NEU Ski Trip Planner — Privacy Policy

1. Scope and controller

This policy covers the NEU ski trip planning plugin for ChatGPT and its associated resort dashboard and planning interface (the “Service”). It does not describe the separate NEU iOS application's data practices. A website hosting or embedding the Service may also have its own policy for that website's cookies and other processing.

The controller for the processing described as ours is Guillem Bruix Barcelo, a self-employed professional established in Spain, trading as NEU Ski (“NEU”, “we”, “us”).

Privacy and support contact: [email protected].
Contact form: https://guillembruix.com/store/contact/
Controller's contact address: Carrer Irena Sendler 4, 08018 Barcelona, Spain.

OpenAI operates ChatGPT and processes information under its own applicable terms and privacy policy. Our control over information in NEU's systems is different from OpenAI's control over ChatGPT conversations and account information.

2. Information processed

Planning preferences. The form processes the destination or resort, dates, ski duration, group type and size, skill level, sport, budget and currency, transport preferences, optional departure city, accommodation preferences and requested services. Optional fields can include children's ages and additional requirements. Resort searches, resort identifiers and interface language are also processed to provide the relevant information.

Provide only information necessary for your trip. Do not include children's names or dates of birth, medical diagnoses, payment-card details, identification documents, passwords or other sensitive information in optional fields. You may leave optional fields blank. We do not need precise GPS tracking or access to your NEU iOS activity history for this Service.

ChatGPT interactions. When you activate the final planning action in a supported ChatGPT interface, the Service attempts to send a summary of your preferences and structured planning context to that conversation. Resort selections may also update the context available to the assistant. ChatGPT may pass relevant tool arguments, such as a resort search, resort identifier or language, to the NEU server to fulfil your request. The Service is not designed to retrieve your complete conversation history or your other chats.

Technical and access information. The hosting infrastructure records technical events. These can include request timestamps, URLs and query parameters, request and diagnostic identifiers, IP addresses, browser and device headers, referrer information, response status, errors and execution timing. Depending on the hosting access and authentication flow, request headers and logs can also contain authentication-related metadata, including an account email address and name, and cookie or session-related information. These are infrastructure records, not a NEU advertising profile.

Support information. If you contact us, we process your contact details, message, relevant correspondence and any information you choose to provide. Avoid sending passwords, payment details or unnecessary sensitive information.

3. Purposes and legal bases

We process information to:

• provide requested resort information, maintain the planning form, and support the preparation of a trip proposal; where applicable, this is necessary to provide the service you request or take steps at your request before a contract;
• answer enquiries and resolve reported problems; the basis is providing the requested service or our legitimate interest in responding to enquiries, depending on the request;
• operate, secure and troubleshoot the Service and prevent misuse; the basis is our legitimate interest in maintaining a reliable and secure service, subject to applicable safeguards and your rights;
• meet applicable legal obligations or establish, exercise or defend legal claims, where necessary.

Where a particular optional activity requires consent, we will request it separately before that processing. Merely using the Service is not treated as consent to advertising or non-essential tracking.

4. Storage, analytics and cookies

The current planning interface holds form answers in temporary interface memory. It does not deliberately save those answers in localStorage, sessionStorage, IndexedDB or a NEU planning database. Closing or reloading the interface normally clears that in-memory draft, but this does not delete any information already sent to ChatGPT or held in infrastructure records.

The current NEU dashboard code does not implement a dedicated advertising pixel or audience-analytics service. The iOS application's AppsFlyer, Meta and RevenueCat integrations are not incorporated into this dashboard code. Hosting diagnostics, authentication and third-party embedded content are separate from this statement.

The NEU form itself does not set application cookies. Hosting, authentication, embedded providers, affiliate destinations and a website embedding the Service may use their own cookies or similar technologies. Their processing must be assessed separately; this policy does not claim that the entire experience is cookie-free.

