LEGAL
Privacy Policy
Last updated:
What we hold about you, what we have deliberately chosen not to hold, and who else touches it.
1. The short version
- We never see or store your card number. Stripe handles the card.
- We do not collect passport numbers at all. There is nowhere to put one and the booking interface rejects a request that includes one.
- Passenger names and dates of birth are encrypted before they are stored, and are deleted from nowhere else because they are stored nowhere else.
- There are no analytics, advertising, or tracking scripts on the site.
- The only cookie we set is the one that keeps you signed in. It cannot be read by JavaScript.
2. What we collect
When you sign in
Your email address, and a display name if you give us one. Sign-in is a one-time code emailed to you, so we hold no password and no password hash. Our database provider sends that email and issues the credential your browser holds.
When you use the site
- Travel preferences you choose to save — budget band, pace, interests, home airport, dietary and accessibility notes.
- Destinations you save.
- Your conversations with the travel agent, including everything you type into it. Do not type anything into it you would not want stored.
- Proposals an advisor has built for you, and the trips in them.
When you book
- For each passenger: given name, family name, date of birth, and optionally gender, email, and phone number. The airline requires these to issue a ticket.
- The order itself: the flight or stay booked, the price breakdown, the airline booking reference, and the sequence of states the order passed through.
- Payment records: the Stripe payment identifier, the amounts authorized, captured and refunded, and the processing fee. Not the card number, not the CVC, not the expiry. Those go from your browser to Stripe and never reach our servers.
Security and audit records
Actions that move money or change permissions are written to an audit trail recording who did what, to which record, and when. That record can include the IP address the request came from. Rate limiting also works on IP address. These exist to make fraud and mistakes traceable after the fact.
3. Passport numbers: not collected
Some airlines require passport details for some routes. travelers.so does not ask for them and has no field to store them in. The checkout interface does not collect them, and the API that receives passenger details rejects a request containing a passport number rather than quietly discarding it — because “quietly discarded” and “quietly stored” look identical from the outside.
Where an airline needs passport details, they are supplied to that airline at the point of booking and are not kept by us afterwards. Not holding a value is a stronger protection than encrypting it.
4. How passenger details are protected
Passenger names and dates of birth have to outlive your visit: confirming a booking with the airline can finish minutes after you close the tab, and the details have to still be there when it does.
They are therefore encrypted before being written, using AES-256-GCM with a key held separately from the database. Each record is bound to the order it belongs to, so an encrypted passenger record cannot be moved onto a different booking without the decryption failing. Someone who obtained a copy of the database alone would not be able to read them.
5. Cookies
One cookie, named travelers_session. It holds the credential that keeps you signed in.
- httpOnly — JavaScript on the page cannot read it, so a script injection cannot steal your session.
- secure — sent only over HTTPS everywhere except a local development machine.
- sameSite: lax — withheld from cross-site form posts, which is the request forgery case that matters, while still surviving a normal link into the site.
- Thirty days, after which you sign in again. Signing out revokes it on our side as well as clearing it from your browser.
There are no analytics cookies, advertising cookies, or third-party trackers. The site’s content security policy does not permit a script from any origin other than our own and Stripe’s payment library.
6. Who else processes your data
We use a small number of providers to run the service. Each does one job.
- InstantDB — our database, and the service that emails your sign-in code. It holds everything listed in section 2.
- Stripe — payments. Your card details go directly to Stripe. Stripe receives your email address so it can identify the payment.
- Duffel — airline booking. Receives the passenger details needed to issue a ticket and passes them to the airline.
- The airline or accommodation provider — receives whatever it needs to carry or host you, and then holds it under its own privacy policy, which we do not control.
- OpenRouter — routes travel agent conversations to a language model provider. Whatever you type into the agent is sent to it.
- Vercel — hosting, and therefore server logs.
- Upstash — rate-limit counters.
- YouTube (youtube-nocookie.com) — destination videos. The privacy-enhanced host is used and the player is only loaded if you click a thumbnail, so nothing is requested from YouTube until you ask for it.
We do not sell your personal data, and we do not share it with anyone for advertising.
TO BE COMPLETED — processor locations and international transfers
Where each of the above processes data, and what mechanism covers any transfer out of your region, is not stated. If travelers in the UK or EU are sold to, this section needs a lawyer’s answer and probably a data processing agreement with each provider named above.
7. Why we hold each thing
- Email address — to sign you in and to reach you about a booking.
- Preferences and saved destinations — so the service is useful on your second visit.
- Conversations — so you can come back to them, and so the agent has the context of what you already said.
- Passenger details — because an airline will not issue a ticket without them.
- Order and payment records — to fulfil the booking, to handle refunds and disputes, and to keep accurate financial records.
- Audit and security records — to detect and investigate fraud, and to be able to reconstruct what happened to a payment.
8. How long we keep it
TO BE COMPLETED — data retention period
No retention period is set. Financial and booking records typically have to be kept for a statutory minimum, while conversations and preferences have no such requirement and should be deleted sooner. Both figures need an owner’s decision and a lawyer’s check, and then the deletion has to actually be implemented — a stated period nothing enforces is worse than an honest silence.
9. Your rights
Depending on where you live you may have rights to access, correct, export, or delete the personal data we hold about you, and to object to some of its uses.
TO BE COMPLETED — applicable privacy regimes and the rights that follow
Which regimes apply — UK GDPR, EU GDPR, CCPA/CPRA, others — depends on where the operating entity is established and where travelers are sold to. The specific rights, the response deadlines, and the lawful bases relied on must be stated here by a lawyer rather than paraphrased from a template. Listing rights that do not apply, or omitting ones that do, are both real problems.
TO BE COMPLETED — data protection contact
An email address for privacy requests, and — if one is required — the name and contact details of a data protection officer or an EU/UK representative. Without this there is no route for a traveler to exercise any right at all.
10. Children
travelers.so accounts are for adults. Children can of course be passengers on a booking, in which case we hold a child’s name and date of birth, encrypted, because the airline requires them — provided by the adult making the booking, not collected from the child.
11. If something goes wrong
TO BE COMPLETED — breach notification
The commitment to notify affected travelers and any regulator, and the timeframe for doing so, needs to be stated and needs to match whatever the applicable regime requires.
12. Changes to this policy
The date at the top is the version you are reading. Related documents: the Terms of Service and the Refund and Cancellation Policy.