Privacy Policy
Who we are
myDMC is operated from Croatia (legal entity to be finalised before public launch). For the purposes of GDPR we are the data controller for personal data processed through the Service. Questions: privacy@mydmc.app.
What we collect
DMC profile. The details you fill in under Settings — company name, brand colour, logo, trip lead contact, default practical info. There are no myDMC accounts, so there is no email address or password to collect. All of it is written to this browser's own storage and stays on your device; we never receive a copy.
Customer Content. Everything you enter into the builder — trip details, traveller names + ages + notes, photos, practical info. This lives in your browser too: trips and library in local storage, photos in the browser's IndexedDB. It leaves your device in exactly two cases. When you generate a PDF, that trip is sent to our renderer on Cloudflare so a document can be produced and handed straight back to you. When cloud photo storage is switched on, photos you add upload to our Cloudflare R2 bucket so they survive a cleared browser; when it is off, they never leave the device. Not used for AI training. Not sold.
Payments. None. We have no payment processor connected and nothing on this site can charge you, so we never see, handle, or store a card number or any billing record. The 7-day trial is a flag in your own browser, not an account with us.
Usage signals. Server logs (IP, user agent, timestamps for requests) for at most 30 days. Those run on legitimate interest — we need them to keep the Service up and to stop abuse — and they are not tied to analytics.
Analytics, only if you agree. We use Google Analytics 4 to see which pages get read. The tag is present on every page of the site, not only the marketing ones, and — being straight with you about this — it loads and counts the page as soon as the page opens, whether or not you have accepted. What your answer changes is not whether it runs but what it is allowed to keep. Until you accept, Google Consent Mode holds analytics storage in a denied state, so the tag runs without cookies: no analytics cookie is written or read on this browser, and Google receives nothing that identifies you or your device, which leaves it counting visits in aggregate with no way to recognise you from one page or one day to the next. On your first visit you get a banner with an equally-weighted Accept and Decline. Declining is the default, and closing the banner without choosing is treated as declining. We never turn on advertising or remarketing signals at all, accepted or not. Trip content never reaches Google either way. If you accept and then work in the builder, what Google records is the page address — which for a trip page contains an internal ID, a random string that identifies nothing outside your own browser. The itinerary itself, the traveller details, and the photos are never sent to Google or to any analytics tool.
Changing your mind. Use the control below. Switching it off takes effect immediately, deletes the Google Analytics cookies from this browser, and needs no email to us. Withdrawing does not affect the lawfulness of what was collected while consent was in place. The setting is stored per browser, so if you use more than one, each asks separately.
Why we process it
Performance of contract. Doing the things you ask the Service to do: rendering an itinerary into a PDF when you press export, and storing a photo you upload. Building and storing the trip itself needs no legal basis from us — that happens on your own device.
Legitimate interest. Operating securely (rate limiting, abuse prevention) and improving the product based on aggregate usage signals that can't identify individuals.
Consent. Google Analytics, and nothing else — we run no mailing list and send no product-update emails. What consent unlocks is the part that needs it: storing an analytics identifier on your browser and measuring you as a returning visitor. Until you opt in, none of that happens (see section 02 for what the tag still does meanwhile), and you can withdraw at any time from the control in that section, without affecting the lawfulness of prior processing.
Where it lives
Most of it lives nowhere but your own browser. What does reach a server runs on Cloudflare — hosting, the Worker that renders PDFs via Browser Rendering, and the R2 bucket that holds photos when cloud photo storage is switched on. That is our entire infrastructure: we operate no database and no authentication system, so there is no account store for your data to sit in. Where available, we choose EU regions. Some Cloudflare services are global by architecture; their data protection terms are GDPR-aligned via the EU Standard Contractual Clauses.
How long
Your trips. We don't hold them, so we can't put a retention period on them. They stay in your browser until you delete them or clear the browser's data — which also deletes them, permanently and with no copy on our side. Export a backup from Settings if that matters to you.
Photos. Those kept in the browser follow the same rule. Photos uploaded to our R2 bucket stay until you delete the photo, which removes it from the bucket.
PDF renders. Built on demand and streamed straight back to you. We do not currently keep a copy.
Logs. Server logs for up to 30 days. We keep no billing or audit records, because there is nothing to bill; once paid plans exist, invoice records will be retained as Croatian tax and accounting law requires.
Subprocessors
Two, and only two. Cloudflare (hosting, Browser Rendering, R2) processes what leaves your browser. Google (Analytics 4) processes page-view data. That is true whichever way you answer the banner: decline and Google still receives the cookieless page-view described in section 02, so it remains a subprocessor for you — what accepting adds is the analytics identifier that ties those page views to your browser. Each is GDPR-aligned via a Data Processing Agreement. We update this list when subprocessors change, announcing material changes on this page at least 30 days ahead.
Your rights
Under GDPR you have the right to access, correct, delete, port, or restrict processing of your personal data. In practice you can exercise most of these yourself without asking us, because the data is on your device: edit it in the builder, delete a trip to erase it, and use “Download backup” under Settings to export your trips, library, suppliers, and DMC profile as JSON. That file does not include the photos — those are stored separately in the browser and are not carried in a JSON backup, so save any you need copies of from the trip itself. For anything we do hold — uploaded photos, server logs, analytics if you accepted it — write to privacy@mydmc.app — we respond within 30 days. You may also lodge a complaint with the Croatian Personal Data Protection Agency (AZOP) or your national supervisory authority.
Security
Customer Content in transit is encrypted (TLS 1.2+). What we store — photos in R2 — is encrypted at rest by Cloudflare. We minimise access via least-privilege roles and revoke credentials that are no longer needed. The honest headline is that the surface is small: the less of your data we hold, the less of it a breach of ours could expose, and today we hold almost none of it. The corollary is that data on your device is protected by your device — a shared or unlocked computer exposes every trip in that browser, and we have no way to help you there.
We'll report any breach to the supervisory authority within 72 hours of becoming aware, per GDPR, and publish it on this page. We hold no contact details for our users, so we have no way to notify you directly.
Changes
We'll update this Policy as the Service evolves — and it will change substantially, because accounts, server-side storage, and payments would each add data we do not collect today. Material changes (new subprocessors, new data categories, retention changes) are announced on this page at least 30 days before they take effect, with the “Last updated” date changed to match. We hold no email addresses, so this page is the only notice channel we have.