Last updated: July 13, 2026
At Travelese.ai ("we," "us," or "our"), we value your privacy and are committed to being fair, accountable, and transparent in how we handle your personal information. This Privacy Policy describes how we collect, use, share, and protect your personal information when you use our AI-powered travel planning platform at travelese.ai and app.travelese.ai (our "Service"). It also describes your privacy rights.
For individuals in the European Economic Area, United Kingdom, and Switzerland (collectively, "Europe"), additional Europe-specific information is provided in Section 10 of this policy.
We ask that you do NOT include unnecessary personal information in your prompts and inputs to our Service; however, we cannot control what you provide to us.
We may collect personal information from you and about you. Below are examples of the information we may collect, how we collect it, how we use it, and how we may disclose it.
Account Data. If you create an account, we collect your name, email address, account credentials, and authentication method. If you log into our Service using a third-party service such as Google or X, that third-party will send your information to us at your direction, which may include your name, email address, and profile information.
Traveler Profile Data. To facilitate travel bookings, we collect your full legal name (as on travel documents), date of birth, nationality, gender, passport information (number, issuing country, expiration date), loyalty program numbers, and contact phone number.
Payment Data. Subscription payments are processed by Stripe. Travel booking payments are processed through Duffel's payment infrastructure. We receive only tokenized references, the last four digits of your card, card brand, and billing address. We do not store full card numbers on our servers.
User Content. You may provide personal information in prompts and other content you input to the Service ("Input"). Outputs of the Service ("Output"), including AI-generated travel recommendations and itineraries, are based on your Input. Together, Input and Output are "User Content." If you include personal information in Inputs, this information may appear in Output.
Voice Data. When you use voice features, your speech is processed and converted to text. We do not permanently store raw audio recordings. Text-to-speech output is generated using xAI's voice synthesis technology.
Travel and Booking Data. We collect flight and accommodation search history, confirmed booking records (itineraries, confirmation numbers, booking status), trip information (destinations, dates, notes), and associated traveler assignments.
Technical Data. We collect your IP address, device type, browser type and version, operating system, country and timezone (derived from IP address), pages visited, features used, session duration, and interaction data.
Anonymous User Data. If you use the Service in demo mode without creating an account, we collect limited data including your IP address, device information, and the content of your chat messages (up to five messages). This data is associated with a temporary session identifier, not a persistent account.
Cookies and Similar Technologies. We and our service providers use cookies and similar technologies to operate and improve our Service. You can change optional cookie preferences anytime via Cookie settings in the footer.
We may use your personal information for the following purposes:
We may aggregate, pseudonymize, or de-identify your information so that it no longer identifies you and use this information for the purposes described above. We will not attempt to re-identify such information.
We do not sell your personal information to third parties. We share your information only as described below.
Service providers. We share data with third-party service providers who process data on our behalf:
| Provider | Data Shared | Purpose |
|---|---|---|
| Supabase | Account data, authentication tokens, application data | Database hosting, authentication, data storage |
| Stripe | Email, name, billing address, payment method tokens | Subscription billing and payment processing |
| Duffel | Traveler names, passport data, dates of birth, contact details, loyalty numbers | Flight and accommodation booking and fulfillment |
| xAI | Chat message content, voice input (as text) | AI language model processing and voice synthesis |
| Railway | IP address, request metadata | Platform hosting and performance |
| Cloudflare | IP address, device fingerprint | Bot protection (Turnstile) |
Each provider processes data under their own privacy policies and in accordance with data processing agreements we maintain with them.
Travel providers. When you make a booking, your traveler information (name, passport details, date of birth, contact information, loyalty numbers) is shared with the relevant airline or accommodation provider through Duffel. These travel providers are independent data controllers and process your data under their own privacy policies.
Analytics providers. We use analytics services to understand how our platform is used. Analytics data is aggregated and does not directly identify individual users. Analytics cookies only run after you opt in via Cookie settings.
Legal requirements. We may disclose your information if required by law, court order, or government regulation, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, investigate fraud, or respond to a lawful government request.
Business transfers. In the event of a merger, acquisition, or sale of all or a portion of our assets, your personal information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your data.
We retain your personal information where we have an ongoing legitimate business need to do so:
| Data Type | Retention Period |
|---|---|
| Account information | Duration of account plus 30 days after deletion |
| Traveler profiles | Duration of account plus 30 days after deletion |
| Chat messages and AI interactions | Duration of account plus 30 days after deletion |
| Booking records | 7 years after booking date (tax and legal compliance) |
| Payment transaction records | 7 years after transaction (financial regulations) |
| Usage and analytics data | 26 months from collection |
| Anonymous session data | 30 days from session |
When retention periods expire, data is permanently deleted or irreversibly anonymized.
