Privacy

Sí Listo is run by [Full legal name or company name], [Postal address]. We are the controller of the personal data described here, which means we decide what is collected and why, and we are responsible for it under the UK GDPR, the Data Protection Act 2018 and, for people in the European Union, the EU GDPR.

For anything about your data, email hello@silisto.net. We are registered with the UK Information Commissioner’s Office, registration number [ICO registration number].

Your account. An email address, the name you choose to show your group, and a picture if you add one. If you sign up with an email and password, the password is handled by Firebase Authentication and we never see it. If you use Continue with Google, Google tells us your name, email address and profile picture, and nothing else.

What you tell us about a trip. Where you are going, your dates, roughly where you are staying, how many people and whether there are children, and anything the group cannot eat. Dietary needs and allergies are covered in their own section below.

What you do on a trip. The cards, the edits, the votes, the notes, who is coming to what, the bookings you mark, the expenses you log and who you say paid, which is how we work out who owes who. Edits carry your name so the rest of your group can see who changed what — that is the point of a shared plan. While you have a trip open we also show the group that you are there.

What you say to Laura. Your messages to the trip assistant, and the recent conversation, are sent to our server and to Google’s Gemini models to work out an answer. We do not keep the conversation after the answer comes back; a change she suggests is only saved if somebody on the trip applies it.

Talking to Laura. If you tap the microphone, your recording (up to a minute at a time) is sent to our server and to Google’s Gemini models to be written down as text, and her spoken answers are made by Gemini too. We do not keep the recording or the audio. We send your browser’s language setting so she can answer in your language.

A notification token, only if you turn notifications on. Switching them on stores an identifier for that browser or phone, issued by Google, so we can send a notification to it. It is per device, so turning it on twice on two devices stores two. Turning notifications off deletes it, and so does deleting your account.

If you arrived from one of our ads. Google puts its own reference for that click on the link you followed. We keep it in your browser, and if you go on to make a trip we record it against the trip, so we can tell which ads are worth paying for. Later we tell Google that the click led to a trip — that, and nothing else. Not who you are, not where you are going, not anything on the trip. There is no advertising cookie and no ad network code anywhere in this app.

How far visitors get. To see where people give up, we count a few steps of each visit: the page loaded, a destination typed, Plan pressed, the account box shown, an account made, a trip created. Each count records the step, the day, the page and whether the visit came from an ad. It does not record who you are, what you typed, or anything that links one visit to another.

Technical data. Like any website, the services that host us see your IP address and browser details when you connect, and keep them briefly in their logs to keep the service running and to stop abuse. Cloudflare Web Analytics gives us page-view totals without cookies and without identifying you.

What we do not collect. No payment details, ever — we are not the seller and no money moves through this app. No advertising profile of you, and nothing that follows you to other sites. No location tracking: we geocode the places you type, not the place you are.

Data protection law says we need a lawful basis for each thing we do with your data. These are ours:

• Running your account and your trips — planning, sharing the plan with your group, votes, expenses and who owes who, Laura, and notifications you switch on. Basis: contract, because this is the service you asked for.
• Dietary needs and allergies. Basis: your explicit consent. See the next section.
• Keeping the service secure and working — logs, limits on how many plans an account can build, fixing faults. Basis: legitimate interests, ours and yours, in a service that works and is not abused.
• Knowing which ads lead to trips, and counting how far visitors get. Basis: legitimate interests in knowing whether what we spend on ads works and where the app is confusing. We keep this to the minimum described above, and you can object.
• Answering you when you email us. Basis: legitimate interests.
• Anything the law requires of us. Basis: legal obligation.

We do not use your data for advertising or sell it, and we make no decisions about you by automated means that have a legal or similarly significant effect. The plan the AI builds is a suggestion your group can change.

What you cannot eat, and especially an allergy, can reveal something about your health, which the law treats as a special category of data. We only use it with your explicit consent, which you give when you add it, next to a note that says what adding it means.

We use it for one thing: planning meals around it and checking restaurants against it. To do that it is shared with the people on your trip, and sent to Google’s Gemini models with the rest of the trip details. It is not used for advertising or profiling, and not shared with anyone else.

Your own needs, added to your account, are kept privately against it and shared with each trip you are on, where the people on that trip can see them. They leave a trip when you do.

The group’s needs, added by the organiser when planning, are about other people. Only add someone else’s dietary needs or allergies if they have told you to. Better still, ask them to add their own when they join.

Withdrawing consent is the same as removing it: clear it from your account or the trip and it is gone, and the plan stops being checked against it. Deleting your account removes it too. Withdrawing does not make what we did before unlawful.

Everyone on your trip. Anyone with your share link can join, and once they have they can see and change all of it, including the dietary requirements and the expenses. Only share the link with people you would trust with the plan.

