implanPrivacy policy
Last updated: October 8, 2026
- implan is a small, private trip planner. We keep only what is needed to run it.
- We count visits with Umami on our own server only if you agree: no cookies, no stored IP addresses, no ads.
- We never sell your data or use it for advertising.
- Vansiu AI is optional. It runs on DeepSeek, a company in China, and is used only after you agree to that transfer.
1. Who is responsible
The controller of your personal data is Piotr Żmudziński, the person who runs implan (https://implan.me). Contact for anything about your data: [email protected]. There is no data protection officer.
2. What we process, why and on what legal basis
| Data | Purpose | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| Account: name, password (stored only as a salted hash), Google account email if you sign in with Google, who invited you, sign-up date | Signing in, showing you your trips | Art. 6(1)(b): providing the service you asked for | Until your account is deleted |
| Trip content: stops, dates, places, stays, transport, notes, checklists, ratings, uploaded documents and photos | Running the planner and sharing trips with the people you invite | Art. 6(1)(b) | Until you delete it or your account |
| Security log: IP address, browser (user agent), time, the action and its result, failed sign-ins | Protecting accounts, blocking password guessing, finding the cause of errors | Art. 6(1)(f): our legitimate interest in security | The log is size-capped and overwritten by newer entries, usually within a few weeks |
| Visit statistics (Umami): page address, referring site, browser, operating system, device type, screen size, language, country | Knowing which pages are used, to improve implan | Art. 6(1)(a): your consent, which you can withdraw at any time (section 3) | 6 months, then deleted |
| Vansiu AI chat: your messages and the plan of the trip you have open (without notes, booking confirmation numbers, ratings, documents and names) | Answering your question and preparing changes you confirm | Art. 6(1)(b) for answering you; the transfer to China only with your explicit consent (Art. 49(1)(a) GDPR) | Not stored by us after the answer; the chat lives in your browser tab |
| Emails you send us: your address and message | Answering you and handling your data requests | Art. 6(1)(f): our legitimate interest in answering you | Up to 12 months after the matter is closed |
Database backups made before updates are kept on the same server for at most 6 months. Giving us your data is voluntary, but without a name and password (or a Google account) you cannot use implan. We do not make decisions about you by automated means and we do not profile you.
3. Analytics (Umami)
Only if you agree, we count visits with Umami, an open-source analytics tool that we run ourselves at umami.pzmud.pl. The script runs only after you click "Count my visits": it reads the page address, referring site, screen size and language from your browser, and our server derives browser, operating system, device type and country from the request. Trip names are not sent. Umami sets no cookies, does not store your IP address and cannot follow you across websites: visits are grouped under a pseudonymous identifier. The data stays on our server, is not shared with anyone and is deleted after 6 months.
Legal basis: your consent (Art. 399(1) of the Polish Electronic Communications Law and Art. 6(1)(a) GDPR). You can withdraw it at any time with the switch below, as easily as you gave it; this does not affect visits counted before.
Browsers that send the "Do Not Track" signal are not counted, even with consent.
4. Cookies and browser storage
- implan_auth cookie: keeps you signed in, for up to 1 year or until you sign out. Strictly necessary.
- Local storage for your view settings (map style, folded days, place sorting), your analytics choice
(
implan.analytics,umami.disabled), your Vansiu AI consent (implan.vans-consent) and, in the session storage of the tab, the Vansiu AI chat. These stay in your browser and are not sent to us.
We use no advertising or third-party tracking cookies. Storage that is strictly necessary for the service you ask for (the sign-in cookie, your view settings and your choices) does not require consent under Art. 399(3) of the Polish Electronic Communications Law. Analytics is not strictly necessary, so it runs only with your consent (section 3).
5. Who else receives data
- Mikrus (mikr.us): rents us the server implan and Umami run on, located in the EU. Processes data on our behalf.
- Cloudflare, Inc. (USA): carries the encrypted traffic to the server; it decrypts it on the way, so it technically sees your IP address and what you send. Certified under the EU-US Data Privacy Framework.
- DeepSeek (Hangzhou DeepSeek Artificial Intelligence, China): only after you agree in the Vansiu AI window, each message you send to Vansiu AI goes to DeepSeek's servers in China together with the plan of the open trip (stops, dates, places, stays and transport, without booking confirmation numbers, notes, ratings, documents or the names of trip members). If you share a trip, its plan is sent when any member who agreed talks to Vansiu AI. China has no EU adequacy decision and no appropriate safeguards are in place, so your data is not protected there as it is in the EU. We make this transfer only on the basis of explicit consent (Art. 49(1)(a) GDPR). You can withdraw it at any time with Withdraw consent in the Vansiu AI window; this does not affect transfers made before. Do not write passport, card or health details into the chat.
- Purelymail (USA): our email provider stores the emails you send to [email protected].
- Google LLC (USA): only if you choose Sign in with Google, or import a Google Maps link. Certified under the EU-US Data Privacy Framework.
- Map tiles from OpenFreeMap and Esri load straight into your browser, so these providers see your IP address and the map area you look at. Place search (OpenStreetMap Nominatim) and weather (OpenWeather, Open-Meteo) are called by our server and receive only the place name or coordinates, never who you are.
- The people you share a trip with see that trip and who added what.
- Claude, ChatGPT and other AI apps receive trip data only if you connect them yourself; they then act under their own privacy policies.
6. Your rights
You have the right to access your data, get a copy (portability), correct it, have it deleted, restrict its processing and object to processing based on our legitimate interest (Art. 15-21 GDPR). Write to [email protected]; we reply within one month. You can delete your trips yourself in the app; to delete your account, write to us.
Where we rely on your consent (analytics, sending Vansiu AI messages to DeepSeek), you can withdraw it at any time; this does not affect the lawfulness of processing before the withdrawal.
Your right to object. You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest, such as the security log or answering your emails (section 2). Write to [email protected].
You can also complain to the supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (President of the Personal Data Protection Office), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.
7. Changes
When this policy changes, we update it on this page and change the date at the top.