Privacy policy

1. Data controller

The data controller is the operator of the Worldmates platform, reachable at info@worldmates.it.

2. Which data we process

Account — email and password. Worldmates never sees your password: our authentication provider stores it in encrypted (hashed) form.

Profile — display name, photo, bio, country, date of birth and the travel attributes you choose to share (styles, budget, pace, interests). They introduce you to other travelers and are used to compute the travel affinity between profiles. Name, photo, bio, styles and the reviews you received are visible to other users.

Content you create — trips (with stops, places and dates), experiences, join requests with your dates, reviews, group chat messages, direct messages, cover photos, any reports and blocks, creator certification requests.

Technical data — service error logs (they may include your account identifier, never your password) and site traffic statistics collected without cookies and without personal identifiers.

Service usage — for each day you use Worldmates while signed in we store one row with your account, the date, the device type (web, Android or iOS) and the time of last use. It tells us how many people use the platform and from where: only the administrator sees it, in the internal console, and it is deleted with your account. We do not record the pages you visit or your location.

Interactions with suggestions — when we show you the "Travelers like you" section we record which profiles we suggested and which ones you opened, to improve the quality of the suggestions. This data stays inside the service: it never leaves Worldmates and is deleted together with your account.

Handing a trip over to an associated agency — if the organizer asks an associated agency to take over a trip, we record the request, the agency's offer and each member's vote (yes/no). Before the handover the agency only sees aggregate trip data (stops, dates, number of participants, style, budget) and the organizer's public profile, never the members' names. If the group approves, the agency becomes the organizer and sees what every organizer sees: names, photos, participation dates, booking notes and the trip chat. This data stays inside Worldmates and is deleted with the trip or with your account.

3. Why we process it

To provide the service (legal basis: contract, art. 6.1.b GDPR) — creating and showing trips and profiles, managing participations and approvals, chats and messages, computing the compatibility between travelers, sending you the emails the service needs (address confirmation, password recovery, notifications about your activity).

For the safety of the community (legitimate interest, art. 6.1.f) — handling reports and blocks, preventing spam and abuse, protecting the service.

We do not sell your data and we do not use it for advertising. We do no marketing without your explicit consent.

4. Where the data is and who processes it for us

We rely on providers that process data on our behalf:

• Supabase — database, authentication and image storage, on servers in the European Union (Ireland).
• Vercel — hosting of the web application and cookie-less statistics (US company, with EU standard contractual clauses).
• Resend — delivery of service emails from infrastructure in the European Union (US company, with EU standard contractual clauses).
• OpenStreetMap / Nominatim — when you search for a place or look at a trip map, the search text is sent to OpenStreetMap servers for geocoding.
• CARTO — map tiles (the background of a trip map) are served by CARTO servers, which receive your IP address and the referring page like any web resource. The globe texture is served directly from worldmates.it.

5. Cookies

Worldmates uses no profiling cookies and no advertising trackers. We only use the browser's technical storage to keep your sign-in session, plus cookie-less traffic statistics: that is why we show you no consent banner. The usage log described in section 2 is tied to your account, not to a cookie.

6. How long we keep the data

As long as your account is active. You can delete your account yourself from your profile ("Delete account" section): deletion is immediate and removes profile, content and credentials (backup copies may persist for a short technical period before being overwritten). Alternatively, write to us at info@worldmates.it.

7. Your rights

Under articles 15–22 GDPR you can ask us at any time for: access to your data, rectification, erasure, restriction, portability, objection to processing. Write to info@worldmates.it. If you believe the processing breaks the law you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, gpdp.it).

8. Minimum age

Worldmates is reserved for people aged 18 or over.

9. Changes

If this policy changes substantially we will let you know on the platform.