Privacy Policy (GDPR)
Last updated: August 30, 2026
1. Data Controller
Vantastika ("we", "us", "our") is the data controller for the personal data collected through the website vantastika.se and its associated mobile application (together, the "Service"). We process your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council ("GDPR") and applicable national data protection legislation.
Organization name: Vantastika
Email for privacy inquiries:
privacy@vantastika.se
Website: vantastika.se
2. What personal data do we collect?
We collect the following categories of personal data:
| Category | Examples | Source |
|---|---|---|
| Account data | Email address, username, display name, country, vehicle type | Provided by you at registration |
| Profile data | Profile picture (optional) | Uploaded by you |
| User content | Saved campsites, trips, reviews, forum posts, comments, messages | Created by you in the Service |
| Contact and marketplace data | Phone number and other optional contact details in listings or incident records | Provided by you when using the feature |
| Vehicle data | Vehicle profile (make, model, dimensions, fuel type), service history, odometer reading, registration number (optional) | Entered manually by you or via AI receipt interpretation |
| Receipts and invoices | Images or PDFs of vehicle maintenance receipts. Content (workshop name, date, amount, items) is extracted with AI to populate the maintenance form. | Uploaded manually by you; stored privately per user |
| Financial and purchase history | Optional trip budgets, expenses, receipt details and subscription status where the feature is used | Entered or uploaded by you; status is confirmed by the payment provider where applicable |
| Technical data | IP address, browser type, operating system, device type, screen resolution | Collected automatically |
| Device and notification data | Persistent app-specific device ID, push token, platform, app version and delivery status | Created when you enable notifications; used for delivery, device changes and duplicate-registration prevention |
| Location data | GPS coordinates (latitude/longitude) | Only with your explicit consent |
| Usage data | Pages visited, session length, click behavior | Collected when you have allowed analytics (pseudonymized) |
| Search and diagnostics data | Saved searches and error, crash and performance information | Saved searches are created by you; diagnostics are collected for operations and, for usage analytics, only after consent |
| Communication data | Messages sent to customer support via the contact form | Sent by you to us |
Special categories: We do not knowingly collect sensitive personal data (e.g. health data, ethnic origin, political opinions). If you choose to share such information in free text (e.g. forum posts), you are responsible for doing so.
3. Purposes and legal basis for processing
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and managing your account | Art. 6(1)(b) — Performance of a contract |
| Providing the Service's features (trip planning, favorites, checklists, budget tracking) | Art. 6(1)(b) — Performance of a contract |
| Offering the AI assistant Vannie | Art. 6(1)(b) — Performance of a contract |
| AI interpretation of vehicle maintenance receipts | Art. 6(1)(b) — Performance of a contract (an optional feature you activate yourself) |
| Displaying maps and route calculations | Art. 6(1)(b) — Performance of a contract |
| Displaying location-based features (e.g. nearest campsites) | Art. 6(1)(a) — Your consent |
| Improving the Service through pseudonymized usage statistics | Art. 6(1)(a) — Your voluntary consent, disabled by default |
| Protecting against abuse, spam and fraud | Art. 6(1)(f) — Legitimate interest |
| Complying with legal obligations | Art. 6(1)(c) — Legal obligation |
| Sending service-related emails (password reset, account confirmation) | Art. 6(1)(b) — Performance of a contract |
| Sending transactional push notifications that you enabled | Art. 6(1)(b) — Performance of a contract |
| Sending optional marketing push notifications | Art. 6(1)(a) — Your consent, disabled by default |
4. Consent
Where processing is based on consent (Art. 6(1)(a)), you have the right to withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. You can withdraw consent by:
- Changing the settings in your profile
- Contacting us via the contact form
- Disabling location services in your browser/device
5. Your rights under GDPR
You have the following rights regarding your personal data:
- Right of access (Art. 15): Request a copy of the personal data we process about you.
- Right to rectification (Art. 16): Correct inaccurate or incomplete data.
- Right to erasure (Art. 17): Request deletion of your data ("the right to be forgotten"). You can delete your account directly in the profile settings.
- Right to restriction of processing (Art. 18): Restrict processing under certain circumstances.