5. Recipients and external services

Information is disclosed only as relevant to providing the Service or meeting a legal requirement:

• OpenAI / ChatGPT: conversation content, submitted planning context, tool interactions and applicable hosting or authentication processing. See https://openai.com/policies/privacy-policy/.
• Hosting and infrastructure providers: the Service currently uses OpenAI Sites and Cloudflare infrastructure for delivery and operational diagnostics. For personal data collected through our Site, we determine the purposes and means of processing. OpenAI processes that data as needed to operate the Site under the agreement and, where applicable, the data processing addendum governing our account. This hosting role is distinct from OpenAI’s role for its own ChatGPT account and conversation services.
• NEU content and asset services: resort data, images and 3D assets are served from NEU-controlled services. Some assets or components are delivered through external content-delivery services, including Google's model-viewer library delivery endpoint.
• Embedded map, weather and webcam providers: currently including Windy and map tile services attributed to OpenStreetMap and CARTO, and other providers identified in a particular widget where used. Loading external resources or embedded pages can disclose technical information, such as your IP address, browser details and the requested resource, to those providers. An embedded provider may apply its own cookies and privacy policy.
• Support providers: the email and contact-form services used to receive and handle your enquiry, currently hosted by HostGator.
• Affiliate and booking destinations: when you follow an external hotel or insurance link, its destination and any redirect or attribution service receive the information associated with that visit. Hotel links currently use trip.tpo.li redirects; insurance links lead to InterMundial. Their own privacy policies apply.

We do not intentionally include your planning-form answers, optional notes or contact details in affiliate URLs. Links may contain referral identifiers allowing a provider to attribute a visit or transaction to NEU. We may receive an affiliate commission. We do not sell planning-form answers or use them to build advertising audiences.

Independent providers may act as separate controllers for their own services. Providers acting on our behalf must be covered by appropriate contractual arrangements where required.

6. Retention

• Unsubmitted form answers: temporary interface memory for the current instance of the form, rather than a persistent NEU trip-planning record.
• Information submitted to ChatGPT: retained under the applicable OpenAI product, account, conversation and workspace settings and policies. We do not set a separate NEU deletion period for your ChatGPT conversation.
• Hosting, access and diagnostic records: kept by our hosting infrastructure providers under their own retention settings, with access restricted. We have asked our hosting provider to confirm the applicable period and will update this policy when it is confirmed.
• Support enquiries: we delete or irreversibly anonymise routine support correspondence within 12 months after the enquiry is closed. Necessary records may be retained separately, with restricted access, for applicable legal obligations or legal claims, and deleted when that justification ends.
• Third-party embedded and affiliate services: their own retention policies apply to their independent processing. This does not remove our responsibilities for processing under our control.

7. International processing

Service providers may process information outside your country, including outside the European Economic Area. Where we arrange a restricted international transfer, we must use a valid transfer mechanism, such as an applicable adequacy decision or appropriate contractual safeguards. You can contact us for information about safeguards relevant to our processing.

8. Your choices and rights

You can leave optional answers blank, edit preferences before submitting, stop using the form, and decide whether to open external providers. Manage ChatGPT history and applicable data controls through your OpenAI account or workspace; clearing the NEU form does not clear your chat.

Where applicable, you may request access, correction, deletion, restriction or portability of personal data, and object to processing based on legitimate interests. You may withdraw consent for processing that actually relies on consent, without affecting earlier lawful processing. Contact [email protected]. We may request only the information reasonably necessary to verify and address your request.

You may complain to a competent supervisory authority, including the Spanish Data Protection Agency (AEPD), https://www.aepd.es/. Rights apply subject to applicable legal conditions. Contacting NEU cannot by itself delete records independently controlled by OpenAI or another provider, but we will explain the relevant route where possible.

9. Children, security and automated decisions

The Service is not directed to children under 13. Where a higher minimum age or parental involvement is required by applicable law or the host platform, that requirement applies. An adult planning a family trip should provide only the minimum non-identifying information needed about children.

We use reasonable measures appropriate to the information and risks, including HTTPS delivery and access restrictions for operational information. No system can guarantee absolute security.

Trip suggestions are informational. The Service does not itself make decisions producing legal or similarly significant effects, determine insurance eligibility, process bookings or take payments.

10. Updates and contact

We will update this policy when relevant functionality or data practices change and revise the effective date. Material changes will be communicated as required by applicable law. Questions and rights requests: [email protected].