complaint with your local data protection authority. In Spain, that’s the AEPD.

To exercise any of these rights, write to hello@viarlo.co. We aim to respond within one month, as GDPR requires (extendable to three months for genuinely complex requests, with notice to you).

11. Children

Our services are intended for adults. We do not knowingly collect data from anyone under 18.

12. Changes to this notice

We may update this notice as our tools or practices change. We will update the “Last updated” date above whenever we do.

13. Contact us

Questions about this notice or your data: hello@viarlo.co.