Privacy & AI Policy

How to reach us

• Data-protection enquiries & rights requests: privacy@tripztravel.com
• Data Protection Officer: [DPO Name and Contact, if appointed — leave blank if no DPO is required for this organisation]
• EU/EEA representative (Article 27 EU GDPR): [EU Representative Name and Address — to be appointed before EU launch]
• Post: [Your Company Legal Name], [Registered Address]

Data we store, why, and on what legal basis

• Account details (your name, email address) — used to identify you and send you transactional notifications about your account.Lawful basis: performance of a contract (UK GDPR / EU GDPR Article 6(1)(b)).
• Trip itinerary data — flights, hotels, and events you add manually or that are detected from connected accounts. This is the core product.Lawful basis: performance of a contract (Article 6(1)(b)).
• Booking references (PNRs) — encrypted using AES-256-GCM with per-user encryption keys before they are written to our database.Lawful basis: performance of a contract (Article 6(1)(b)).
• Legal name, date of birth, passport details (only if you choose to add them) — encrypted using AES-256-GCM with per-user keys. We never share these with third parties without your explicit instruction.Lawful basis: performance of a contract (Article 6(1)(b)). Where this includes information that may reveal special-category data, we rely on your explicit consent (Article 9(2)(a)).
• Connected account tokens — the OAuth tokens for Google Calendar, Outlook, or Outlook Calendar that allow us to scan for bookings. New tokens are encrypted at rest with per-user keys; we are completing a backfill of legacy tokens to bring all rows under encryption.Lawful basis: your consent at the point of connection (Article 6(1)(a)). You can withdraw consent at any time by disconnecting the account.
• Travel preferences (optional) — travel pace, interests, transport and accommodation preferences, budget, dietary requirements and accessibility needs. Relevant preferences are sent to Tripz Travel's AI service to personalise your answer when AI is enabled. Dietary and accessibility information requires the relevant explicit consent; these settings are separate from learning from past trips.Lawful basis: your consent (Article 6(1)(a)). Where preferences include health-related information (e.g. accessibility, dietary needs), we rely on your explicit consent (Article 9(2)(a)).
• Push notification tokens — if you opt in to push notifications, your browser or device generates a push subscription endpoint (a URL provided by your browser vendor's push service, such as Google FCM or Apple APNS) and associated encryption keys. These are stored so Tripz Travel can deliver notifications such as trip alerts and booking confirmations to your device.Lawful basis: your consent at the point of opting in (Article 6(1)(a)). You can withdraw consent at any time by revoking notification permission in your browser or device settings, or from Settings → Notifications.
• Security and audit logs — limited operational logs we keep to detect fraud, debug problems, and meet our legal obligations.Lawful basis: legitimate interests (Article 6(1)(f)) and legal obligation (Article 6(1)(c)) where retention is required by law.
• Native app diagnostics and performance data — only if you turn on "Share operational diagnostics" in Settings → Security, Tripz Travel's native app and Share Extension collect bounded crash, hang, launch, performance, and reliability summaries together with app, build, and operating-system versions. Reports covering a period before consent, a different account, or an interruption in consent are discarded. Diagnostics carry account-linked pseudonymous references so we can diagnose recurring failures and locate records for access or deletion requests. These references are personal data while Tripz Travel can link them to your account. We use diagnostics only to maintain app functionality, not to evaluate user behaviour, audiences, or feature effectiveness. They never include itinerary content, shared text, booking references, emails, tokens, raw stack traces, or raw device-diagnostics reports.Lawful basis: your consent (Article 6(1)(a)). Diagnostics are off until you choose to enable them. Your choice applies to the native app and Share Extension on devices signed in to the same Tripz Travel account. Declining or withdrawing consent does not reduce app functionality. You can withdraw as easily as you opt in, using the same setting. Section 6 explains how withdrawal and sign-out work.
• Affiliate referral data — when you click an affiliate suggestion attached to a Trip, Tripz Travel creates a random per-viewer tracking identifier and keeps the server-side mapping between that identifier, your account, and the suggestion. The outbound link contains the opaque tracking value and may also contain the limited Trip details needed to prefill the service you chose — for example, a city, travel date or time, party and luggage counts, and pickup or drop-off names, types, and coordinates. It does not contain your Tripz Travel account name, email address, booking reference, passport details, or free-form itinerary notes. We use the mapping for commission attribution, troubleshooting, and aggregate provider-performance reporting, not advertising or personalisation. Where a partner runs an embedded widget on Tripz Travel, it operates only with your consent.Lawful basis: performance of our contract with you (Article 6(1)(b)) for the service prefill you request, and legitimate interests (Article 6(1)(f)) for operating and measuring Tripz Travel's affiliate referrals. The identifier is pseudonymous personal data while Tripz Travel can resolve it to your account. You may object to legitimate-interests processing as described in Section 10. Consent (Article 6(1)(a) and PECR Reg 6) applies to any embedded widget that stores or reads information on your device.

