Privacy Policy

Who we are. TwistyTrip (twistytrip.com) is operated by André Silva as data controller. The fastest way to reach us about your data is the contact page.

What we collect. Your email address and, if you sign in with Google, Facebook or Microsoft, the name, email and profile photo that provider shares. Optionally — only if you choose to fill them in on your account page — your country, postal address and T-shirt size, used solely to send you physical things (rider welcome packs, event merchandise, prizes); leaving them empty changes nothing about the product. The trips you create and who you share them with. If you use the no-account trial or the contact form, a one-way hash of your IP address (never the raw IP) to enforce daily limits and prevent abuse. If you buy Premium, payment is handled entirely by Paddle, our Merchant of Record — we never see your card details; Paddle acts as an independent controller for payment data.

Why we process it (legal bases). Running your account and generating your trips: performance of our contract with you. Abuse prevention, security and aggregate analytics: our legitimate interest in keeping the service working and affordable. Marketing email and non-essential cookies: consent, which you can withdraw at any time.

Analytics and advertising. We use Cloudflare Web Analytics (cookieless) and Google Analytics to understand how the site is used, and Google AdSense to show advertising on free pages. Google sets cookies for these — see our cookies page. Some hotel links are affiliate links through CJ (Commission Junction) — see the affiliate disclosure.

Who processes data for us. Cloudflare (hosting, database, AI generation), Resend (sign-in and notification emails), Paddle (payments, as Merchant of Record), Google (sign-in, analytics, advertising), Meta and Microsoft (sign-in, only if you choose them), CJ (affiliate link tracking). Route calculations use GraphHopper and weather uses Open-Meteo — both receive coordinates only, never your identity. Where providers are outside the EEA/UK we rely on the EU-US Data Privacy Framework or standard contractual clauses.

How long we keep it. Account data: until you delete your account or ask us to. Anonymous-trial and abuse-prevention records: only as long as needed to enforce the limits. Email logs: the minimum needed to know what we sent you.

Marketing email. We send at most occasional product email, and every message has a working unsubscribe link. Opting out never affects sign-in or trip emails.

Your rights. You can ask for access, correction, deletion, a portable copy, restriction of processing, or object to processing based on legitimate interest — contact us and we will handle it. You also have the right to complain to your data protection authority (for example the CNPD in Portugal or the ICO in the UK).

What we don't do. We don't sell your data and we don't read your trips for anything except generating and showing them to you and your riding group.

Trips prepared for you by a business (Studio). Motorcycle businesses can use TwistyTrip Studio to build trips and share them with their own customers by email. When that happens, the business is the data controller for your name, email and phone number — they added you to their contact book — and TwistyTrip processes that data on their behalf, only to deliver the trip: sending the invite, signing you in with a one-time link, and showing you the trips shared with you. We never use client contact details for our own marketing. Ask the business to remove you, or contact us and we will handle it with them.