Legal / Privacy
Privacy for businesses
How we handle data about the travel businesses we work with: our early-access list, calls and business accounts.
v1, pending legal review. We wrote this first version from standard templates. A solicitor has not reviewed it yet, and it may change after that review.
- Who it's for
- People on our early-access list, people who talk to us about Travolia, and business account users.
- Who is responsible
- Foldox Limited trading as Travolia, as controller.
In short: Foldox Limited trading as Travolia decides how we use data about the travel businesses we work with, so we are the controller. That covers our early-access list, calls and business accounts. Chats between travellers and your AI travel agent work differently: there, your business is the controller and we are your processor.
Who this notice covers
- People who join our early-access list.
- People who book a call with us, email us or talk to us about Travolia.
- People who sign up for, or use, a Travolia business account, including team members.
- Contacts at travel businesses we get in touch with about Travolia.
Our early-access list
You can join the list on travolia.com by giving your website and email address and ticking the box to agree.
What we store
- Your email address and your website address.
- Which form you used, and when you agreed to join.
- Your browser's language and type.
- A one-way code made from your IP address and a key that changes every day. We use it only to stop floods of fake sign-ups. Once the key changes, the code cannot be turned back into your address. We never store your IP address itself.
- The preview of your AI travel agent that we build from the public pages of your website. This is mostly business information, but it can include staff names or contact details shown on your site.
Why we keep it: to build a preview of your AI travel agent from the website you give us, and to contact you about it and about early access to Travolia. Our legal basis is your consent, which you give by ticking the box.
Where: in our database in the EU.
How long: until you ask us to remove it. If we invite you to start and you do not open an account within 12 months, we delete your entry. If you open an account, the business account part of this notice applies.
How to remove it: email [PRIVACY EMAIL] from the address you signed up with and ask us to remove you. We stop contacting you and confirm within one month. We keep a short note that you opted out, so you are not added again by mistake. If you want every trace erased, say so, and we delete the entry completely.
Calls and conversations
If you book a call, email us or talk to us, we keep your name, contact details, business details and notes of what we discussed. We use them to answer you and follow up. Our legal basis is our legitimate interest in replying to you, or the steps you asked for before a contract.
We keep these records for up to two years after we last spoke, unless you become a customer.
Contacting travel businesses
We may contact you at work about Travolia, using business contact details published on your website or in a public directory. Our legal basis is our legitimate interest in telling travel businesses about Travolia. Every message tells you how to opt out, and we stop as soon as you ask.
Business accounts
Business accounts are not open yet. This part describes how we will handle account data when they open.
What we collect
- Your email address first: when you start, we ask for your email address before we build your AI travel agent, and we email you the link to it.
- Account and team details: names, email addresses, roles and sign-in details.
- Your business details: business name, website, and the websites you add your AI travel agent to.
- What you add to build your agent: pages from your website, brochures, spreadsheets, trips, prices and answers. This is mostly business information, but it can include staff names or contact details.
- Billing: Stripe takes payment. We see your plan and whether you have paid, not your full card number.
- Usage: how many conversations your agent has, settings you change, sign-in records and error logs.
- Support: anything you tell us when you ask for help.
Why, and our legal basis
| What we do | Our legal basis |
|---|---|
| Run your account and your AI travel agent | Contract |
| Count conversations against your plan's limit | Contract |
| Bill you and keep accounting records | Contract, and our legal duty under tax law |
| Keep the service secure, stop abuse and check you control the websites you add | Our legitimate interest in a safe service |
| Send service emails, such as your trial ending, reaching your limit or a new sub-processor | Contract |
| Send product news | Our legitimate interest; you can opt out at any time |
How long we keep it
- While your account is open.
- If you close your account and your business has team members, you first hand ownership to another member. If you are the only owner, we warn you, give you 30 days to change your mind and a copy of your data, and then delete it.
- Billing records: six years after the end of the financial year, as Irish tax law requires.
Chats on your AI travel agent
When travellers chat with your AI travel agent, your business decides how their data is used. You are the controller, and Foldox Limited trading as Travolia is your processor.
- We use those chats only to run the service for you, for security, and for support you ask for. We also count conversations for your plan, with no personal details in the counts.
- We never use them to market our trip planner, and we never use them to train AI for other businesses.
- You decide how long chats are kept. Enquiries stay until you delete them.
- Coming: a default limit of 90 days after the last message, which you can set between 30 and 365 days.
- Coming: a data processing agreement that sets out these rules.
Travellers can read Privacy for chats with a business's AI travel agent.
Where your data is stored
Your data is stored in the EU. AI answers come from the AI providers listed below as sub-processors, with the transfer safeguards shown there.
Sub-processors
These providers help us run Travolia for businesses and their AI travel agents. They act on our instructions.
| Provider | What it does | Where, and the safeguard |
|---|---|---|
| Supabase | Database and sign-in | EU (Ireland) |
| Vercel | Hosting, and the servers that run Travolia | United States and EU. Standard Contractual Clauses and the EU-US Data Privacy Framework |
| Anthropic | AI model that writes your agent's answers | United States. Standard Contractual Clauses |
| OpenAI | AI model, and search over your content | United States. Standard Contractual Clauses |
| Resend | Sends emails, including enquiries to you | United States. Standard Contractual Clauses |
| Stripe | Payments | United States and EU. Standard Contractual Clauses and the EU-US Data Privacy Framework |
Under their business terms, our AI providers do not use your data to train their models. For UK data, the UK addendum to the Standard Contractual Clauses applies.
Coming: a live sub-processor list with a change log. We will give business customers 30 days' notice before we add a sub-processor.
Your rights
You can ask to see, correct, delete or take a copy of your data, and object to how we use it, including to marketing at any time. Privacy at Travolia explains your rights and how to complain.
To ask, email [PRIVACY EMAIL].