Data we do NOT collect

• Raw email body content beyond what is needed to extract structured travel data — we extract booking details and discard the rest. Some processing of email content is unavoidable as part of the classification step (see Section 4).
• Financial information such as card numbers or bank details. Payments for paid plans are handled directly by our payment processor; we never see your card data.
• Real-time location tracking, advertising identifiers, or behavioural advertising profiles built from your activity across the web.
• Special-category data (such as health, religion, sexuality, or political views) beyond the limited optional preferences described above, and never without your explicit consent.

• Encrypted at rest: If our database were compromised, the encrypted fields are mathematically unreadable ciphertext without the corresponding encryption keys.
• Restricted staff access: Routine staff and support access does not include the ability to read encrypted fields. Decryption can only happen through audited, role-restricted pathways, and any such access is logged. We are not, however, technically incapable of decrypting your data — staff with the appropriate role can decrypt where strictly necessary (for example, to comply with a legal obligation or to investigate a security incident affecting your account).
• Account deletion and encryption: Successful account deletion removes your account's stored encryption key from the live database. Shared bookings and their keys can remain for other members, and limited security records use separate encryption keys. Backups can contain earlier copies of both encrypted data and protected keys, so removing a key from the live database does not by itself make those copies unreadable. See Section 9 for retained records and backup limitations.
• Searchable encryption: Booking references are also stored as keyed hashes (HMAC-SHA256 with a per-user salt) so we can detect duplicates without storing or reading the plaintext value.
• Transport security: All data in transit between your device and Tripz Travel, and between Tripz Travel and our service providers, is protected by TLS 1.2 or higher.

• Scopes requested: gmail.readonly (email) and calendar.events.readonly (calendar). Read-only. No write access.
• What we examine: Our system identifies emails likely to contain travel bookings (using sender lists and keyword filters) and reads those emails to extract booking data. Emails that don't look travel-related are filtered out without their content being stored.
• What we keep: Only the structured booking data we extract — flight numbers, dates, hotel names, check-in/check-out times. Raw email content is not retained after extraction.
• Revoke at any time: Disconnect from Tripz Travel Settings, or revoke directly at myaccount.google.com/permissions.
• Google Limited Use Policy: Tripz Travel's use of data obtained via Google APIs strictly complies with the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the travel itinerary feature visible in the Tripz Travel app. It is never used for advertising, sold to third parties, or used to train AI models.

• Permissions requested: Mail.Read and Calendars.Read. Read-only. No write access.
• What we examine and keep: Same approach as Google — we identify travel-related items, extract structured data, and discard the rest. Raw content is not retained after extraction.
• Revoke at any time: Disconnect from Tripz Travel Settings, or revoke directly at account.live.com/consent/Manage or myapps.microsoft.com.
• Microsoft API Terms: Tripz Travel complies with the Microsoft APIs Terms of Use. Microsoft user data is used exclusively to provide the itinerary feature. It is never used for advertising, sold, or shared with third parties.

