Privacy Policy
Effective date: 22 October 2026
Last updated: 22 October 2026
Hi there!
GoWithHeart (gowithheart.com, the “Website”) publishes travel guides to countries, cities and places worth visiting: what to see, where to eat and how to plan your trip. We want you to feel at ease while reading it, so this Privacy Policy explains in plain language what personal data we collect, why, how long we keep it, who we may share it with, how we protect it and what rights you have.
You can read most of the Website without registering or telling us who you are. We only collect what we really need to run the Website and the features you choose to use.
The Website is growing, and some features described below (the AI route planner, user accounts, the newsletter, paid subscriptions and travel product recommendations) are introduced step by step. Each section applies from the moment the feature becomes available on the Website. A short version for each form on the Website is collected on the Privacy Notices page. If you still have questions, write to us at support@gowithheart.com.
1. What personal data is
Personal data is any information that can identify you, on its own or combined with other information: your name, email address, IP address, a cookie identifier, location data and so on. Processing means anything done with such data: collecting, recording, storing, using, sharing or deleting it.
2. What data we process and why
2.1 Visiting the Website
When you open a page, our server automatically receives technical data: IP address, date and time of the request, the page requested, the page you came from, and your browser and device type. Without it, the Website simply cannot show you the page. This data also helps us protect the Website against attacks and find errors.
Legal basis: our legitimate interest in a secure, working Website (Art. 6(1)(f) GDPR).
Retention: server logs are deleted after 30 days, unless needed longer to investigate a specific security incident.
2.2 Cookies
Cookies are small files the Website stores in your browser. We use strictly necessary cookies (for example, to remember your language and your cookie choices) without asking, because the Website cannot work properly without them. All other cookies — analytics, social media and advertising — are set only after you agree in the cookie banner. You can change or withdraw your consent at any time via the “Cookie settings” link in the footer, and you can also delete or block cookies in your browser settings. The consent banner runs on our own Website and does not send your choices to third parties: they are stored in your browser in the gwh_consent cookie. The full list is in our Cookie Policy.
Legal basis: your consent (Art. 6(1)(a) GDPR) for all non-essential cookies.
2.3 Analytics
If you consent, we use Google Analytics 4 (loaded through Google Tag Manager) to understand how people use the Website: which pages they read and for how long, where they come from (search, Pinterest, social media — including via UTM tags in links), what type of device they use and which links they click. Google Analytics uses cookies and randomly generated identifiers and receives your IP address, which Google does not store for EU users. We look at this data in aggregate — to improve the Website and write about what interests you, not to find out who you are. We do not use session recording, mouse heatmaps or similar tools.
Legal basis: your consent (Art. 6(1)(a) GDPR).
Retention: 14 months.
2.4 Contacting us
When you write to us by email or through a contact form, we receive your name, email address and whatever you choose to write. We use this only to answer you and help.
Legal basis: your request (Art. 6(1)(b) GDPR) and our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).
Retention: until the conversation ends and for 24 months after that, in case you come back with the same question.
2.5 Reviews
You can leave a review under our guides to countries, cities and places. For this we ask for a rating, your name, email address and the review text. After moderation, your name, rating and text are published on the Website — so please do not write anything you do not want to share publicly. Your email address is not published: we need it to contact you about your review and to protect the Website from spam.
Legal basis: your request to publish a review (Art. 6(1)(b) GDPR) and our legitimate interest in moderation and preventing abuse (Art. 6(1)(f) GDPR).
Retention: as long as the review is published. You can ask us to delete your review at any time by writing to us.
2.6 User account
If you create an account, we process your email address, password (stored only in hashed form — we cannot see it), your name if you provide it, your language, saved routes and favourites. If you sign in with Google or Facebook, we also receive your name, email address and profile picture from that platform.
Legal basis: performing our agreement with you — the Terms of Use (Art. 6(1)(b) GDPR).
Retention: as long as the account exists. If you delete your account, the data is deleted within 30 days, except data we must keep by law.
2.7 Newsletter
If you subscribe to our newsletter, we use your email address and language to send you travel ideas, new guides and selected offers. We start sending only after you confirm your subscription via the link in the first email. You can unsubscribe in one click — the link is in every email. We may see whether an email was opened and which links were clicked, to make the newsletter more useful.
Legal basis: your consent (Art. 6(1)(a) GDPR).
Retention: until you unsubscribe. After that, your address stays only on a block list so that we do not subscribe you again by mistake.
2.8 Partner links
The Website is free for readers, and partners help us keep it that way. Some links lead to booking services for hotels, tours, tickets, insurance, eSIMs, car rental and transfers, and to shops selling travel products. If you book or buy through such a link, we may earn a commission. The price for you does not change, and our recommendations do not depend on commissions.
A partner link first goes through our own redirect page (/go/…). We record the click: date and time, the page and block, the partner and the language of the page. This shows us which tips are genuinely useful. We do not record your name or contact details.
You then arrive on the partner’s website, which may set its own cookies to attribute the booking to us. This is governed by the partner’s privacy policy. Partners do not share your booking or payment details with us — only aggregated commission reports.
Legal basis: our legitimate interest in funding and measuring the Website (Art. 6(1)(f) GDPR); partner cookies on our pages only with your consent.
Retention: click records are kept for 24 months.
2.9 AI route planner
The route planner uses an artificial intelligence service to suggest an itinerary. To do this, we send the AI provider what you enter: destination, dates or trip length, budget, interests and number of travellers. Please do not enter anything you do not want to share — for example, health details or other people’s names.
The AI provider processes this data on our behalf only to generate the answer, under a data processing agreement. If you are signed in, the route is saved in your account so you can open it again; otherwise the request is kept only while the result is shown and in technical logs (section 2.1).
