Privacy Policy

1. Controller

7x6 KlG, Am Stadtrand 43, 8600 Dübendorf, Switzerland.

Privacy contact: privacy@travel76.ai

General support: support@travel76.ai

We have appointed EU Rep as our representative in the EU under Art. 27 GDPR. Data subjects in the EU and data protection authorities submit GDPR queries to the representative through the form on eurep.ie. BizLegal Ltd trading as EU Rep has its registered office at 27 Cork Road, Midleton, Co. Cork, Ireland, company number 635921. You may also contact us directly at privacy@travel76.ai.

2. What we process, why, and on which legal basis

We make no solely automated decisions with legal effect (Art. 22 GDPR): Travel76 suggests, you decide, and you book with the partner. We build no profiles for advertising.

• Account and sign-in: email address, display name, Firebase user ID, the language we write to you in, time of last sign-in. There is no password: you sign in with a one-time code we email you, or with Google. Purpose: create, sign in to and secure your account. Basis: contract (Art. 6(1)(b) GDPR). Without an email address only a guest account is possible.
• Sign-in codes: the code is stored only in hashed form and expires after 10 minutes or once used. To stop anyone flooding an inbox we count requests per address and per IP address for one hour. The code email names the browser and operating system (from the user agent) and the local time of the request, so you can spot a request that was not yours. Basis: contract; for the counters, legitimate interest in preventing abuse (Art. 6(1)(f)).
• Sign-in with Google (optional): if you choose it, Google confirms your email address to us and passes on your name, profile picture and Google account ID via Firebase. Basis: contract. You can disconnect Google in your account at any time; the code by email remains.
• Account emails: sign-in codes, a welcome email after your first sign-in, a notice to your old address when you change it, a confirmation when you delete your account, inactivity warnings. They contain no advertising. Basis: contract.
• Guest account: a random identifier without email. Purpose: use without registration. Basis: contract.
• Trip planning: chat messages, itineraries, routes, notes, preferences, places you set, and if you give it, your birth date or age (optional, seen only by you). Purpose: providing the service, including AI processing under section 8. Basis: contract; for other people you name in messages or notes, legitimate interest in planning the trip with you (Art. 6(1)(f)). Please do not enter ID or passport numbers or payment card details, and do not upload passports or ID cards; the service does not need them and does not ask for them. A diet or a walking limit we keep only with your consent (next paragraph). Please do not write health details into chat messages or notes; if you mention one (such as an allergy), we process it only to plan for you.
• Diet and walking limit (optional): a diet you choose (such as halal, kosher, vegetarian or gluten free) and the longest walk you manage reveal something about your health, your religion or beliefs, or a disability (special categories of personal data, Art. 9 GDPR; sensitive personal data, Art. 5 lit. c FADP). We store them only with your explicit consent, which we ask for once, the first time you set one: in your preferences, in a sentence the assistant reads from the chat or your passport, or in your travel note (Art. 9(2)(a) GDPR; Art. 6 para. 7 lit. a FADP). We record when and in which version you gave it. Purpose: plan around them, including the AI processing under section 8 and the check of the plan against your preferences. Your companions see only the effect by default (such as "needs a food option"), never the value; you choose this per preference. You can withdraw the consent at any time in your account (section 7); we then delete every diet and walking limit on your profile and all your trips, and your travel note, at once; processing before the withdrawal stays lawful. Without the consent you can use the service fully, without these preferences. Guest accounts and accounts without a confirmed email cannot give it. If the AI finds such a detail in your travel note (a diet, an illness, a belief), we keep the note only with this consent; otherwise we store nothing and ask you. For a child on a trip who has no account, the person who speaks for the child may enter a diet if they hold parental responsibility and consent for the child; we record who consented and when. That consent ends, and the diet is deleted, when someone else speaks for the child, the child is no longer marked as a child, or the child joins with an account of their own. For an adult without an account no one else can enter one.