Email and calendar extraction

• When a likely booking confirmation is found in your inbox or calendar, its content is sent to our AI extraction model so it can identify the booking type, dates, locations, and reference numbers.
• Before content is sent to the model, we apply a prompt-injection sanitiser and a length cap, and we strip data not needed for extraction where we can identify it. Some personal information (for example, your name) may necessarily be present in the content the model reads, because that information is part of the booking confirmation itself.
• After extraction, only the structured result (booking type, reference, dates, locations) is saved to your itinerary. The raw email or calendar content is not retained.
• Automated processing. This extraction is automated and operates on personal data. It is not a decision that produces legal effects or similarly significantly affects you within the meaning of UK GDPR / EU GDPR Article 22 — it simply files the booking under your itinerary, which you can then review, edit, or delete. You can pause automatic booking imports by turning off "Use AI" in Settings → AI & Privacy, or disconnect your inbox or calendar at any time.

Travel Copilot suggestions

• Tripz Travel analyses your itinerary for gaps — long waits, empty evenings, layovers — and suggests relevant services (luggage storage, restaurant bookings, lounge access).
• With cloud AI enabled, Copilot uses relevant saved Travel Style preferences, subject to the applicable dietary and accessibility permissions. Learn from my trips separately controls whether Copilot may learn and use patterns from past trips and feedback.
• Your data is not used to train external AI models. Content sent to our AI provider is not retained by them and is not used by them to improve their models (see below).

Cloud AI provider

• Email and calendar extraction uses GPT-5 nano through Microsoft Azure AI Services. This deployment currently processes data in Sweden Central.
• Copilot suggestions uses the same GPT-5 nano deployment through Microsoft Azure AI Services. Microsoft contractually commits that customer data submitted via the Azure OpenAI API is not used to train or improve OpenAI's or Microsoft's foundation models.
• Content sent for the suggestions feature can contain your question, the requested destination and dates, relevant saved preferences, permitted learned patterns, and itinerary structure (dates, locations, types of booking) when a trip is in context. Booking references, passport details, and full names are not included in suggestions prompts.
• Copilot chat transcripts can contain sensitive travel details. Visible transcript history is retained for up to 90 days by default. Normalized request facts and private permission revisions are retained with the conversation. Older answers can remain visible after a settings change while being excluded from future model context. Clear Chat removes the selected dashboard or trip chat from visible history and future Copilot context, and account deletion or valid erasure requests remove Copilot chat records as required.

AI on your device

• On supported Apple devices, Tripz Travel uses Apple's on-device AI to help identify details from activities you share with Tripz Travel. This AI processing runs on your device, without sending the content to a remote AI service for that processing.
• These features remain available when "Use AI" is turned off in Tripz Travel. Availability depends on your device and Apple Intelligence settings. You can review and edit suggested details before saving.
• Other parts of sharing still use an internet connection—for example, loading your trips, searching for a location or saving an activity to your Tripz Travel account. Saved details follow the usual storage and trip-sharing rules described in this policy.

International transfers and safeguards

• UK-to-EEA transfers are covered by the UK's adequacy decision in respect of the EEA and require no additional safeguards.
• Transfers to the United States (for example, certain Microsoft and Google support and security functions) are protected by the European Commission's adequacy decision under the EU-US Data Privacy Framework, the UK's "UK Extension" to the DPF, and Standard Contractual Clauses (SCCs) plus the UK International Data Transfer Addendum (IDTA) with the relevant providers, as appropriate.
• Transfers to Cyprus (TravelPayouts) are within the EEA and require no additional safeguards.
• Other transfers (where they occur) are made under SCCs, IDTAs, or equivalent safeguards and are accompanied by Transfer Impact Assessments.
• You can request copies of the relevant transfer mechanisms by contacting privacy@tripztravel.com.

Service providers (sub-processors)

These providers process personal data on our behalf under contractual obligations consistent with UK GDPR / EU GDPR Article 28.

