Privacy Policy

1. Information We Collect

Information You Provide

When you create an account and use TravelSmart, you may provide:

• Account information: email address, display name, and profile photo.
• Trip preferences: destinations, travel dates, traveler composition (number of adults and children), interests, pace preference, travel style, and any notes you add to customise your trip.
• Saved content: trips, itineraries, bucket list items, and chat messages with the AI assistant.
• Communications: messages you send to us via email or through the platform.

Information Collected Automatically

When you use TravelSmart, we automatically collect:

• Usage data: pages visited, features used, buttons clicked, itineraries generated, and interactions with trip content. This data is collected through PostHog, a privacy-friendly analytics service that does not use cross-site tracking.
• Device and connection data: browser type, operating system, screen resolution, and approximate geographic region (derived from IP address, not precise location). We do not collect or store your precise GPS location.
• Session data: authentication tokens, session identifiers, and timestamps necessary to maintain your logged-in state.

Information We Do Not Collect

We do not collect payment card details (payments are processed entirely by our payment provider). We do not access your device contacts, camera, microphone, or files unless you explicitly upload a profile photo.

2. How We Use Your Information

We use the information we collect to:

• Generate personalised itineraries: your trip preferences (destination, dates, interests, pace, travel style, group composition, and notes) are sent to AI services to produce tailored travel recommendations.
• Improve the service: aggregated, anonymised usage data helps us understand which features are used, where users encounter friction, and how itinerary quality can be improved.
• Maintain your account: authentication, session management, and account security.
• Communicate with you: service updates, beta announcements, and responses to your enquiries. We will not send marketing emails without your consent.

We do not:

• Sell your personal data to third parties.
• Use your data to train AI models. Your trip preferences are sent to AI services to generate your itinerary in real time — they are not retained by those services for model training.
• Serve advertisements or share data with advertising networks.

3. Third-Party Services

To deliver the platform, TravelSmart relies on trusted third-party services for the following purposes:

• AI and language models — to generate itineraries, chat responses, and destination research.
• Mapping and venue data — to display maps, resolve venue details, calculate routes, and show photos.
• Flight and accommodation search — to find travel options matching your dates and preferences.
• Web research — to gather destination context, travel tips, and community insights from publicly available sources.
• Authentication — to securely manage account creation, login, and session management.
• Analytics — to understand how the product is used, using privacy-friendly tools that do not perform cross-site tracking.
• Hosting and infrastructure — to store your data securely and deliver the application.

Your trip preferences (destination, dates, interests, travel style) may be sent to these services as necessary to generate your itinerary. No personally identifiable information (name, email, profile photo) is shared with third parties beyond what is required for the service to function. Each third-party service is governed by its own privacy policy.

4. AI-Generated Content

TravelSmart uses artificial intelligence to generate itineraries, destination guides, venue recommendations, and travel tips. Important things to understand:

• AI content may contain inaccuracies. Opening hours, prices, availability, closure dates, and other details may be incorrect or outdated. Always verify critical information independently before your trip.
• AI content is not professional advice. TravelSmart does not provide professional travel advisory, medical, legal, or safety guidance. Use your own judgment when making travel decisions.
• Your preferences shape the output. The quality of AI recommendations depends on the preferences you provide. More specific inputs generally produce better results.
• We are not liable for AI errors. TravelSmart is not responsible for any loss, inconvenience, or expense resulting from reliance on AI-generated content, including but not limited to missed reservations, closed venues, or inaccurate directions.

5. Data Storage and Security

• Database: your data is stored in a managed PostgreSQL database with encrypted connections (TLS/SSL) for all data in transit and at rest.
• Authentication: account security uses industry-standard session management with secure cookies and password hashing.
• Profile photos: stored within our database. We do not use third-party file hosting services for user-uploaded images.
• Encryption: all data transmitted between your browser and our servers is encrypted using HTTPS (TLS 1.2+).
• Access controls: access to production databases and infrastructure is restricted to authorised personnel only.

While we implement industry-standard security measures, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security of your data.

6. Data Retention

• Account data: retained for as long as your account is active. If you delete your account, your data will be permanently removed within 30 days.
• Trip and chat data: retained for as long as your account is active. You can delete individual trips and chats at any time through the platform.
• Analytics data: anonymised usage data is retained for up to 12 months.
• Cached data: API response caches (venue details, flight results, weather data) are automatically purged on a rolling basis and are not linked to your identity.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Correction: request correction of inaccurate or incomplete data.
• Deletion: request deletion of your account and all associated data.
• Objection: object to specific processing of your data.

You can exercise most of these rights directly through your account settings. For any rights-related enquiries, contact us at iason@travelsmart.global. We will respond to all requests within 30 days.

8. Cookies

TravelSmart uses a minimal set of cookies:

• Essential cookies: session authentication cookies (Firebase session tokens) required for the service to function. These cannot be disabled without losing access to your account.
• Analytics cookies: we use first-party cookies for privacy-friendly analytics. Our analytics provider does not use cross-site tracking, does not build advertising profiles, and does not share data with third parties.
• No advertising cookies: we do not use advertising cookies, retargeting pixels, or cross-site tracking of any kind.

You can control cookie preferences through your browser settings. Disabling essential cookies will prevent you from using TravelSmart while logged in.

9. Children's Privacy

TravelSmart is not directed at children under 16. We do not knowingly collect personal information from children under 16. If you believe a child under 16 has provided us with personal data, please contact us at iason@travelsmart.global and we will delete it promptly.

Trip planning for families with children is supported — the “Add child” feature in trip preferences collects only the child's age range to tailor itinerary recommendations. No child's personal information (name, email, photo) is collected or stored.

10. International Data Transfers

TravelSmart's infrastructure spans multiple regions. Your data may be processed in jurisdictions outside your country of residence, including the United States and the European Union. We ensure that any international transfer of personal data is subject to appropriate safeguards in accordance with applicable data protection laws.

11. Beta Disclaimer

TravelSmart is currently in public beta. During the beta period:

• Features, data handling practices, and this policy may change as the product evolves.
• We will notify you of significant changes to this policy via email or through the platform.
• Beta features may be added or removed without notice.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will:

• Update the “Last updated” date at the top of this page.
• Notify registered users via email or an in-app notification.
• Post the updated policy on our website.

Your continued use of TravelSmart after changes are posted constitutes your acceptance of the updated policy.

13. Contact

If you have questions about this Privacy Policy or how we handle your data:

Email: iason@travelsmart.global
Website: travelsmart.global