Privacy policy
Your data on DolceRoutes
This policy explains how your data is used when you visit dolceroutes.com, contact us or use My trips and My wishlist.
You can save ideas and plan a trip without an account. Creating an account lets you access your plans on several devices. Sharing a trip is optional.
Last updated: 25 September 2026.
Who is responsible for your data?
The controller responsible for the processing described here is Cousin Alexis, a private individual and the publisher of DolceRoutes.
For questions about your data or to exercise your rights, email: contact@dolceroutes.com.
Depending on how you use the site
Without an account: the trips, saved ideas, notes and day assignments you create are kept in the local storage of the browser you use. They are not saved in an online account collection. Clearing site data or using private browsing may cause these plans to disappear. Visiting the site and running searches nevertheless involves technical exchanges with our servers and, depending on the services displayed, with third-party providers.
With an account: your email address, an internal identifier, technical account information and a cryptographic hash of your password are stored. Your password is not stored in plain text in the account database or trip backups.
To organise your trip: your space stores trip names, destinations, days, selected content, notes, their day assignments and any optional information you provide, such as dates and participants. Version numbers and update dates allow changes to be synchronised. A working copy may also be kept in the browser while you are signed in.
When you contact us: when you email us, we receive your email address, your message and any name you provide. This information is handled only by email to answer your enquiry; it is not saved in a WordPress contact-form database. We cannot reply without a way to contact you.
To keep the site running securely: the server receives information including your IP address and connection details. The account module uses session cookies, verification tokens and temporary attempt counters, some based on hashes of your IP address or email address.
An email address and password are required to create an account; dates and participants are optional. You do not need to provide your companions’ full names. Do not put passwords, identity document numbers, payment details or health information in your notes.
Why this data is used
| Purpose | Legal basis |
|---|---|
| Creating and managing the account; saving and synchronising trips and saved ideas; sending the confirmation or recovery emails needed to use the service. | Performance of the service requested by the user on a contractual basis (Article 6(1)(b) of the GDPR). |
| Making a trip viewable through a link when its owner chooses to share it. | Providing this feature at the owner’s request. The information to include is selected before publication. |
| Answering general enquiries received by email. | Legitimate interest in responding to people who contact us. |
| Preventing abuse, protecting access and diagnosing incidents. | Legitimate interest in keeping the website and personal spaces secure. |
| Handling requests to exercise data protection rights and meeting applicable legal obligations. | Compliance with the relevant legal obligations. |
| Measuring traffic with Google Analytics and Jetpack Stats; using affiliate tracking technologies and those associated with third-party content. | Consent for tracking technologies that are not exempt and for the related processing. The site does not currently have a system for collecting this choice; the situation is described in the “Cookies and local storage” section. |
| Monitoring the site’s presence in Google Search Console. | Legitimate interest in improving content visibility using the search engine’s performance reports. |
| Displaying the OpenStreetMap tiles needed for the map being viewed. | Legitimate interest in providing the site’s maps; this basis does not cover any non-essential third-party tracking technologies. |
The site does not offer a newsletter. Creating an account or contacting us does not subscribe you to commercial messages. Emails about registration, signing in or account recovery are sent to operate the service.
You choose what other people can see
A trip is not shared automatically. You review a preview and confirm the creation of a viewing link. Anyone with this link can open the trip and pass the link on, without creating an account.
The shared view includes the trip name, destination, day titles and selected content. Dates are visible only if you allow them. Notes are excluded by default: only those you select are shared, including their full text and day assignments.
Your account email address, the Participants field, other trips and your overall My wishlist collection are not included in the shared view. However, avoid putting private information in a trip name, a day title or a note selected for sharing.
The link displays changes saved online. Editing a note that is already shared also updates its shared version; a new note stays private until you select it.
You can disable the link. The shared view becomes unavailable when access is next checked, but screenshots, printouts and other copies already made by a recipient cannot be withdrawn remotely. You must inform your travel companions before entering or sharing information about them.
Who may receive information?
Managing DolceRoutes: the publisher and only those authorised to help operate or support the site can access the data needed for their tasks.
Hosting and email — o2switch: accounts and their collections are kept in the WordPress database hosted by o2switch in France. Service emails use o2switch email, configured through WP Mail SMTP, followed by the recipient’s email provider. WP Mail SMTP connects to the outgoing mail server; it is not a separate hosting provider for your trip plans.
Google Analytics: this tool helps us understand site traffic and use. It may process information about pages viewed, interactions, the browser, the device and identifiers associated with browsing. Pseudonymous identifiers should not be confused with fully anonymous data. See Google’s policy.
Jetpack Stats — Automattic: this tool provides statistics on visits and clicks. The provider’s documentation describes the processing of information including IP addresses, browsers, viewed and referring URLs, and event dates; certain WordPress.com identifiers may also be involved if the visitor is signed in there. The publisher views reports, not a list of visitors’ IP addresses. See Automattic’s notice for visitors.
Google Tag Manager: this tool manages when tags installed on the site are triggered. It does not replace a consent mechanism; the processing performed depends on the tags it triggers. Analytics tags remain subject to the privacy rules that apply to them.
Google Search Console: this tool analyses the presence of DolceRoutes pages in Google search results, including the impressions, clicks and queries shown in its reports. It should not be confused with the browsing tracking carried out by Google Analytics.
