Legal / Privacy
Privacy for chats with a business's AI travel agent
How your chat is handled when you talk to the AI travel agent on a travel business's website.
v1, pending legal review. We wrote this first version from standard templates. A solicitor has not reviewed it yet, and it may change after that review.
- Who it's for
- People who chat with the AI travel agent on a travel business's website.
- Who is responsible
- The travel business that runs the AI travel agent, as controller. Foldox Limited trading as Travolia handles chats for that business, as its processor.
In short: You are chatting with an AI travel agent that a travel business runs on its own website. The business decides how your chat is used. Foldox Limited trading as Travolia provides the software and handles your chat for the business. Questions about your data go to the business first.
AI travel agents on business websites are not live yet. This notice describes how chats will be handled when they are.
Who is responsible
- The travel business that runs the AI travel agent is the controller. Its name and logo appear in the chat, and its own privacy notice applies to you.
- Foldox Limited trading as Travolia provides the software. We handle your chat only on the business's instructions, as its processor. That is why the chat says "Powered by Travolia".
When we run a demo ourselves, the business in the chat is made up, and Foldox Limited trading as Travolia is the controller for those chats.
Ask the business first
To see, correct or delete your chat, or to object to how it is used, contact the business. It decides on your request.
If you cannot reach the business, email us at [PRIVACY EMAIL]. We will pass your request on and help the business answer it.
What the chat collects
- Your messages and the agent's replies.
- Details you choose to give when you ask the business to follow up, such as your name, email address, phone number, travel dates, number of travellers and budget. The business receives these as an enquiry.
- Technical data needed to run and protect the chat: a random id in your browser that keeps your conversation together, the page you chatted on, your browser's type and language, and your IP address, which we use for rate limits and abuse checks.
Please don't share health details, passport numbers or card numbers in the chat. The business does not need them to answer your questions.
You are talking to an AI
The agent is an AI, not a person. It answers from the business's own trips and pages, and it can make mistakes. When it cannot help, someone at the business follows up.
How your chat is used
- To answer you and to send your enquiry to the business.
- To keep the service secure and stop abuse.
- For support the business asks us for.
- To count conversations for the business's plan, with no personal details in the counts.
We never use your chat to market the Travolia trip planner to you, we never use it to train AI for other businesses, and we never sell it.
Where it is stored
Your chat is stored in the EU. AI answers come from the AI providers listed below as sub-processors, with the transfer safeguards shown there.
To write a reply, we send your messages and the business's relevant content to one of these AI providers. Under their business terms, they do not use it to train their models.
| Provider | What it does | Where, and the safeguard |
|---|---|---|
| Supabase | Stores chats and enquiries | EU (Ireland) |
| Vercel | Hosting, and the servers that run the chat | United States and EU. Standard Contractual Clauses and the EU-US Data Privacy Framework |
| Anthropic | AI model that writes replies | United States. Standard Contractual Clauses |
| OpenAI | AI model, and search over the business's content | United States. Standard Contractual Clauses |
| Resend | Emails your enquiry to the business | United States. Standard Contractual Clauses |
For UK data, the UK addendum to the Standard Contractual Clauses applies.
How long it is kept
- The business decides how long chats are kept, and it can delete them at any time.
- Enquiries the business receives stay until the business deletes them.
- If the business closes its Travolia account, its chats are deleted after a 30-day grace period.
- Coming: a default limit of 90 days after the last message, which each business can set between 30 and 365 days.
Your rights
Under the GDPR, and the UK GDPR if you are in the UK, you can ask to see, correct or delete your data, limit or object to how it is used, and get a copy. Ask the business first.
You can complain to the data protection authority where you live or work. In Ireland that is the Data Protection Commission (dataprotection.ie), and in the UK the Information Commissioner's Office (ico.org.uk).