• Your position (optional): if you allow it in your browser, your approximate position, rounded to about 1 km. Purpose: find the nearest airport and suggest what is near you; the AI receives it as part of your conversation (section 8). Basis: contract. You decide in your browser whether to share it and can revoke it there at any time.
• Own bookings and receipts: bookings you made elsewhere (confirmation code, note, price you enter, times, places, provider) and the booking confirmations (receipts) you keep at them. If you have a confirmation read, the AI reads the whole document without masking it first (section 8): names, booking and ticket numbers and everything else on it, including meal or assistance codes that can reveal health or religion. We read a boarding pass in Wallet format (.pkpass) from its barcode, without AI. Before a receipt is first read or kept, we ask once per account for your explicit consent to this (receipt consent; Art. 9(2)(a) GDPR, Art. 6(7)(a) FADP) and store when and in which version you gave it; without it you can still enter bookings by hand. Only booking fields are taken over, no names or ID numbers. Afterwards the file is deleted unless you keep it; you choose this per file, and it is not preselected. We keep PDF, Wallet (.pkpass) and calendar (.ics) files as they are, with everything in them, such as the name in the barcode or the calendar’s attendees; we save pictures as a new image without their metadata. The trip folder keeps only receipts at bookings, no other documents. Code, note and price are visible only to you until you share the booking with your companions; a kept receipt only once you also choose to show it to all travellers. If a receipt names companions, upload it only if you may pass on their details for this; what applies to them is in the next item. Purpose: show your bookings in the trip and plan around them. Basis: contract; for details about health or religion, your consent, which you can withdraw in your account at any time (section 7).
• If you are named on a booking confirmation someone else uploads: we receive from that person your name and whatever else the confirmation shows (such as ticket or seat number, date of birth, passport number, meal or assistance codes). Purpose: take the joint booking into the trip and, if that person chooses, keep the confirmation at the booking. Basis: legitimate interest of the traveller and the travelling group in reading and keeping the confirmation of a booking that covers them together (Art. 6(1)(f)). We take no details about you into any booking field. The AI reads the whole file (section 8; recipients in section 3). If the person does not keep the file, it is deleted after reading. A kept file is seen only by the person who uploaded it, and by the travellers on their trip if that person shows it to them. It is deleted when that person removes it, leaves the trip or withdraws their consent, when the booking, the trip or their account is deleted, and at the latest 12 months after the trip’s last day (section 6). You can object: write to privacy@travel76.ai and we delete the file. We cannot inform you individually because we have no contact details for you and do not extract any.
• Shared trips: display name, avatar and your contributions are visible to companions you invite or whose invitation you accept. Of your preferences, companions see what you allow per preference: the value, only its effect (such as "no early starts"), or nothing; you choose this in your preferences. The days you cannot travel are always visible to your companions, so the plan can work around them. Your assistant checks the plan against your own preferences and tells you, not the others, when an item clashes with something you need or goes against something you would rather avoid. Fixed limits, such as the days you cannot travel or a price ceiling, are checked by our code; your other preferences, such as things you want to avoid, the AI reads against the items’ names, kinds of place, dates and times. The AI also words the message (section 8). Basis: contract.
• Travellers on a trip: name, colour and, if given, age group (adult, child, infant) and a child’s age. The traveller enters these themselves; for someone without an account (such as a child), the trip owner or a companion who speaks for them may enter them, and we note who did. Only the traveller, the owner and that companion see the individual values; the group and the AI see only totals (number of adults, children’s ages, number of infants). Purpose: plan for the whole party. Basis: contract; for travellers without an account, legitimate interest of the travelling group in planning for them (Art. 6(1)(f)). A diet for a child without an account only with the consent of the person who speaks for the child (see "Diet and walking limit"); for an adult without an account, none.