• Microsoft Azure — cloud hosting, database, storage, queue (Service Bus), Key Vault, Application Insights and Log Analytics for opted-in native diagnostics, and Azure OpenAI Service. Microsoft processes this data for Tripz Travel under our contractual instructions.
• Apple Maps — trip maps, plan maps and planning map results connect your browser to Apple when you open the map feature. Apple receives ordinary request information, including your IP address, and the map view. Tripz Travel displays the relevant place coordinates and labels without requesting your device location. Requested directions and route optimisation also send waypoint coordinates to Apple Maps server-side. Apple Maps analytics endpoints remain blocked.
• Mapbox — the Mapbox browser SDK remains disabled in this web build. External directions links open Apple Maps or Google Maps only when selected. Some avatars and cover images load directly from Google, DiceBear or Pexels rather than through Tripz Travel's image proxy, exposing ordinary request information including your IP address to those providers.
• Google LLC — Google OAuth (sign-in), Google Calendar API, and Gmail API (when enabled). No Google advertising or analytics products are used.
• Microsoft Graph — Outlook Mail and Outlook Calendar APIs.
• TravelPayouts (TP Pte. Ltd., Cyprus) — affiliate network used to create tracked partner links and report confirmed conversions. Tripz Travel sends the complete partner destination URL and a random per-viewer attribution identifier to its server-side APIs. A destination URL may contain the limited Trip-derived service-prefill details described in Section 2; it does not contain your Tripz Travel account name, email address, booking reference, passport details, or free-form itinerary notes. Tripz Travel's redirect suppresses browser referrer data, and no TravelPayouts JavaScript or widget runs on tripztravel.com.
• Resend (Resend Inc.) — transactional email delivery for magic-link sign-in, trip notifications, and account communications.
• Stripe (Stripe, Inc.) — payment processing for paid subscriptions. Card data is entered directly on Stripe's infrastructure; Tripz Travel never sees or stores your card details.
• Browser push services (Google FCM / Apple APNS) — if you opt in to push notifications, your browser's push service (provided by Google or Apple depending on your device) delivers notifications to your device. Tripz Travel sends only the notification payload to the push service; your subscription endpoint URL is stored in our database and deleted when you revoke notification permission.

Other members on a shared trip

When you join a Tripz Travel trip with other people, the other members of that trip can see the bookings you add to it. This is how shared trip-planning works on Tripz Travel. The data shared includes booking reference numbers (PNRs), access codes, passenger and guest names, hotel addresses and check-in instructions, restaurant booking details, and any notes you add to a booking (which may include dietary requirements). It does not include your account-level data — your passport details, date of birth, home city, billing information, and travel preferences set in Settings remain on your account and are not visible to other trip members.

How consent is captured:

• — When you accept an invite to a trip, we show you the full sharing terms before you join and record your acceptance.
• — When you merge one of your own trips into a shared trip, we show you a separate confirmation describing exactly what you are about to share, and record that consent.
• — When you add dietary requirements in Settings, we ask for explicit consent under UK/EU GDPR Article 9(2)(a) because dietary information may include health, allergy or religious data.

Dynamic membership and notification:

A trip's membership can change over time. When a new person is added to a trip you are on, we notify you (by in-app banner, push notification, and email) so you always know who can see your bookings. You can leave the trip at any time with one tap from the trip page. Leaving stops your future bookings from being shared; bookings you have already added to the trip remain in the trip's data and can be removed by request under your erasure rights below.

Lawful basis: your consent (Article 6(1)(a)), with explicit consent under Article 9(2)(a) for dietary information specifically. Recorded as a ConsentEvent log entry at each consent moment.

Affiliate partners (independent controllers)

When Tripz Travel suggests a partner service and you tap to book, we send you to the partner's website via a tracking link. The link contains the attribution value and may contain limited Trip-derived details that prefill the service you selected, as described in Section 2. It does not contain your Tripz Travel account name, email address, booking reference, passport details, or free-form itinerary notes. Once you arrive on the partner's site, the partner becomes an independent data controller under their own privacy policy; what they collect, what cookies they set on their own domain, and how they use your data is their responsibility, not ours.

Current partners include:

• — GetYourGuide — tours and activities
• — Klook — tours, activities, dining, and transfers
• — Welcome Pickups — pre-booked airport transfers
• — Bounce — luggage storage
• — Radical Storage — luggage storage

We may earn a commission if you book via a partner link, at no additional cost to you (see Terms of Service Section 6). Full details of the cookies (if any) we set on tripztravel.com in connection with affiliate links are in the Cookie Policy.

