Privacy Policy

Last updated: 28 October 2026

This policy explains what personal data the Surprise Me in Croatia mobile app and website (“we”, “the app”) collect, why, and what choices you have. We process personal data in line with the EU General Data Protection Regulation (GDPR).

Contact

For any privacy question or request, email support@surprisemeincroatia.hr.

Data we collect

Account data. If you sign in with Google or Facebook, we receive your name, email address and the account identifier from that provider. We use only the basic profile and email permissions. You can use parts of the app as a guest without an account.
Profile data you choose to add, such as a phone number, birthday, gender or profile picture.
Trip data. The travel preferences you select (region, trip length, style, pace, car rental) and the itineraries we generate and save for you, plus how many itineraries you have requested.
Purchase records. When you buy an itinerary, payment is handled by Stripe or PayPal. We never see or store your card details. We keep a record of the transaction ID, amount, currency, date, status and what was purchased.
App diagnostics and usage. We use Firebase Analytics to understand how the app is used and Firebase Crashlytics to collect crash reports (device model, OS version, app version and technical details of the error).
Data stored only on your device, such as your favourites and language setting.

The app does not access your location, contacts, camera or photos.

Why we use it

To provide the service: sign you in, generate and save itineraries, and process purchases (performance of a contract).
To keep the app working and secure, fix crashes and improve features (legitimate interests).
To meet accounting and tax obligations for purchases (legal obligation).

We do not sell your personal data and do not use it for third-party advertising.

Who we share it with

We share data only with service providers that help us run the app:

Google (sign-in, Firebase Analytics, Crashlytics)
Meta (Facebook sign-in)
Stripe and PayPal (payments)
Contabo, our hosting provider, where our servers and database run

Some of these providers may process data outside the EU. Where they do, they rely on safeguards approved under the GDPR, such as Standard Contractual Clauses.

How long we keep it

We keep account and trip data while your account exists. When you delete your account we delete this data, except purchase records, which we keep as long as accounting law requires. Crash and analytics data is kept according to Firebase’s retention settings.

Your rights

You can ask us to access, correct, delete or export your personal data, or object to or restrict its processing. To delete your account and its data, email support@surprisemeincroatia.hr from the address linked to your account. You also have the right to lodge a complaint with the Croatian data protection authority (AZOP, azop.hr) or the authority in your country.

Children

The app is not directed at children under 16, and we do not knowingly collect their data.

Changes

If we change this policy, we will update the date above and, for significant changes, let you know in the app.