The public MCP server (/api/mcp) and the showcase site work without signing up. No audience-measurement cookie, no advertising tracker, no third-party pixel is loaded.

Every tool call is recorded on the server for technical monitoring: the tool name, its arguments (the stations, dates and places requested), the status, the duration. On the public URL, this line is tied to no account and no browser identifier. These are search parameters, not an identity, but you should know all the same.

Creating a free account serves three purposes: a personal MCP URL, seat watches and a profile of travel constraints. What is then kept:

• your email address, for authentication and to send you your alerts;
• your travel profile: TGV Max pass, discount cards, usual departure city, favourite stations, preference, connections you tolerate;
• your watches and the alerts they produce (journey, period, availability detected);
• the log of the calls made through your personal MCP URL: tool, arguments, status, date. It is visible in your dashboard, under History: you see exactly what is stored.

Andiamo asks for no name, no phone number, no postal address, no payment method. It has no use for them.

The database and authentication are run by Supabase, on an instance hosted in the European Union (Paris region). The site and the MCP server run on Vercel. Alert emails, when you turn them on, go out through Resend.

These three providers are technical subprocessors: they handle the data to run the service, not on their own account.

A search queries outside services: SNCF Open Data for trains, transport.data.gouv.fr for bus and urban timetables, the French national address base to geocode a place, SerpAPI for flights. Andiamo passes them the question (a station, a city, a date, an airport code) and nothing more: not your email, not your account identifier, not your MCP token, not the content of your conversation with the assistant.

These sources therefore see requests that come from the Andiamo server, not from you.

Andiamo sells no ticket: it sends you on to the retailer. Some of these links may be partner links, flagged as such, and what travels with them is an opaque surface identifier, never personal data. The detail is on the partner links page. Once you are with the retailer, its own cookie policy applies.

• No sale, rental or transfer of data to a third party.
• No advertising profiling, no reselling of audiences.
• No model training on your searches or your conversations.
• No tracking cookie, on any page of the site.

Your profile, your watches and your alerts live for as long as your account exists. You can delete a watch at any time from the dashboard or with the delete_watch tool, and revoke a personal MCP URL from the Connector page.

Deleting the account erases the profile, the tokens, the watches and the alerts. The technical log lines are detached from the account: they no longer carry any link back to you.

You have a right of access, rectification, erasure, objection and portability over this data. To exercise it, or to request account deletion, go through the support channel below.

The public channel is the repository issue tracker: github.com/NicoLeblanc/andiamo/issues. A ticket there is visible to everyone: do not write any personal data in it. For a request that touches your account, just say what you want done, and verification will go through the account email address.

Andiamo is an independent project, not affiliated with SNCF or any operator. The code is open: everything described here can be checked in the repository.

It describes the real behaviour of the service at the moment you read it. Any change to storage or providers is made in the same commit as the code change, and its history is public in the repository.