Legal / Privacy
Privacy for travellers
How we handle your data when you read our travel guides or use the Travolia trip planner.
v1, pending legal review. We wrote this first version from standard templates. A solicitor has not reviewed it yet, and it may change after that review.
- Who it's for
- Readers of our guides and blog, and people who use the trip planner.
- Who is responsible
- Foldox Limited trading as Travolia, as controller.
In short: Foldox Limited trading as Travolia runs the Travolia trip planner and the travel guides on travolia.com. We use your data to run the planner, keep it safe and make it better. We never sell it.
Who this notice covers
- People who read our travel guides, visa guides and blog.
- People who use the Travolia trip planner on the web or in our iOS app, with or without an account.
It does not cover chats with the AI travel agent on a travel business's website. The business runs that chat. Read Privacy for chats with a business's AI travel agent instead.
What we collect
When you read our guides and blog
- Technical data your browser sends: your IP address, browser and device type, and the page you asked for. Our hosting provider keeps this in server logs for security.
- Analytics, only if you agree in the cookie banner. See Cookies and storage.
You do not need an account to read our guides.
When you use the trip planner
- Account details: your email address, your name and picture if you add them, and your password, which we store only as a secure hash. If you sign in with Google or Apple, they send us your name and email address.
- What you plan: destinations, dates, budget, travel style, the trips you create, and your chats with the AI planner.
- Guest use: if you plan without an account, your browser gets a random guest id. We use it to apply guest limits. Trips you make as a guest are saved in your browser.
- Payments: if you subscribe, Stripe on the web or Apple in the iOS app takes the payment. We see your plan and whether you have paid, not your full card number.
- App data: if you allow notifications in the iOS app, a device token so we can send them. Images you upload, such as a profile picture.
- Support: anything you tell us when you contact us.
Please don't put health details, passport numbers or card numbers into a chat. The planner does not need them.
How we use it, and why we are allowed to
| What we do | Our legal basis |
|---|---|
| Run your account, save and sync your trips, and answer your chats | To provide the service you asked for (contract) |
| Apply guest and free-use limits, stop abuse, keep the service secure and fix errors | Our legitimate interest in a safe, working service |
| Take payments and keep billing records | Contract, and our legal duty to keep tax records |
| Send account emails, such as sign-in links and receipts | Contract |
| Count how features are used, to improve the planner | Our legitimate interest in improving it |
| Measure visits to our pages with analytics | Your consent, given in the cookie banner |
AI in the planner
The planner's answers are written by AI models from Anthropic and OpenAI. We send them your messages and the trip details they need to answer. Under their business terms, they do not use this data to train their models.
AI can make mistakes. Check important details, such as visa and entry rules, with official sources.
Who we share it with
These providers help us run the planner and the site. They act on our instructions.
| Provider | What it does | What it receives |
|---|---|---|
| Supabase | Database and sign-in | Account and trip data |
| Railway | Runs the planner's servers | Planner data as it is processed |
| Vercel | Hosts travolia.com | Technical data and the pages you visit |
| Anthropic | AI model | Your chat messages and trip details |
| OpenAI | AI model | Your chat messages and trip details |
| Google Maps Platform | Place search and place details | The places you search for |
| OpenWeather | Weather forecasts | Destinations and dates only |
| Resend, SendGrid or Amazon SES | Sends our emails; we use one at a time | Your email address and the email |
| Amazon Web Services (S3) | Stores images you upload | The image |
| Sentry | Error reports | Technical details of the error, which can include your account id |
| PostHog | Product analytics | How features are used, linked to your account id |
| Stripe | Web payments | Your payment details |
| Apple | Sign in with Apple and App Store payments | What each needs to work |
| Sign in with Google, Firebase notifications for the iOS app, Google Fonts, and Google Analytics if you agree | What each needs to work | |
| OpenStreetMap | Map tiles in the planner | Your IP address and the map area |
| Unsplash | Destination photos | Your IP address |
Stripe and Apple also use payment data for their own fraud checks, under their own privacy notices.
We share data with others only when the law requires it, or if the business is sold or restructured. A buyer would have to keep the promises in this notice.
Where it is stored
Planner accounts and trips are stored with Supabase in [PLANNER DATA REGION]. Several providers above are in the United States. When data leaves the EU or the UK, we rely on the EU Standard Contractual Clauses, with the UK addendum for UK data, or on the EU-US Data Privacy Framework where the provider is certified.
How long we keep it
- Your account and trips: until you delete them or your account. You can delete your account in the planner's account settings.
- Guest trips: in your browser, until you clear them.
- Billing records: six years after the end of the financial year, as Irish tax law requires.
- Server logs and error reports: for a limited time set with each provider, then deleted.
- Analytics: up to 14 months.
Children
The trip planner is not meant for children. You must be 16 or over to create an account.
Your rights
You can ask to see, correct, delete or take a copy of your data, and object to how we use it. Privacy at Travolia explains your rights and how to complain.
To ask, email [PRIVACY EMAIL]. You can also delete your account yourself in the planner.