Legal & safety disclosures

• We may disclose data where we are legally required to (for example, in response to a valid court order or law-enforcement request), where it is necessary to protect the rights, safety, or property of Tripz Travel or others, or in connection with a corporate transaction (merger, acquisition, restructuring) — in which case we will give you advance notice and your data-protection rights will continue to apply.

• Trip itinerary data: Saved trips, booking details and history do not expire based on the trip's end date. They remain until you remove them or their trip or account is deleted under the rules below. When an owner deletes their account, a shared trip passes to its oldest eligible editor. Trips and Plans without an eligible remaining editor are deleted; viewers do not inherit. Shared bookings remain available in surviving trips. Repayments between other travellers, shared budgets and evidence for surviving expenses remain without creator attribution. Existing deletion rules still remove financial records involving the deleted account as payer or payee. Authored Trip polls and their votes are deleted, while itinerary events created from them remain. Plan date-window polls retain their shared dates without creator attribution. Structured mentions of the deleted account are removed from retained comments and notes. Comment, mention and poll notification previews contain no names or copied content. The departing member's private participant data, personal history and owned memories are deleted separately.
• Connected account tokens: Retained while your connector is active in Tripz Travel. We delete Tripz Travel's stored connector credentials when you disconnect the connector in Settings or successfully delete your Tripz Travel account. Removal of permissions at the provider is a separate step, described below.
• Email and calendar content: Not retained after extraction. Only the structured booking data is kept.
• Derived travel memories: Deleted when you turn off Learn from my trips or close your account. Original trips and reviews follow their own retention rules.
• Account data: Retained until you delete your account. See Section 10.
• Trip affiliate click attribution: Tripz Travel keeps the server-side mapping between your account, a Trip affiliate suggestion, and its random tracking identifier for 90 days after your most recent click on that suggestion. An automated privacy job deletes expired mappings. Anonymous aggregate operational metrics do not contain your account, trip, link, or tracking identifier.
• Affiliate conversion records: We retain confirmed conversions separately for accounting, payment disputes, and legal obligations. We remove the direct account identifier from the conversion record when your account is deleted. Removing that link does not necessarily make the remaining record anonymous. The financial-record retention limitations below also apply to these records.
• Billing, tax and other financial records: Account deletion does not erase all payment, refund, dispute or accounting evidence held by Tripz Travel or payment providers. Where UK company accounting requirements apply, records normally need to be kept for 6 years from the end of the last company financial year they relate to, and longer in specified circumstances. This is not an automatic deletion date for every financial record. Tripz Travel has not yet set and implemented deletion deadlines for every type of retained financial record, so some records may remain beyond that period. Contact privacy@tripztravel.com to ask about records retained after your account is deleted or to request erasure.
• Security and audit logs: Database audit records follow a 12-month retention limit for fraud detection and security investigations, with expired records removed by scheduled cleanup. Limited security evidence, including encrypted identifiers of the people involved and pseudonymous security identifiers, may remain after account deletion during this period. These records can still be personal data and are not erased by deleting a per-user encryption key. Operational custom events in Azure Application Insights follow the shared 30-day event retention period.
• Opted-in native app diagnostics: Stored in Microsoft Azure Application Insights and its linked Log Analytics workspace with a 30-day retention period and no additional archive retention. Withdrawing consent or deleting your account starts earlier erasure of the relevant records and their retained copies, without waiting for the normal expiry date. We stop using those records for diagnostics while erasure is pending, track deletion with Microsoft, and check for records that arrive after the withdrawal. An upload already received cannot be recalled instantly, so we confirm completion only when the deletion process has finished. You can contact privacy@tripztravel.com for access, deletion or the status of an outstanding request.
• Diagnostics consent and erasure records: We retain a limited record of your choice, when it was made, the notice you saw, and the progress of any withdrawal or deletion while it is needed to demonstrate consent and complete erasure. Once the covered diagnostics and their copies are deleted, we delete this evidence unless a specific legal obligation or legal claim requires limited further retention, and then only for as long as necessary. These records are not used to analyse how you use the app.
• Browser continuity summaries: Viewing trip and plan pages automatically saves limited summaries locally for the trip error-page fallback. These summaries are distinct from the opt-in Offline Vault, have no automatic expiry, and are not removed by the current offline sign-out cleanup. Clear site storage through your browser to remove them. See the cookie inventory for the fields and storage keys.
• Backups: Automatic database backups are currently configured for 7 days. We have not verified a maximum retention period covering every export or other recovery copy. Account deletion does not immediately erase backup copies, which may contain both encrypted data and protected encryption keys. Deletions are not currently reapplied automatically when an older database backup is restored, so a restoration can bring deleted account data back into the service. Native diagnostics and their retained copies follow the separate erasure process described above.