If you choose to delete your account, we will delete your data within 30 days unless it is necessary to retain the data for legal, compliance, or safety purposes.
We implement commercially reasonable technical, administrative, and organizational measures to protect your personal information:
However, no security measure or method of data transmission over the internet is 100% secure. You are solely responsible for protecting your login credentials, limiting access to your devices, and signing out after sessions.
Breach notification. If a data breach affects your personal information and is likely to result in a significant risk to your rights, we will notify you and the applicable regulators without undue delay, as required by GDPR, PIPEDA, and applicable U.S. state laws.
Our Service may contain links to external websites, including airline and hotel websites. Third-party websites have their own terms and privacy policies. We are not responsible for their privacy practices, and we encourage you to review their policies before providing personal information to them.
Our Service is not directed at anyone under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a person under 18, we will take steps to delete that information promptly. If you believe a child has provided us with personal data, please contact us at [email protected].
How AI processes your data. When you interact with our AI assistant, your messages are sent to xAI's Grok language models for processing. xAI processes your input to generate responses in accordance with our data processing agreement with them.
Model training. We do not use your personal information or User Content to train our own AI models. Your prompts and inputs are processed by xAI under our data processing agreement and are not used by xAI to train its models except as permitted by that agreement. You can delete your chat history from your account at any time.
Voice data. When you use voice features, your speech is converted to text and processed by the AI. Text-to-speech responses are generated by xAI's voice synthesis. Voice personas (Eve, Ara, Rex, Sal, and Leo) are AI-generated voices, not recordings of real individuals. We do not create voiceprints and do not use voice data to identify you biometrically.
Automated decision-making. Travelese.ai uses AI to provide travel recommendations and search results. These are suggestions and do not constitute automated decision-making with legal or similarly significant effects. All booking decisions are made by you.
Depending on where you are located and subject to applicable legal exceptions, you may have certain rights in relation to your personal information.
Rights for all users. Regardless of your location, you have the right to:
Exercising your rights. To exercise any of these rights, contact us at [email protected]. We will respond within thirty (30) days, or within the timeframe required by applicable law. We may need to verify your identity before processing your request.
Please note that your personal information may be exempt from such requests in certain circumstances, for example if we need to retain it to comply with our legal obligations or to establish, exercise, or defend legal claims.
Do Not Track. Because there is no consistent industry standard for responding to "Do Not Track" signals, we do not alter our privacy practices when we detect such a signal from your browser.
If you are located in Europe, you additionally have the right to:
Legal bases for processing. We process your data based on: (a) contractual necessity (to provide our services and fulfill bookings), (b) legitimate interests (to improve our services and ensure security), (c) consent (for optional features like voice input and analytics cookies), and (d) legal obligations (tax records, financial reporting).
Contacting us in Europe. Because we are established outside the EEA and the UK, you may direct any GDPR or UK GDPR request or question to our privacy contact at [email protected]. You also have the right to lodge a complaint with your local supervisory authority.
If you are a California resident, you have the right to:
Categories of personal information collected. Identifiers (name, email, IP address), commercial information (booking and payment records), internet activity (usage data, chat history), sensitive personal information (passport data, precise geolocation). We collect this data directly from you and through your use of our services.
If you are a resident of a U.S. state with a comprehensive privacy law (such as Virginia, Colorado, Connecticut, Utah, Texas, and others), you have the right to access, correct, delete, and obtain a portable copy of your personal information, and to opt out of targeted advertising, the sale of personal information, and certain profiling. We do not sell your personal information or share it for cross-context behavioral advertising. We honor opt-out preference signals, including the Global Privacy Control (GPC). Where applicable, you may appeal a decision on your request by contacting [email protected].
Travelese.ai is registered and operates in Canada as well as the United States. If you are in Canada, in addition to the rights described above:
Your data may be processed in countries outside your country of residence, including the United States, where our service providers operate. When we transfer data internationally, we rely on appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the European Commission, data processing agreements with our service providers, and the data protection measures described in this policy.
We may update this Privacy Policy from time to time. When we do, we will publish an updated version and effective date on this page. Material changes will be communicated to registered users via email or in-app notification at least thirty (30) days before they take effect. Your continued use of Travelese.ai after changes take effect constitutes acceptance of the updated policy. If you do not agree, you must stop using the platform.
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us at:
Email: [email protected]
Website: travelese.ai