Privacy Policy

Last updated: 16 June 2026

This Privacy Policy explains how Lost on Purpose ("we", "us") collects, uses and protects your personal data when you use our website lostonpurpose.online and our itinerary-planning service (the "Service").

1. Data Controller

ISAGREY BV
Isabeau De Jaeger
Heldenplein 6A, 1540 Herne, Belgium
VAT: BE1015073326
Contact: isabeaudejaegeruyf@gmail.com

2. What we collect

• Account data: email address and authentication credentials.
• Itinerary inputs: the destinations, dates, vibe descriptions and preferences you submit to generate trips.
• Generated content: the AI-generated itineraries linked to your account.
• Payment data: handled by our payment processor (Stripe). We receive confirmation of payment and customer email — never your full card details.
• Technical data: basic logs (IP address, browser, timestamps) needed to run and secure the Service.

3. How we use your data

• To deliver the Service (generate, store and show your itineraries).
• To process payments and provide proof of purchase.
• To send transactional emails (verification, password reset, account notifications).
• To monitor usage limits, prevent abuse and keep the Service running reliably.
• To respond to support requests.

Your itinerary inputs (destinations, vibe) are sent to AI providers (e.g. Google, OpenAI via the Lovable AI Gateway) for the sole purpose of generating your itinerary. We do not sell your data and we do not use your prompts to train AI models.

4. Legal basis (GDPR)

• Performance of a contract (delivering the Service you paid for).
• Legal obligation (accounting, tax records).
• Legitimate interest (security, abuse prevention, product improvement).

5. Sub-processors

• Supabase (hosting, database, authentication) — EU region.
• Stripe (payments).
• Resend (transactional email delivery).
• Lovable AI Gateway / Google / OpenAI (AI generation).
• Cloudflare (hosting, CDN).

6. Retention

Account data and itineraries are kept as long as your account exists. Payment and invoicing records are kept for 7 years as required by Belgian tax law. You can request account deletion at any time by emailing us.

7. Your rights

Under the GDPR you have the right to access, correct, delete, or export your personal data, and to object to or restrict its processing. Email isabeaudejaegeruyf@gmail.com to exercise any of these rights. You also have the right to lodge a complaint with the Belgian Data Protection Authority (gegevensbeschermingsautoriteit.be).

8. Cookies

We use only strictly necessary cookies for authentication and session management. We do not use advertising or third-party tracking cookies.

9. Changes

We may update this policy from time to time. Material changes will be announced on this page with an updated date.