• Discussions on trip items: comments you write on an item and when you last read the thread. Every traveller on the trip reads and writes them. Personal data such as phone numbers or email addresses are masked before saving. Comments are not sent to the AI. You can delete your own comments. Basis: contract.
• Questions and statement rounds: a traveller can ask one, several or all companions a question, request or decision, and later let them agree to a proposed statement (yes, yes with a condition, or no, with a reason). The person asking sees each answer; the others see their own answer, or all answers if the person asking chose that. The written answers go without names to the AI, which summarises them and proposes a statement (section 8). Basis: contract.
• Trip history: what changed on a shared trip and who did it (route changes, items saved, placed or removed, searches with their dates, joining, leaving, role changes). Every traveller on the trip sees it. Purpose: let the group follow changes. Basis: contract.
• Group costs: payments the travellers record (amount, currency, who paid, how it is split, a short note, the item it belongs to, the date and that day’s exchange rates) and settlements between them. Every traveller on the trip sees them; who owes whom is calculated, not stored. No money moves through Travel76. Purpose: share costs fairly. Basis: contract.
• Ended trips: when the owner deletes a shared trip or their account, the other travellers are shown once that the trip ended, with its title, dates, number of stops and travellers, a cover photo and the owner’s name and colour; never the plan or the chat. Basis: contract; legitimate interest in telling the group why the trip is gone (Art. 6(1)(f)).
• Partner searches: search criteria (places, dates, number of travellers) and, where Kayak requires it for hotel, flight and car searches, IP address, user agent and a daily pseudonym (a code derived from your account that changes every day and that Kayak cannot trace back to you). Purpose: retrieve offers, prevent abuse. Basis: contract; legitimate interest in preventing abuse (Art. 6(1)(f)).
• Usage statistics and error reports: page views, features used, error messages with browser and device type; an error report contains the error text and its technical stack trace, which can name a trip ID. Purpose: improve the service, find errors. Basis: legitimate interest in a working product (Art. 6(1)(f)). Details in section 9.
• Technical logs: service name, time, correlation ID, error code, user and trip ID; no offer contents. IP addresses are shortened to their network, except in the web server’s error log and the server’s security logs (firewall, logins), which keep the full address. Purpose: security, operations, debugging. Basis: legitimate interest (Art. 6(1)(f)).
• Backups: encrypted copies of the database. Basis: legitimate interest in data security and the duty of appropriate security (Art. 32 GDPR, Art. 8 FADP).
• Feedback: what you enter in the feedback form. Basis: consent (Art. 6(1)(a)), revocable at any time.
• Reports of content: when you report a shared trip, we store the trip, the reason you pick, your explanation, your account and, if you give it, an email address for the confirmation. We send the report by email to our team, review it and tell you our decision. The explanation can name other people on the trip; the people concerned do not learn who reported. Purpose: handling notices of illegal content. Basis: legal obligation (Art. 6(1)(c) GDPR with Art. 16 of the Digital Services Act).
• Invite and access codes: code, time, device counter. Basis: contract; legitimate interest in preventing abuse.
• Premium waitlist ("Vormerken"): when you click this button on a paid feature, we note which feature, the trip you clicked it on and when. Purpose: learn which paid features travellers want before we build them, and tell you when the feature is available. Basis: legitimate interest in knowing the demand for our own products (Art. 6(1)(f)). No payment and no commitment. You can remove your entries yourself at any time in your account under “Your data”.
• Emails to us: content and sender. Basis: contract or legitimate interest in replying.
• Product updates by email: email address, display name and your consent record (when and where you opted in). Purpose: news about Travel76 such as new features and launches; no partner offers, no third-party advertising. Basis: consent (Art. 6(1)(a)), given by a separate, unticked checkbox after your first sign-in or in your account; you can withdraw it at any time via the unsubscribe link in every email or in your account. Without consent you receive no such emails; account emails (sign-in codes, security notices, inactivity warnings) are sent regardless.

