Privacy notice

1. Controller

Fariborz Ghambari
Friedrich-Dürr-Straße 49/1, 74074 Heilbronn, Deutschland
E-mail: info@shahantravel.com

No data protection officer is appointed (not legally required, § 38 BDSG). Please send privacy questions to the e-mail above.

2. What this is about

“Shahan Travel” (“Shahan Travel”, شاهان سفر) is a travel assistant: website shahantravel.com (shahantravel.de forwards there), Android app “Shahan Travel” on Google Play (de.fariborzghambari.safar), Telegram bot and WhatsApp channel. It searches hotel and flight prices, reminds you of deadlines, helps on the road and splits costs among co-travellers. It never books and never moves money for travel.

3. Data we process

• Account: name and e-mail from the Google sign-in; Telegram ID and username if you sign in via Telegram; your phone number if you sign in with a code via WhatsApp (to send and check the code) or share it in Telegram yourself.
• Trip data you enter: destinations, dates, number of people, budget, wishes, bookings, flight and train data, checklists.
• Co-travellers: names, birth dates, passport names and expiry dates you enter — stored encrypted. We never store passport numbers.
• Emergency card (health data): medical details you enter voluntarily (e.g. allergies, medication). These are special categories of data under Art. 9 GDPR. They are stored encrypted, shown only to you and put on your own Google Wallet pass only if you trigger that yourself. So that the card appears in the language of the destination, the AI (Vertex AI / Gemini, EU) translates your details when the card is shown; the translation is not stored.
• Costs: expenses, receipt photos, settlements; your IBAN or PayPal name only if you enter them for repayments (IBAN encrypted).
• Photos, notes, booking files you upload.
• Location: only when you tap “my location” or send a location to the bot; we keep only the place (e.g. home city), no movement data.
• Messages to the assistant (text and voice). Voice messages are processed to turn them into text, not stored as audio.
• Google Wallet: the contents of a pass (e.g. trip, flight, emergency card) — only when you tap “Add to Google Wallet”.
• Push notifications: the push address of your browser or device — only if you allow notifications.
• Technical data: shortened IP address, device type, times, error logs — for operation and security.
• Payments: only if paid plans are introduced later (the first month is then free). Stripe processes the payment; we never see card data, only customer ID and status.

4. Purposes and legal bases

• Providing the service you use (sign-in, search, reminders, cost splitting, travel diary, Wallet passes) — Art. 6(1)(b) GDPR.
• Notifications via Telegram, WhatsApp or push — your consent, Art. 6(1)(a) GDPR, revocable at any time.
• Emergency card (health data) — your explicit consent, Art. 9(2)(a) and Art. 6(1)(a) GDPR. Saving the card means you consent; you withdraw consent at any time by deleting the card.
• Security, abuse prevention, debugging, cost control — legitimate interest, Art. 6(1)(f) GDPR.
• Keeping invoices and accounting records if there are paid plans — legal obligation, Art. 6(1)(c) GDPR (§ 147 AO, § 257 HGB).

No advertising, no selling of data, no sharing for advertising.

5. Recipients and processors

• Google Cloud (Google Cloud EMEA Ltd., Ireland): servers (Cloud Run, Belgium), database (Firestore, Frankfurt), AI (Vertex AI / Gemini, region europe-west1, Belgium), Google Maps Platform (places, routes). For price research Gemini uses Google Search (Grounding with Google Search); search terms such as destination, travel dates and number of people are sent to Google. Data processing agreement (Cloud Data Processing Addendum).
• Google Wallet — only if you add a pass; the pass contents go to Google.
• Push service of your browser or operating system (e.g. Google) — only if you allow notifications; it receives the push address and the notification text.
• Google Play — installation and updates of the Android app, under Google's terms.
• Telegram — only if you use the bot or sign in via Telegram.
• Meta Platforms Ireland (WhatsApp Business Cloud API, our WhatsApp Business number) — if you sign in with a WhatsApp code or use WhatsApp for messages; Meta receives your phone number and the messages.
• Stripe Payments Europe (Ireland) — only if paid plans are introduced later.
• Flight fare and flight status services — Duffel (Duffel Technology Ltd., United Kingdom; live fares only on paid plans), Travelpayouts / Aviasales (cached fares) and Air France-KLM Open Data (fares and flight status): we send only airports, travel dates, cabin, number and ages of travellers or flight number and date — no names, no contact details. The United Kingdom has an EU adequacy decision.
• Public data sources without personal data (ECB exchange rates, weather, timetables, fuel prices): we send only places or routes, never names.

6. Transfers outside the EU

Google, Meta and (for paid plans) Stripe may also process data in the USA. The basis is the adequacy decision for the EU-US Data Privacy Framework (the companies are certified) or EU standard contractual clauses (Art. 46 GDPR). Telegram processes data under its own terms, also outside the EU; use the bot only if you agree.

7. How long we keep data

• Account and trip data: as long as your account exists.
• Emergency card: until you delete it or your account.
• After “delete account”: closed immediately, erased for good after 30 days (until then, signing in again restores it).
• Error logs 30 days · chat history 90 days · search history 180 days · security log 12 months.
• Database backups: daily backup kept 14 days, restore points 7 days.
• Invoices and accounting records for paid plans: statutory retention periods (currently 8 or 10 years, § 147 AO, § 257 HGB).

8. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw consent at any time (Art. 7(3)). In the app: Settings → “My data” → download, or delete account.

You may lodge a complaint with a supervisory authority (Art. 77), e.g. the State Commissioner for Data Protection Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

9. Obligation to provide data, automated decisions

Only the sign-in is required; everything else is voluntary — without it some features are limited. The AI makes suggestions (hotels, checklists, texts); there is no automated decision with legal effect under Art. 22 GDPR.

10. Security

Encrypted connection (TLS), servers in the EU, passport data, emergency card and IBAN additionally encrypted field by field, access only for you and the co-travellers you invite (the emergency card only for you). Files are removed from the device storage when you sign out.

11. Cookies and device storage

One technically necessary sign-in cookie and local storage in the browser or the Android app for sign-in and offline use (§ 25(2) no. 2 TDDDG). No tracking or advertising cookies.

12. Minimum age and children

You must be at least 18 years old to use the service. Children's data (e.g. age for a cot) is entered by their parents.

13. Changes

We update this notice when the service changes. Last updated: 20.10.2026.

See also: Terms of use · Legal notice (Impressum)