Privacy Policy

Last updated: 29 September 2026

1. Introduction

TravelBeot ("we," "our," or "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services.

2. Information We Collect

2.1 Information You Provide

Category Data Types Required/Optional
Account Information Email address, password, display name Required for account
Contact Information Name, email for itinerary service Required for service
Travel Preferences Travel dates, interests, food preferences, budget, companion info Required for itinerary
Payment Information Processed by Stripe (we don't store card details) Required for purchase
Communication Messages, feedback, support requests Optional

2.2 Information Collected Automatically

  • Usage Data: Pages visited, features used, time spent
  • Device Information: Browser type, operating system, device type
  • Location Data: General location based on IP address (not precise GPS)

Campaign tags. When you arrive from a link that carries a campaign tag (utm, ref or src), we keep that tag with your visit and with any request or order you make, so we can tell which links work. Ad click identifiers and Google Analytics identifiers are kept with an order only for visitors outside the EEA, the UK and Switzerland, or for signed-in visitors who allowed tracking.

2.3 Behavioral Data (With Consent)

Your Choice: We only collect behavioral data for personalized recommendations if you consent. You can decline without affecting your access to our services.

If you consent, we may track:

  • Places you view or bookmark
  • Search queries and filters used
  • Interaction patterns for recommendation improvement

3. How We Use Your Information

  • Service Delivery: To create and deliver your personalized itinerary
  • Account Management: To manage your account and preferences
  • Communication: To send itinerary updates, respond to inquiries
  • Payment Processing: To process transactions securely via Stripe
  • Improvement: To improve our services and user experience
  • Personalization: To provide relevant recommendations (with consent)

Emails. We send receipts and messages about a request, booking or order you started. We send reminders tied to your own trip (a week before and the evening before) unless you stop them with the link in any of them. We send letters a few times a year only to addresses that said yes; we keep a record of when and where that yes was given. Every trip reminder and letter has a one-click stop link. SendGrid delivers our email.

4. Data Sharing and Third Parties

4.1 Service Providers

We share data with trusted third parties who help us operate our services:

Provider Purpose Data Shared
Stripe Payment processing Payment information
MongoDB Atlas Data storage Account and service data
SendGrid / SMTP Sending notifications Email address, itinerary info

4.2 We Do NOT

  • Sell your personal data to third parties
  • Share your data for advertising purposes
  • Use your travel preferences for purposes other than your itinerary

5. Data Retention

Page views, visit events and search logs are deleted after 30 days, and the mail log after 90 days. Itinerary requests, plans and messages are kept until you ask us to delete them. When you delete your account, we delete your conversations with our team and the questions sent from your trip pages, and remove your name and contact details from your requests and plans; those plans and your payment records stay without them.

Some records leave sooner on their own: visit sessions 90 days after the visit ends, questions sent from a trip page 180 days after the trip ends, and conversations with our team 3 years after the last message.

The typed readings our software makes of a message or a search (what it is about, whether it is urgent, which area or kind of place a search meant) are kept for 2 years with names, e-mail addresses and phone numbers removed, so we can check and improve those readings; they go with your account when you delete it.

  • Account Data: Retained while your account is active
  • Payment Records: Retained as required by law (typically 5-7 years)

You can request deletion of your data at any time (see Section 7).

6. Data Security

We implement appropriate security measures to protect your data:

  • HTTPS encryption for all data transmission
  • Encrypted password storage (bcrypt hashing)
  • Secure cloud infrastructure (MongoDB Atlas)
  • PCI DSS compliant payment processing via Stripe
  • Regular security reviews and updates

7. Your Rights

You have the following rights regarding your personal data:

7.1 Access and Portability

Request a copy of your personal data in a portable format.

7.2 Correction

Update or correct inaccurate personal information through your account settings or by contacting us.

7.3 Deletion

Request deletion of your account and personal data. You can:

  • Delete your account through the My Page settings
  • Contact us at [email protected] for complete data deletion

7.4 Withdraw Consent

Withdraw consent for behavioral tracking at any time without affecting core service access.

7.5 Object to Processing

Object to certain data processing activities.

8. Cookies and Local Storage

Some pages load tags that set cookies:

  • Google Analytics (G-J8DJHJ3ZFX): measuring which pages are visited and how the site is used
  • Stripe (on the shop's payment step): fraud prevention during payment

TravelBeot also uses your browser's local storage (not cookies) to:

  • Remember your language preference
  • Store authentication tokens
  • Cache data for offline functionality
  • Remember tracking consent preferences

You can block or delete cookies, and clear local storage, in your browser settings.

9. International Data Transfers

The companies below receive personal data outside Korea, over the internet, when you use our services.

Recipient Country Data Purpose
Anthropic, PBCUnited StatesTrip request details and messages placed in a prompt (preferences, dates, notes); map search terms and one-sentence trip descriptions when TypeSafe does not read them; staff field notes and field photos (the field notebook)Drafting itineraries, replies and content with a model
Cloudflare, Inc.United States (global network)IP address and request details of every visitDelivery network and security in front of the site
GitHub, Inc.United StatesThe whole database while the nightly backup streams through a hosted runner (encrypted before it is stored); decrypted on a runner only if the restore drill runs on GitHubNightly backup and CI
Google LLCUnited StatesAnalytics identifiers and page events; Search Console totals; push tokens; prompts when a Gemini model is usedSite analytics, search reporting, app push, optional model calls
MongoDB, Inc.United States (cluster region to confirm)All service records: accounts, trip requests, bookings, orders, messagesDatabase hosting
OpenAI, L.L.C.United StatesText placed in a prompt; research queries; staff voice memos from field visits when the PC transcriber is away (gpt-4o-transcribe)Drafting and triage with a model
Cloudflare, Inc.United States (bucket region to confirm)Encrypted backups and private documents; field notebook audio and photosBackups and the private object store
Railway CorporationUnited States (service region to confirm)Everything the application server processesApplication hosting
Twilio Inc. (SendGrid)United StatesEmail address, name, email contentSending service email
Stripe, Inc.United StatesName, email, payment card details (entered on Stripe), amountsPayments, deposit holds and refunds
TypeSafe AI, Inc.United StatesMessage text for triage (questions, chat messages, booking and revision notes, replies to our mail, pasted messages); questions sent from a trip page, with that day's stops; search terms typed on the map; the one-sentence trip description on the free toolsSorting incoming messages and reading searches and one-sentence requests

10. Children's Privacy

Our services are not intended for children under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us.

11. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes via email or website notice. Continued use after changes constitutes acceptance.

12. Data Breach Notification

In the event of a data breach that affects your personal information:

  • Notification Timeline: We will notify affected users within 72 hours of becoming aware of a breach (GDPR requirement) or within 24 hours for users in Korea (PIPA requirement)
  • Notification Method: Email notification to affected users and, if required, public notice on our website
  • Information Provided: Nature of the breach, types of data affected, potential consequences, and measures taken to address the breach
  • Regulatory Reporting: We will report to relevant supervisory authorities as required by law

13. Data Protection Officer

TravelBeot has designated a Data Protection Officer responsible for overseeing our privacy practices:

14. Contact Us

For privacy-related questions or to exercise your rights:

We aim to respond to all requests within 30 days.