Privacy Policy
Last updated: 2026-05-05
This Privacy Policy describes how the operator of this website (“we”, “us”) collects, uses, stores, and shares personal data when you use the vignette route planning and order request service (the “Service”). It is intended to meet transparency expectations under the EU/EEA General Data Protection Regulation (“GDPR”) and similar laws, where they apply.
1. Data controller
The data controller is the natural or legal person operating this website. You can contact us using the email address or other contact point provided in transactional messages (for example, order or request confirmations) or on the Service itself.
2. Scope
This policy covers processing through this website and our own APIs (for example, saving a request or usage metrics). It does not govern third-party sites linked from the Service. Third-party providers (see below) have their own privacy notices.
3. Categories of personal data we process
Depending on how you use the Service, we may process:
- Route and trip data: origin and destination labels you select, travel dates, selected vignette countries, fuel type where relevant, and derived pricing breakdowns.
- Vehicle data: license plate number and country of registration.
- Contact data: email address you provide.
- Technical and usage data: browser-related events we log for product improvement (for example, page views, when a route or price estimate is reached, validation issues, when a request button is used). These events may include coarse campaign parameters (such as UTM tags or ad click identifiers from the URL), language choice, and page path.
-
Local storage on your device: we may store your form progress, language, and similar settings in
the browser (for example
localStorage) so the page can restore your input. - Approximate location (optional): we may request an approximate country derived from your IP address (via a third-party lookup) to pre-fill convenience fields (for example registration country). Your IP may be processed by that provider.
4. Purposes and legal bases (GDPR)
| Purpose | Legal basis |
|---|---|
| Providing route and price estimates; restoring your session | Performance of a contract or pre-contract steps at your request (Art. 6(1)(b) GDPR); consent where required for non-essential storage |
| Receiving, reviewing, and fulfilling an order request; contacting you about it | Performance of a contract (Art. 6(1)(b) GDPR) |
| Processing card payments (when enabled) via a payment provider | Performance of a contract (Art. 6(1)(b) GDPR) |
| Internal notifications to our team (for example email or secure messaging) when a request is submitted | Performance of a contract; legitimate interests in operating the Service (Art. 6(1)(f) GDPR) |
| Aggregated usage metrics, debugging, abuse prevention | Legitimate interests (Art. 6(1)(f) GDPR) in securing and improving the Service, balanced against your rights |
| Marketing / analytics tags loaded through Google Tag Manager (Google Analytics 4 and advertising tags) | Your consent (Art. 6(1)(a) GDPR), collected through the banner shown on your first visit; these tags stay denied until you accept |
| Session recording (PostHog): how pages are used — scrolling, clicks, form steps — with every input field masked | Your consent (Art. 6(1)(a) GDPR), collected through the same banner; nothing is recorded unless you accept |
| Product analytics without storage on your device (PostHog): counting visits, measuring where people leave the ordering flow, aggregate click positions on a page, and automatic reports of JavaScript errors | Our legitimate interest in understanding and improving the Service (Art. 6(1)(f) GDPR). Nothing is written to your device unless you accept the banner; if you accept, that storage is used on the basis of your consent (Art. 6(1)(a) GDPR) |
If we rely on consent, you may withdraw it at any time without affecting prior processing that was lawful.
5. Recipients and processors
We use service providers who process data on our instructions, including where applicable:
- Hosting / infrastructure — server environment where the application and data files run;
- Email (SMTP) — delivery of messages to you and to our team;
- Stripe — payment processing and related fraud checks when online payment is enabled;
- Google — Maps / Places or similar APIs when enabled; Google Tag Manager / analytics as configured;
-
PostHog — product analytics, hosted on PostHog's EU Cloud (data stored in the European
Union). These requests are sent through our own domain (
buyvignettepass.com/ingest) before reaching PostHog, so that the measurement is not silently dropped by browser extensions; the recipient is PostHog either way; - Messaging providers — for example Telegram Bot API, if we route internal alerts to staff devices;
- IP geolocation API — for example ipapi.co or comparable, for optional country pre-selection.
Some providers may process data in countries outside the EEA. Where required, we use appropriate safeguards (such as Standard Contractual Clauses) or rely on adequacy decisions.
6. Retention
- Order requests are stored in server-side logs (for example append-only files) for the time needed to handle your request, meet legal, tax, and accounting obligations, and resolve disputes. If you ask for deletion, we will comply unless a longer retention is required by law.
