Privacy Policy

This policy explains how United Pyramids Pte. Ltd. (UEN 202346730K) ("WndrPlan", "we", "us") collects, uses, discloses and protects personal data when you use wndrplan.com and related applications. We handle personal data in accordance with the Singapore Personal Data Protection Act 2012 (PDPA).

Account data: your email address and authentication credentials. Passwords are stored only as salted hashes by our authentication provider; we never see them in plain text.

Trip data: the destination, travel dates, number and type of travellers, and trip purpose you enter, plus the packing lists and travel context generated for you.

Profile data: if you choose to provide them, your display name, home city and nationality. Nationality is used to work out visa and entry requirements for your destination. These are optional and the Service works without them.

Usage data: our hosting provider keeps standard server logs, which include your IP address, browser and device type, and the pages you request. These logs keep the Service running and help us detect abuse. We also keep basic records of how the Service is used, including which affiliate links are followed, as described in section 7. We do not run analytics or advertising tracking unless you accept the matching cookies; see section 8.

Communications: any message you send us.

What we may collect later: as we add features, some of them will need information this list does not cover. We will update this policy and tell you before any new collection starts, as described in section 15.

We do not ask for or store passport numbers, national identity numbers, or payment card numbers. Payment card details are handled entirely by our payment processor and never reach our servers. This is a deliberate design decision to reduce the amount of sensitive data we hold.

We also do not buy personal data about you, or receive it from data brokers or advertising networks. Everything we hold about you comes from you, or from your own use of the Service.

To create and maintain your account; to generate your packing lists and travel content; to remember your trips so you can return to them; to respond to your questions; to keep the Service secure and detect abuse; to understand which features are used so we can improve them; and to meet legal obligations.

Staff access: A small number of authorised WndrPlan staff can view account and trip data, such as your destination, travel dates, the suggestions generated for you and the items you tick. We do this only to fix problems, answer your questions and improve the Service. Staff use access-controlled internal tools, look only at what a task needs, and never sign in as you or change your trips unless you ask us to.

To generate your packing list and travel context, the trip details you enter are sent to a large language model hosted on Microsoft Azure OpenAI Service. Requests are processed in whichever of our provider's regions suits the request and gives the best performance at the time, which may be outside Singapore; see section 9. We send only the trip details needed to produce your result. We do not send your email address or account identifiers to the model. Generated results may be stored in a shared cache, keyed by destination and trip characteristics rather than by you, so that common trips return faster and cost less to produce. That shared cache contains no personal data. A copy of your result is also saved to your own trip, so that what you were shown does not change under you later. Our AI provider is contractually prevented from using your trip details to train or improve its models.

We share personal data only with service providers who help us run WndrPlan, and only as far as needed: our database, authentication and hosting provider (Supabase); Microsoft Azure, for AI generation and for map and place lookups; Google, if you choose to sign in with Google, for public holiday information, and — if you accept analytics cookies — Google Analytics; our email provider (Resend); our payment processor (Stripe); and our affiliate network (Travelpayouts), subject to your marketing cookie choice in section 8. We do not sell personal data and we do not share it with advertisers.

Google APIs. WndrPlan uses Google sign-in, and Google's calendar data for public holidays. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

How WndrPlan is funded. Some links in the Service take you to travel partners such as insurance, transport, accommodation, activity and eSIM providers. These are affiliate links: if you book through one, we may earn a commission at no extra cost to you. Affiliate links are part of how the free plan is paid for, so they appear throughout the Service and are not optional.

What we record. When you follow one of these links we record which partner it was, which part of the Service you followed it from, which trip it related to, and when. If a booking results, we record that and the commission earned. We use this to know which partners are worth keeping and to check that our commissions are correct. It is kept against your account.

What we do not do. We do not share your account or trip data with these partners. Following one of these links takes you to that partner's own website, where their privacy policy and their cookies apply, not ours.

Separately, our affiliate network can set its own tracking on this site. That is marketing tracking and it runs only if you accept marketing cookies. Declining does not stop a booking being credited to us: the link you follow carries that information to the partner's own site. Declining stops the network's tracking running on our pages. See section 8.

