Legal

    Privacy policy.

    Last updated: October 2026

    Data controller

    This website is operated by Wander Astray, which acts as the data controller for the personal data processed in connection with our services. This means Wander Astray determines why and how your information is processed and is your point of contact for any questions about your data.

    What we collect

    When you purchase an itinerary, contact us, or create an account, we collect the information you provide: your name, email address, login credentials, and trip preferences. If you use our trip planner, we store the destinations and travel details you enter so you can access your saved trips. We also collect basic technical data such as IP address and device information for security and operations.

    How and why we use it

    Your information is used to deliver the service you requested — delivering itineraries, saving your automated-generated trips, and communicating with you about your orders. Our legal basis is performance of our contract with you, our legitimate interests in security and product improvement, and your consent where required. We don't sell your data to third parties. We don't send marketing emails unless you've opted in.

    Payment processing

    Payments are processed by Paddle.com, which acts as our Merchant of Record and reseller for all orders. Paddle collects and processes your payment information (including card details) to complete purchases, manage subscriptions, handle tax compliance, and issue invoices under their own privacy policy. We never see or store your full credit card number.

    Data sharing

    We only share information with the categories of recipients needed to operate the service: our hosting and database provider (Lovable, which hosts the website and runs our database on Supabase infrastructure), Paddle.com Market Ltd as Merchant of Record, our email provider for transactional messages (Lovable Labs Incorporated, whose email service sends receipts and replies to enquiries), professional advisers (legal, accounting), and authorities where required by law. All subprocessors process data on our instructions under appropriate data protection agreements. Some of these providers may process data outside the EU/EEA (including the USA); where that happens, the transfer relies on the European Commission's Standard Contractual Clauses or an adequacy decision.

    Cookies and analytics

    We use essential cookies to keep you signed in and remember your preferences. We use basic analytics to understand how visitors use the site — page views, referral sources, and general usage patterns. We don't use tracking pixels from advertising networks and we don't build advertising profiles.

    Data storage

    Your account data and saved trips are stored securely in our cloud infrastructure. Data is encrypted in transit and at rest. We retain your data for as long as your account is active. You can request deletion of your account and all associated data at any time by contacting us.

    Your rights

    You have the right to access, rectify, or erase your personal data, to restrict processing, to receive your data in a common format (data portability), to object to processing, and to withdraw any given consent at any time. For any data requests, reach out via our contact form — we'll respond within one month. You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet) or your local supervisory authority.

    If we make material changes to this policy, we'll update the date above and notify registered users by email. Continued use of Wander Astray after changes constitutes acceptance.

    Questions? Reach out via our contact form.