Privacy Policy

Account data: name, email address, password hash, language and currency preferences, and two-factor authentication settings.

Travel profile: budget levels, destination and food preferences, accommodation and transport choices, accessibility and mobility needs, and trip history you choose to save.

Transaction data: subscription status, invoices, payment method metadata and booking records. Full card numbers are never stored on our systems; they are handled by our PCI-DSS compliant payment processors.

Technical data: IP address, device and browser type, and security event logs used for fraud prevention and abuse detection.

To generate, price and optimize trip plans, recommendations and itineraries.

To operate accounts, subscriptions, bookings, invoices and customer support.

To detect suspicious logins, prevent fraud and maintain audit logs required for security.

To improve recommendation quality in aggregate. We do not use your personal travel data to train models sold to third parties.

Contract performance for account, planning and booking features; legitimate interest for security, fraud prevention and service improvement; consent for optional marketing communications and non-essential cookies; and legal obligation for accounting and tax records.

We share only what a transaction requires: booking details with the partner fulfilling it, payment data with our payment processors, and message content with support tooling. Each processor is bound by a data processing agreement.

We never sell personal data, and we do not share your travel profile with advertisers.

With your consent, we use Google Analytics (GA4, provided by Google) to measure site traffic and clicks on partner links (such as Trip.com and Voyage Privé). This helps us understand which offers are useful and improve the service.

Data processed: pages viewed, click events on partner links, approximate region, and device/browser information. Recipients: Googjet and Google, acting as processor under its data processing terms.

In the European Economic Area, the United Kingdom and Switzerland, analytics runs only after you accept via the cookie banner; elsewhere it runs by default, honoring applicable opt-outs. You can change your choice at any time via “Préférences cookies” in the footer — withdrawing stops analytics immediately.

Passwords are hashed with Argon2. Sensitive fields are encrypted at rest, and all traffic is served over HTTPS with strict transport security. Access to production data is role-based, logged and reviewed.

We follow OWASP guidance for input validation, output sanitization, session management, rate limiting and dependency hygiene.

Account and travel profile data is retained while your account is active. Invoices and tax records are retained for the period required by law. Security logs are retained for a limited window and then deleted.

You may access, correct, export or delete your personal data, object to processing based on legitimate interest, and withdraw consent at any time. Requests can be made from your account settings or by contacting us; we respond within one month.

Where data is processed outside your region, transfers rely on adequacy decisions or standard contractual clauses with supplementary safeguards.

Privacy questions and data requests: privacy@travel-ai.app. Security disclosures: security@travel-ai.app.