- Right to data portability (Art. 20): Receive your data in a structured, machine-readable format (JSON/CSV).
- Right to object (Art. 21): Object to processing based on legitimate interest.
- Right not to be subject to automated decision-making (Art. 22): We do not make any decisions with legal effect based solely on automated processing.
Exercising your rights: Contact us via the contact form in the Service. We respond to your request within 30 days. We may need to verify your identity before we can process your request.
6. Storage and security
Primary account and app data is stored in the region configured for Vantastika's cloud project. Some features send only the necessary data to the recipients in section 7; processing country and transfer safeguards can therefore vary by feature. We use appropriate technical and organizational measures, including:
- Encryption in transit (TLS/HTTPS)
- Role-based access control (RLS policies)
- Passwords are handled by our authentication service and are not stored in plain text by Vantastika
- Automatic filtering of offensive content
- Input sanitization to prevent injection attacks (XSS, SQL injection)
7. Sharing with third parties
We never sell your personal data. Data may be shared with the following categories of recipients under strict data processing agreements (DPAs):
| Recipient | Purpose | Data shared | Location |
|---|---|---|---|
| Lovable Cloud and underlying infrastructure | Hosting, database, storage, authentication and email | Account, app, file and communication data required by the feature | Configured project region; other countries may apply under provider terms |
| Google Maps Platform, TomTom and open map data sources | Map display, route calculation and place search | Coordinates, search queries and route parameters | EU/EEA, USA or other processing locations under each provider's terms |
| Apple Push Notification service and Firebase Cloud Messaging | Deliver selected operational and, only after separate opt-in, marketing notifications | App-specific device ID, push token, platform, notification category and privacy-reduced preview | Global infrastructure under each provider's terms |
| Open-Meteo | Weather data | Coordinates | EU |
| Lovable AI Gateway and model providers | Vannie, translation, moderation and optional document interpretation | Content you submit to the AI feature and necessary context; data is minimized where possible | EU/EEA or a third country depending on the selected model and provider terms |
| Payment provider | Process purchases and subscriptions | Customer, payment and transaction data required for the purchase | Under the payment provider's terms |
| Authorities | Legal obligation | As required by law | Sweden/EU |
8. Transfer to third countries
Some providers may process data outside the EU/EEA. Where GDPR requires it, we use an applicable transfer mechanism, such as:
- EU-US Data Privacy Framework (DPF) — for certified providers
- Standard Contractual Clauses (SCCs) under the European Commission's decision — as a supplement
- Supplementary safeguards including encryption and pseudonymization
9. Cookies and similar technologies
Vantastika uses the following cookies:
| Type | Name | Purpose | Retention |
|---|---|---|---|
| Necessary | sb-*-auth-token | Authentication and session management | Session / 7 days |
| Necessary | gdpr-consent | Stores your cookie consent | 365 days |
| Functional | i18n-lang | Stores your chosen language | 365 days |
| Functional | country-context | Stores your chosen country | 365 days |
We do not use tracking cookies, advertising cookies, or third-party analytics services (e.g. Google Analytics).
Usage statistics
When you voluntarily enable analytics, we collect pseudonymized usage statistics (page views, device type, country) to improve the Service. Analytics is disabled by default and can be disabled again at any time in privacy settings. This data may include a random session ID and, for signed-in users, a user ID. The statistics are used only internally and are not shared with third-party analytics services. We consider this data pseudonymized, not anonymous, since under certain circumstances it could be linked to an identifiable person.
Visibility of uploads
The following uploads may be visible to other users of the Service:
- Profile picture (avatar): Visible to all signed-in users.
- Trip images: Visible to fellow travelers and, if the trip is shared publicly, to all visitors.
- Forum images: Visible to all signed-in users.
- Diary images: Stored in private storage with access control. Access occurs via time-limited signed URLs valid for a maximum of 1 hour. Only you, as the owner, can generate these URLs.
- Receipts and vehicle attachments: Stored in private storage (`receipts`, `vehicle-attachments`) and accessible only to you as the owner. Never visible to other users.
- Incident images: Stored in private storage and accessible only to you as the owner.