YouTube, Google Maps and Instagram: some pages display embedded videos, maps or posts. Loading them establishes a connection with Google or Meta, which may receive technical information, including your IP address and browser, and use its tracking technologies depending on the service and settings. Having an account with these providers may affect their processing. See Google’s policy and Instagram / Meta’s policy.
OpenStreetMap and Leaflet: when itinerary previews become visible or a map is opened, the browser loads OpenStreetMap tiles. The Leaflet library may be loaded from UNPKG. The providers of these resources receive the technical information needed to deliver them, including your IP address. The module does not send personal notes as mapping data. See the OpenStreetMap Foundation’s policy.
Affiliate links: DolceRoutes uses links to Booking.com, GetYourGuide, Skyscanner, Rentalcars and Agoda. When you follow a link, the partner receives technical information associated with the visit and, if you book, the information you provide to it. Its own privacy policy applies. Tracking an eligible booking may allow a commission to be attributed to DolceRoutes. An ordinary external link does not mean that all these partners load tracking technologies every time this page is visited; any embedded scripts or widgets may communicate with their provider as soon as they load. See our affiliate policy.
Sharing a trip plan: people who hold the link receive only the shared trip view and the information you have authorised, as described above.
Where processing takes place: hosting the site in France does not mean that all third-party services process data in France. Google and Automattic state that they use international infrastructure, including in the United States. OpenStreetMap tiles are distributed through a global network. Google describes the EU–US framework and standard contractual clauses among the mechanisms that apply to its transfers; Automattic also describes its safeguards in its privacy information. See the safeguards described by Google and Automattic’s information.
How long is information kept?
| Data | Period or criterion |
|---|---|
| Plans made without an account | Local storage does not expire automatically in the current module. It remains until content is removed, site data is cleared or the browser deletes it. It is not reused for another account unless you choose to do so. |
| Account and online collection | Kept so that you can use the service until deletion is requested or the account is closed. The module does not automatically delete inactive accounts. |
| Unconfirmed registration | The request expires after 24 hours. It is removed after activation or during the technical cleanup of expired requests. This cleanup depends on WordPress scheduled tasks running. |
| Password recovery link | Usable for 30 minutes and invalidated according to the reset process. This period is the link’s validity, not a promise that all technical traces will be erased at the same time. |
| Trip sharing | Accessible while sharing remains active. Metadata for shares that have been inactive for more than 30 days is removed during scheduled cleanup. Trip content is not duplicated in the sharing table. |
| Contact correspondence | Messages are kept to handle and follow up the conversation, then deleted when no longer needed during the annual email cleanup. |
| Security logs, sessions and counters | Sessions and technical checks have limited lifetimes. Hosting and security logs are kept for as long as needed to diagnose issues and prevent abuse, then deleted according to the technical cycles of the services concerned. |
| Site and database backups | Any technical copies made by the hosting provider or occasional archives are kept according to their replacement cycle or until no longer needed for recovery. They may delay erasure from a copy, without restoring a deleted account to the live service. |
| Third-party statistics and tracking technologies | Automattic states a 28-day retention period for Jetpack Stats logs containing identifying information; this does not describe the retention of all aggregated reports. Google Analytics data follows that service’s retention settings and Google’s policy. |
Signing out does not delete your account or its online data. The account’s active browser cache is cleared when you sign out using the module’s sign-out process. JSON files you have downloaded and any older local copies remain under your control.
What is necessary and what is optional
For your account and trip plans: sign-in and form-protection cookies, along with the storage needed for trips you choose to keep, provide the service you request. The My trips module does not use them to subscribe you to a newsletter or target advertising. The consent exemption is limited to these strictly necessary uses.
For analytics and external content: tracking technologies that are not exempt require prior agreement. This includes affiliate tracking technologies and those associated with third-party integrations when they are not strictly necessary for the requested service. Creating an account or continuing to browse does not constitute general acceptance of these technologies.
As of the date shown at the top of this page, DolceRoutes does not offer a banner or interface for accepting, refusing or withdrawing a choice about tracking technologies. Analytics services or third-party content may nevertheless load while you browse. This page explains their presence but does not collect your consent. You can email us at contact@dolceroutes.com with any questions.
Browser settings also let you clear site data. Doing so may sign you out and delete trips stored only on that device; it does not, by itself, delete a space already saved online. These settings do not replace the consent collection that the site must provide where required.
Accessing, correcting and deleting your data
You may request access to your data, its rectification or erasure, or restriction of its processing, under the conditions set out in the GDPR. You may also object to processing based on legitimate interests and exercise a right to data portability where its conditions are met. Where processing is based on consent, you may withdraw it without affecting the lawfulness of processing already carried out.
To exercise your rights, email contact@dolceroutes.com with your request and the email address associated with your space. Never send your password. Where there is reasonable doubt, proportionate verification of your identity may be requested, without routinely requiring an identity document.
We normally respond within one month of receiving a request. This period may be extended by two months because of the complexity or number of requests; you will be informed within the first month.
In My space: you can download a copy of your trips and erase your online collection. Erasing the collection does not delete the WordPress account itself. To request deletion of the account and associated data, contact us at the address above.
You can lodge a complaint with the French data protection authority (CNIL). If information about you appears in a trip shared by someone else, you can also report it to us, providing enough detail to locate the shared content.
We may update this policy to reflect changes to the site. Its update date appears at the top of the page; any significant change in how your data is used will be communicated appropriately.