- Usage metrics are processed only in Google Analytics 4, in pseudonymous form and subject to your consent. Retention follows the property's configured data-retention window; we keep no separate analytics store on our own servers.
- Browser storage remains until you clear site data or we clear it on logout/reset flows.
7. Security
We apply reasonable technical and organisational measures appropriate to the risk, such as access control on servers, transport encryption (HTTPS), and separation of secrets (API keys) from public code. No method of transmission or storage is completely secure.
8. Your rights
Depending on your location, you may have the right to:
- access your personal data;
- rectify inaccurate data;
- erase data (“right to be forgotten”) where conditions are met;
- restrict or object to certain processing;
- data portability for data you provided, where processing is automated and based on contract or consent;
- lodge a complaint with a supervisory authority (in the EU, typically where you live or work).
To exercise rights, contact us using the same channel as in section 1. We may need to verify your identity before disclosing or changing information.
9. Children
The Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have, please contact us and we will delete it.
10. Cookies and similar technologies
Strictly necessary storage (for example your saved route, language, and payment state in
localStorage) is used without consent because the Service cannot work without it.
Non-essential analytics and marketing tags — Google Tag Manager, Google Analytics 4, and any advertising tags we
enable through it — are loaded in Google Consent Mode v2 and start in the
denied state. On your first visit a banner asks you to accept or decline; until you accept,
analytics_storage, ad_storage, ad_user_data, and
ad_personalization stay denied, no analytics or advertising cookies are written, and Google
receives only cookieless, non-identifying pings.
PostHog (product analytics) loads on every visit, but starts without storing anything on your
device: until you accept the banner it keeps its state in memory for the current page only, writing no cookies
and nothing to localStorage. This lets us count a visit without following you across pages. If you
accept, it stores an identifier in a cookie and localStorage so a visit can be followed between
pages; if you decline, it stays memory-only. It also collects aggregate click positions and automatic reports of
JavaScript errors, neither of which contains the details you type.
Session recording runs only if you accept the banner. It then records how the page is used —
scrolling, clicks, which step of the form you reach — so we can see where ordering gets difficult. Every input
field is masked in the recording: what you type, including your plate number and email address, is never
captured, and the card payment happens in Stripe's own frame, which is not recorded. If you decline, nothing is
recorded. Recordings are stored by PostHog in the EU and deleted automatically after 30 days.
Your choice is stored locally under vignette:consent:v1. To withdraw or change consent, clear this
site's data in your browser (Settings → Privacy → site data) — the banner will appear again on your next visit.
You can also block cookies entirely through your browser settings.
Reminder for the 2027 annual vignette
If you ask us to remind you when Austria's 2027 annual vignette can be ordered, we store your email address, the language of the page, the page you signed up on and the time of your consent. The legal basis is your consent (Art. 6(1)(a) GDPR), given with the checkbox next to the form. We send one email for that purpose and then delete your address — at the latest on 31 January 2027, even if no email was sent. You can withdraw your consent at any time by writing to [email protected]; we then delete your address at once. The address is not used for anything else and not passed to anyone except our email provider (Brevo) for sending that email.
Route API, widget and AI-assistant apps
Our public route API (/api/v1/…), the embeddable widget and our apps for AI assistants (the MCP
endpoints at /mcp, including our ChatGPT app) receive only what is needed to answer: the start and
destination (a city or a country code), optional travel dates and a language. They do not ask for, receive or
store your name, email address, plate number or payment details, and they need no account or sign-in. We keep
only aggregate daily counts of how often each part is used and from which website or assistant — a hostname or
a crawler name, never your IP address — for up to 120 days. The questions you type into an assistant stay with
that assistant's provider and are governed by its privacy policy; we only see the route parameters it sends us.
If you then follow a link to our website, the rest of this policy applies.
11. Automated decision-making
We do not use fully automated decision-making that produces legal or similarly significant effects solely by automated means. Price estimates are calculated by rules and data you provide; a human may review requests.
12. Changes
We may update this Privacy Policy by changing the “Last updated” date. Material changes may be communicated via the Service or email where appropriate.
13. Contact
Privacy-related requests: use the contact details provided in your confirmation messages or published on this site. For broader questions, see also our Terms of Service.
This Privacy Policy is for transparency and operational use. It is not legal advice. A qualified professional can adapt it to your company name, registered address, DPO appointment (if any), and actual tools you enable in production.