ABSTRACT This paper presents SmartTur+ECO, a system for tourist attractions that integrates conversational recommendation systems (CRS), virtual reality (VR) and gamification. It efficiently gathers trip data and elicits user preferences through interactions with a chatbot, addressing the user‐cold start problem common in tourism. Using an exploit‐explore approach with sentence embeddings from POI descriptions, SmartTur+ECO provides precise and personalized recommendations organized into multi‐day plans, considering opening hours and locations. VR integration offers immersive pre‐trip experiences, helping users make informed decisions. Gamification elements like mini‐games and rewards are designed to foster user engagement and motivation. SmartTur+ECO's modular and scalable architecture ensures compatibility with various devices and allows for the easy integration of new algorithms and data sources, with the aim of supporting recommendation processes. This innovative combination sets new standards in tourism by making travel planning more efficient, entertaining and meaningful.

The rapid growth of platforms for customizing Large Language Models (LLMs), such as OpenAI’s GPTs, has raised new privacy and security concerns, particularly related to the exposure of user data via third-party API integrations in LLM apps. To assess privacy risks and data practices, we conducted a large-scale analysis of OpenAI’s GPTs ecosystem. Through the analysis of 5,286 GPTs and the 44,102 parameters they use through API calls to external services, we systematically investigated the types of user data collected, as well as the completeness and discrepancies between actual data flows and GPTs’ stated privacy policies. Our results highlight that approximately 35% of API parameters enable the sharing of sensitive or personally identifiable information, yet only 15% of corresponding privacy policies provide complete disclosure. By quantifying these discrepancies, our study exposes critical privacy risks and underscores the need for stronger oversight and support tools in LLM-based application development. Furthermore, we uncover widespread problematic practices among GPT creators, such as missing or inaccurate privacy policies and a misunderstanding of their privacy responsibilities. Building on these insights, we propose design recommendations that include actionable measurements to improve transparency and informed consent, enhance creator responsibility, and strengthen regulation.

GPTs are customized LLM apps built on OpenAI's large language model.Any individual or organization can use and create GPTs without needing programming skills.However, the rapid proliferation of over three million GPTs has raised signifcant privacy concerns.To explore the privacy perspectives of users and creators, we interviewed 23 GPT users with varying levels of creation experience.Our fndings reveal blurred lines between user and creator roles and their understanding of GPT data fows.Participants raised concerns about data handling during collection, processing, and dissemination, alongside the lack of privacy regulations.Creators also worried about loss of their proprietary knowledge.In response, participants adopted practices like self-censoring input, evaluating GPT actions, and minimizing usage traces.Focusing on the dual role of user-creators, we fnd that expertise and responsibility shape privacy perceptions.Based on these insights, we propose practical recommendations to improve data transparency and platform regulations.