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Ask us to correct inaccurate or incomplete data.
• Right to erasure ("Right to be Forgotten"): Delete your account from Settings → Danger Zone, or contact us to request deletion of specific personal data without closing your account. We start erasure without undue delay, including removal of your account's stored encryption key from the live database and the native diagnostics erasure process. The retained records and backup limitations in Section 9 still apply. We track processor erasure for opted-in native diagnostics as described there; provider permission removal can remain unconfirmed as explained above. Contact us for the outcome of your request.
• Right to restrict processing: Turn off AI or Learn from my trips, withdraw relevant Travel Style permissions, disconnect connectors, or contact us to restrict specific processing activities.
• Right to data portability: Request an export of your trip data in a machine-readable format.
• Right to object: Object to any processing carried out under our legitimate interests (such as error tracking or affiliate referral attribution).
• Right to withdraw consent: Where we rely on your consent (for example, optional preferences, connected accounts, opted-in native diagnostics, analytics, or embedded affiliate widgets), you can withdraw consent at any time without affecting prior lawful processing. For native diagnostics, turn off "Share operational diagnostics" in Settings → Security to withdraw the account choice and start erasure of the covered records. Withdrawal does not reduce app functionality.
• Rights in relation to automated processing: See Section 5 for how the AI extraction works and how to opt out.

How to exercise your rights and complain

To exercise any of these rights, contact privacy@tripztravel.com. If we have reasonable doubts about your identity, we ask only for the additional information needed to verify that the request is yours. Requests are normally free. For UK and EU GDPR requests, any fee or refusal on the basis that a request is manifestly unfounded or excessive must be justified and explained to you.

You also have the right to lodge a complaint with a data-protection regulator:

• — UK: Information Commissioner's Office — ico.org.uk
• — EEA: Your country's data-protection authority. The full list is published by the European Data Protection Board at edpb.europa.eu.
• — Switzerland: Federal Data Protection and Information Commissioner — edoeb.admin.ch.

Tripz Travel is not intended for children. You must be at least 16 years old to use Tripz Travel (see Terms of Service, Section 3). We do not knowingly collect personal data from anyone under 16. If you believe a child under 16 has provided personal data to Tripz Travel, please contact privacy@tripztravel.com and we will delete it.

Tripz Travel uses cookies that are strictly necessary for the service to function (for example, to keep you signed in). Where we introduce any non-essential cookies or similar technologies — such as analytics — we ask for your consent first via our cookie banner, and you can change your preferences at any time.

For full details of which cookies we use, what they do, how long they last, and how to control them, see our Cookie Policy.

• Most data is stored and processed within Microsoft Azure (UK South region). AI suggestion processing uses Azure OpenAI Service in European data-centre regions.
• Data in transit is protected by TLS 1.2 or higher.
• Encryption keys for sensitive fields are managed in Azure Key Vault. Application code does not hold raw key material directly.
• In the event of a personal-data breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority (the ICO in the UK, the lead EU/EEA DPA, and/or the Swiss FDPIC) without undue delay and where feasible within 72 hours of becoming aware of it, as required by UK GDPR / EU GDPR Article 33 and the Swiss FADP. Where the risk is high, we will also notify affected users without undue delay.