Images you upload to incident reports are not visible to other users.
10. Retention period
| Data | Retention period |
|---|---|
| Account data | Deleted immediately when the account deletion flow completes, except for data that must be retained by law or for the security purposes listed below |
| User-generated content | As long as the account is active; deleted with the account. Already approved public place facts may be retained in de-identified form as described below |
| Technical log data | Maximum 90 days |
| Session data / presence | Maximum 24 hours |
| Contact messages | Maximum 12 months after the case is closed |
| Data we are legally required to retain | As required by applicable law (e.g. the Swedish Bookkeeping Act: 7 years) |
What happens when you delete your account?
When you delete your account, the following is permanently removed:
- Your account and authentication credentials
- Profile, trips, stops, diary entries, checklists and budget data
- Vehicle profiles, service history and uploaded receipts
- Reviews, forum posts, comments and likes
- Favorites, collections, travel tips and place verifications
- Friend requests, location sharing, emergency sharing and messages
- Incident reports, support tickets and ticket messages
- Badges, challenges and AI usage logs
- Roles and administrator permissions
- All uploaded files (profile picture, trip images, forum images, diary images, incident images, receipts, vehicle attachments)
- Place submissions that are drafts, pending review or rejected
What may be retained:
- Security log (audit_log): Contains a user ID, the action performed, and a timestamp. Retained for security and legal reasons (Art. 6(1)(f) — legitimate interest, and Art. 6(1)(c) — legal obligation). The log is used solely to detect abuse and comply with any legal requirements. Log entries for acknowledged security alerts are automatically deleted after 90 days.
- Approved public place facts: An already approved place may remain as a de-identified catalogue entry. The account link, contact details, uploaded images, personal descriptions, attribution and moderation details are removed. Draft, pending and rejected place submissions are deleted completely.
11. Children's privacy
The Service is not directed at children under 16. We do not knowingly collect personal data from children under 16. If we discover that we have collected data from a child under 16, we will delete it without delay. If you are a guardian and discover that your child has created an account, please contact us immediately.
12. Automated decision-making and profiling
We use automated filtering to identify inappropriate content (profanity, hateful content). This does not result in legally binding decisions. The AI assistant Vannie provides recommendations but does not make any decisions that affect your rights.
13. Changes to this policy
We may update this privacy policy. In the event of material changes affecting your rights, we will inform you via the Service at least 30 days before the changes take effect. Continued use after a notified change constitutes acceptance of the updated policy.
14. Contact and complaints
Contact us: Via the contact form in the Service (requires sign-in) or directly via email: privacy@vantastika.se (no sign-in required).
Supervisory authority: You have the right to lodge a complaint with your national data protection authority. In Sweden, this is the Swedish Authority for Privacy Protection (IMY):
- Website: www.imy.se
- Phone: +46 8-657 61 00
- Email: imy@imy.se
15. What Vantastika is NOT and does NOT do
To avoid misunderstandings, it is important to clarify Vantastika's role:
- We are not an insurance company. Vehicle passports, service logs and PDF exports are informational documents based on data you provide yourself. They do not replace proof of insurance, vehicle inspections, or certificates from authorized workshops.
- We are not a navigation or safety company. Route suggestions, speed warnings and POI information are guidance only. As the driver, you are always responsible for the vehicle, load, route choices and traffic rules.
- We are not an official camping directory. Information about campsites, motorhome stopovers and rest areas is sourced from open data (OpenStreetMap), user contributions and third-party providers. Status, prices and opening hours may be inaccurate.
- We are a platform — not a publisher. User content (posts, comments, reviews, status reports) represents the individual user, not Vantastika. We moderate in accordance with the EU Digital Services Act but do not review all content in advance.
- Aggregated and anonymized data is not personal data. When we display e.g. "number of motorhomes within 5 km", this is based on data that cannot be traced back to individual users (geohash5 aggregation, 6-hour TTL, no user IDs).
By using the Service, you confirm that you understand these boundaries. Vantastika provides no warranties beyond those required by mandatory consumer law.
Manage your data permissions
Cookies, data export, deletion and consent history — all in one place.
Open privacy settings →Same text as in the app.