Companies that run parts of the service for us. These process data only on our instructions, under contracts that require them to protect it:

• Google (Firebase Authentication, Firestore, Cloud Messaging)Accounts and sign-in, including Continue with Google; storing trips and everything on them; delivering notifications.Where: USA and other countries where Google operates
• Google (Gemini API)Building itineraries, checking restaurants against dietary needs, finding events, and answering messages to Laura. Receives trip details, including dietary needs and allergies, what you type to Laura, and voice recordings you choose to send her.Where: USA and other countries where Google operates
• Google (Places API)Finding places, photographs and coordinates from place names you type.Where: USA and other countries where Google operates
• RenderHosting our planning server, which handles every request to build or change a plan.Where: Frankfurt, Germany
• CloudflareHosting and delivering this website, protecting it from abuse, and cookieless visit statistics (Cloudflare Web Analytics).Where: Global network, including the USA
• UnsplashPhotograph searches by place name. Receives no personal data.Where: USA

Viator. Only when you tap through to book. We send no personal data; you arrive on their site as any visitor would, with a partner code that tells them the click came from us. Viator is not our processor: what happens after that is between you and them, under their privacy policy.

Google Ads, only as described above: that a click on one of our ads led to a trip.

Authorities, only if the law requires it.

We do not sell your data, and we do not share it with advertisers. There is no advertising in this app.

Some of the companies above process data in the United States and elsewhere. Where they do, the transfer is protected by the UK – US data bridge and the EU – US Data Privacy Framework where the company is certified under them, and otherwise by the standard contractual clauses approved by the UK and the EU, with the UK addendum. Email us for a copy of the safeguards that apply.

A trip’s address contains a long random id, and that id is the only thing protecting it. Anyone who has the link and signs in can join the trip. We keep those pages out of search engines for exactly this reason, but a link forwarded to somebody you did not mean to include works as well for them as it did for you.

We do not use advertising or tracking cookies, and there is no cookie banner because there is nothing to consent to that you have not asked for. What we do keep in your browser:

• Staying signed in. Firebase Authentication keeps your session in your browser’s storage.
• Trips offline. A copy of the trips you open, so they work without a signal.
• Small settings. Your display name, tips you have already seen, a travel mode you chose, whether notifications are on, and a booking you were in the middle of.
• The ad click reference described above, if you came from an ad, until you make a trip.
• Visit steps for the counts above, held only until you close the tab.

Clearing your browser’s site data for silisto.net removes all of it, and signs you out.

Your account and profile stay until you delete them. Trips stay until somebody deletes them. A trip is deleted when the last person on it leaves, and you can delete one at any time from the trips list.

The ad click reference stays on the trip it led to, and is deleted with it. Google only accepts it for 90 days after the click, so after that it is of no use to anyone.

Visit counts contain nothing about you, so they are kept as totals. Server and hosting logs are kept for the short periods our hosting providers set, normally no more than a few weeks.

Research about a city — which restaurants publish what — is cached for 90 days and shared across everyone planning that city. It contains nothing about you.

Emails to us are kept for as long as we need to deal with what you asked, and then deleted.

Account → Delete my account. It removes your account, your profile, your dietary needs, your notification tokens, your votes, and every trip that only you are on — with its days, its activity and its expenses.

Trips you share with other people are not deleted, because they are those people’s plans too. You come off them, and your name goes with you.

If something goes wrong with that, or you want it done by hand, email hello@silisto.net and we will do it.

Wherever you are in the UK or the EU, you have the right to:

• get a copy of the personal data we hold about you;
• have it corrected if it is wrong;
• have it deleted;
• restrict how we use it while a question about it is settled;
• object to anything we do on the basis of legitimate interests, including the ad and visit counts;
• receive the data you gave us in a format you can take to another service;
• withdraw your consent for dietary needs and allergies at any time.

Deleting is a button. For anything else, email hello@silisto.net. It is free, and we will answer within a month.

If you are unhappy with how we have handled your data, please tell us first. You also have the right to complain to the Information Commissioner’s Office in the UK, or to the data protection authority where you live in the EU.

Data is encrypted on its way to and from us. Database rules decide who can read and change each trip, so only the people on a trip can see it, and our server checks who you are on every request. No system is perfect: if a breach put your data at risk, we would tell you and, where the law requires, the regulator.

This app is not for children under 13, and we do not knowingly collect anything from one. In EU countries that set a higher age for agreeing to online services, you need a parent’s permission below that age. The “children in the group” option is about who you are travelling with, so the plan suits them; it does not create an account for anybody.

The date at the top says when this last changed. If a change matters we will tell you rather than quietly reposting the page.