Remember that AI can make mistakes: check opening hours, prices, entry rules and safety information before you travel.
Legal basis: providing the service you requested (Art. 6(1)(b) GDPR).
2.10 Pinterest, Facebook, Instagram and Telegram
We have pages on Pinterest, Facebook and Instagram and a Telegram channel. When you interact with us there, the platform processes your data under its own privacy policy. For statistics of our Facebook page (“Page Insights”), Meta and we are joint controllers.
We publish pins for our articles on our own Pinterest business account using the Pinterest API. Through the API we do not collect any data about Pinterest users — we only read statistics for our own pins (views, saves, clicks).
Share buttons on the Website are plain links: the platform learns nothing until you click. The Pinterest “Save” button, embedded posts and social media pixels (Pinterest Tag, Meta Pixel) are loaded only with your consent.
If you write to our Telegram bot, we see your Telegram name, username and messages, and use them to reply or send what you asked for (for example, a route). We keep bot conversations for up to 12 months.
2.11 Paid subscription
If you take out a subscription, we process your name, email address, plan, payment dates and invoices. Payments are handled by our payment provider — we never receive or store your full card details.
Legal basis: performing our agreement with you (Art. 6(1)(b) GDPR) and our accounting and tax obligations (Art. 6(1)(c) GDPR).
Retention: accounting records are kept for the period required by tax law.
2.12 Content and photos
Our articles are prepared with the help of AI tools and checked by an editor. The AI provider receives only information about places, never about visitors. Photos come from stock libraries (Pexels, Unsplash, Pixabay) and are stored on our own server, so these libraries learn nothing about you when you open a page.
2.13 Statistics
Sometimes we use data for statistics — to see how the Website is developing and which topics readers find interesting. For this we work only with aggregated or anonymised data that cannot identify a specific person.
2.14 Other processing
Apart from the above, we may process data where the law requires it or to protect someone’s vital interests. If we want to use your data for a new purpose that is not compatible with those listed above, we will tell you first and, where required, ask for your consent.
We do not sell your personal data and we do not make decisions about you that have legal or similarly significant effects based solely on automated processing. The AI route planner only makes suggestions — you decide.
3. Who has access to your data
We work with trusted service providers. They process data on our behalf and only for the purposes described in this Policy:
- Hosting: [HOSTING PROVIDER] — stores the Website and server logs;
- Analytics: Google Ireland Limited (Google Analytics, Google Tag Manager) — with your consent;
- Artificial intelligence: OpenAI — for the AI route planner;
- Newsletter and payments: providers we will name here before the newsletter and paid subscriptions launch;
- Social media: Pinterest Europe Limited, Meta Platforms Ireland Limited, Telegram — when you interact with us there or consent to their tools on the Website;
- Partners: travel services and shops — only after you follow a partner link yourself;
- Public authorities: if we are legally required to provide information in response to a lawful request.
Some providers (for example, Google, OpenAI, Meta and Pinterest) may process data in the United States or other countries outside the European Economic Area. In that case the transfer is protected by an adequacy decision of the European Commission (including the EU–U.S. Data Privacy Framework for certified companies) or by the European Commission’s Standard Contractual Clauses. The same safeguards apply if we access data ourselves from outside the EEA.
4. Your rights
Right of access and data portability. You can ask which of your data we process, why, for how long and who we share it with, and get a copy. Data you provided yourself on the basis of consent or a contract can be given to you in a common machine-readable format so that you can move it to another service.
Right to rectification. If your data is inaccurate or incomplete, you can ask us to correct or complete it.
Right to erasure. You can ask us to delete your data if it is no longer needed for the purpose it was collected for, or if there is no legal basis for processing it. We will delete it unless the law requires us to keep it.
Right to restriction. In cases provided by law — for example, while you contest the accuracy of your data — you can ask us to only store the data without using it.
Right to withdraw consent. Where processing is based on your consent, you can withdraw it at any time: via “Cookie settings”, the unsubscribe link in an email, or by writing to us. This does not affect processing carried out before you withdrew it.
Right to object. You can object to processing based on our legitimate interest. We will stop unless we can show compelling legitimate grounds that override your interests. You can object to the use of your data for direct marketing at any time without giving a reason — and we will stop immediately.
Right to complain. You can contact a data protection authority: in Malta, the Information and Data Protection Commissioner (idpc.org.mt), or the authority in the country where you live or work. We would appreciate it if you wrote to us first — we will do our best to sort it out.
How to exercise your rights. Write to support@gowithheart.com. It is free of charge. We may ask you to confirm that you are the owner of the data, so that we do not hand it to someone else.
5. Response time
We respond to requests about your rights within one month. If a request is complex or we receive a large number of requests, this period may be extended by two further months — we will let you know about the extension and the reason within the first month.
6. How we protect your data
The Website is served only over an encrypted connection (HTTPS). Access to the server and admin panel is restricted and protected, passwords are stored only in hashed form, and software is updated regularly. We have data processing agreements with the providers that process data on our behalf. No method of transmission or storage is completely secure, but we do everything we can to keep your data safe.
7. Your age
The Website is not intended for children under 16, and we do not knowingly collect their personal data. If you are under 16, please do not register, subscribe to the newsletter or accept non-essential cookies without permission from a parent or guardian. If you believe a child has given us personal data, write to us and we will delete it.
8. Data breach notification
If a leak or other security breach affects your data, we will notify the data protection authority within the time required by law, and notify you without undue delay if the breach poses a high risk to your rights. We will act immediately to limit any possible harm.
9. Changes to this Policy
We update this Policy when we add new features or services. The date of the latest version is shown at the top of the page. If a change affects how we use data you have already given us, we will tell you on the Website or by email before it takes effect.
Contact
Email: support@gowithheart.com
Thank you for travelling with us!
The GoWithHeart team