The full list of cookies, with what each one does and how long it lasts, is on our Cookie Policy page.

Strictly necessary. Your sign-in session, a small number of preference flags, and the record of the cookie choice you make. These are required for the Service to work and cannot be switched off.

Marketing. Our affiliate network (Travelpayouts) can set identifiers on this site. It does not load unless you accept marketing cookies, and if you decline it is never loaded. If you accept and later change your mind using the Cookie settings link in the footer, it is removed and the page reloads without it. Following an affiliate link still takes you to the partner's own website, where their cookies and their privacy policy apply, including the identifier that tells them you arrived from WndrPlan. That happens on their site rather than ours and is not changed by your choice here.

Analytics. If you accept analytics cookies, we use Google Analytics to see which pages and features are actually used, so we know what to improve. It sets its own cookies, which are listed on our Cookie Policy page. We send it page views only — not your name, your email address or your trip details. If you decline, it is never loaded. If you accept and later change your mind, we remove it, delete its cookies and reload the page without it.

Payment pages are hosted by Stripe and set their own cookies on Stripe's domain when you use them.

Do Not Track. Some browsers offer a "Do Not Track" setting. There is still no agreed standard for how a website should respond to it, so, like most sites, we do not currently respond to those signals. If a standard is adopted we will follow it and update this policy. Your cookie choice above is what controls tracking on WndrPlan, and it works whatever your browser's Do Not Track setting says.

WndrPlan is operated from Singapore. Our main database is hosted in Japan, and some of our providers process data in other countries. Where personal data is transferred abroad, we take steps to ensure a standard of protection comparable to the PDPA, including relying on contractual protections with those providers.

We keep account and trip data for as long as your account is active. If you ask us to delete your account by writing to hello@wndrplan.com, we delete or anonymise your personal data within a reasonable period, except where we must keep records to meet legal, accounting or dispute-resolution obligations. We acknowledge deletion requests within 5 working days and complete them within 30 days.

Under the PDPA you may request access to the personal data we hold about you, request correction of inaccurate data, withdraw consent to our use of your data, or ask us to delete your account. To ask us to delete your account, write to hello@wndrplan.com. For access, correction or withdrawal of consent, contact us using the details below. We will respond within a reasonable time. Withdrawing consent may mean we can no longer provide parts of the Service. If you are not satisfied with our response, you may contact Singapore's Personal Data Protection Commission.

WndrPlan is operated from Singapore. Where the EU or UK General Data Protection Regulation applies to you, the following also applies.

Why we are allowed to use your data. We use your account and trip data to perform our contract with you, which is providing the Service. We use limited data to keep the Service secure and to improve it, which is our legitimate interest in running a safe and useful product. Where we rely on consent, such as for non-essential cookies, you can withdraw it at any time.

Your rights. You can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict how we use it, object to our use of it, and ask for a portable copy. Write to hello@wndrplan.com and we will respond within one month.

Data leaving your country. WndrPlan is operated from Singapore and our main database is hosted in Japan, with other providers processing data in further countries. Japan has an adequacy decision from the European Commission, and is likewise recognised by the United Kingdom, which means transfers there are treated as offering an equivalent level of protection. Where data goes to a country without such a decision, we rely on the European Commission's standard contractual clauses, or the UK addendum, agreed with each provider.

Complaints. If you are not happy with how we have handled your data you can complain to the data protection authority in your country.

We use industry-standard measures including encryption in transit, hashed credentials, access controls and row-level database security. No system is completely secure, so we cannot guarantee absolute security, but we work to protect your data and will notify you and the relevant authority of a data breach where the law requires it.

The Service is not directed at children. You must be at least 13 to create an account, or at least 16 if you are in the European Economic Area or the United Kingdom. If you believe a child below these ages has given us personal data, write to hello@wndrplan.com and we will delete it.

We may update this policy. Material changes will be notified by email or in-app at least 14 days before they take effect.

Data Protection Officer: Lum Kian San, United Pyramids Pte. Ltd. · 73 Ubi Road 1, #05-54, Oxley Bizhub, Singapore 408733 · hello@wndrplan.com

General enquiries: hello@wndrplan.com