3. Recipients and processors

We use providers that process data on our instructions, and partners that receive the data needed for a search or booking redirect. Format: recipient — purpose — location — safeguard.

Companions see what you contribute to a shared trip. Authorities receive data only where the law requires it. Not used: OpenAI, ad networks, marketing pixels, payment providers.

Your browser loads some content directly from the provider: maps and photos from Google Maps Platform and destination images from Unsplash. The provider sees your IP address and browser data. Basis: legitimate interest in showing places with maps and pictures (Art. 6(1)(f) GDPR). Offer pictures from Kayak and photos of experiences from Viator are loaded by our server and passed on to your browser without your IP address or other data about you.

• Google (Firebase Authentication) — sign-in and account management, including sign-in with Google if you use it — USA — Google Cloud Data Processing Addendum; EU-US and Swiss-US Data Privacy Framework
• Google Cloud (Vertex AI, Gemini models) — AI planning and reading booking confirmations; for current information about places, the model can search Google (the search queries it derives from your conversation, without your account) — EU — processor terms; no training on your data
• OpenRouter, Inc. and Anthropic (Claude models) — AI planning and reading booking confirmations as fallback when Gemini does not respond — OpenRouter: USA (routes, does not store); model: AWS Ireland or Google EU — processor terms with Standard Contractual Clauses; zero data retention; no training
• LangChain, Inc. (LangSmith) — error analysis and quality control of AI answers (traces of requests and answers) — EU instance — processor terms (signed data processing agreement)
• Hetzner Online GmbH — servers for application, database, cache and logs — Finland (EU) — processor terms
• Google Cloud Storage — encrypted backups, and the receipts you keep in the trip folder (scanned for malware first, opened only through links valid for five minutes) — Frankfurt (EU) — processor terms; only we hold the backup key
• PostHog, Inc. (EU Cloud) — usage statistics and error reports — Frankfurt (EU) — processor terms
• Kayak (Kayak Europe GmbH, Claridenstrasse 25, 8002 Zurich, Switzerland, our contract partner) — hotel, flight and car comparison; receives search criteria, IP address, user agent and the daily pseudonym, and may use the IP address only to detect bots and fraud; independent controller from the first search request. Offer pictures (hotel photos, cars, logos) are loaded by our server from Kayak and passed on to your browser without your IP address or other data about you — Switzerland — adequacy decision of the EU for Switzerland (see section 5); what Kayak does with the data afterwards, including within its group in the USA, is governed by Kayak’s privacy policy (see section 4)
• Viator, Inc. (Tripadvisor) — experience search; our server sends Viator only search criteria (place, dates, language), no data about you. Our server also loads the photos of experiences from Tripadvisor’s image servers and passes them on to your browser without your IP address or other data about you, so Tripadvisor receives no data about you for the photos. When you open a booking link, your browser connects to Viator directly, without telling it which page of ours you came from; from then on Viator’s privacy policy applies (see section 4) — USA — no transfer by us
• Google Maps Platform (Google LLC) — maps, place data, photos; our server sends search text, place ids and coordinates without data about you; your browser loads maps and photos directly from Google (IP address); Google is an independent controller for this (Google Maps Controller-Controller Data Protection Terms), its privacy policy applies (policies.google.com/privacy) — USA, EU — Data Privacy Framework
• Unsplash — destination imagery; your browser loads images directly from Unsplash (IP address) — Canada — EU and Swiss adequacy decisions
• Google Workspace — email for support@ and privacy@, and sending our account emails (sign-in codes, notices) — EU, USA — Data Processing Addendum; Data Privacy Framework

4. Affiliate redirects (not a travel contract with us)

Travel76 does not sell flights, hotels, cars, or experiences and does not collect travel payments.

When you continue to Kayak or Viator, you leave our service and contract with that partner (or their merchant). We may receive a commission from the partner for the referral — not from you.

Separately, Kayak receives the personal data needed to run the search (a recipient under privacy law, section 3). Viator receives no data about you from our servers: our server loads the photos of experiences from Tripadvisor and passes them on without your IP address or other data about you, and your browser connects to Viator itself only once you open its page (section 3). That is not the same as receiving money.

5. International transfers

Our servers are in the EU. Data goes to the USA at Google (Firebase, Maps, Workspace) and OpenRouter (also when reading receipts), to Switzerland at Kayak (Kayak Europe GmbH) and to Canada at Unsplash.

For the USA we rely on the EU-US Data Privacy Framework and the Swiss-US Data Privacy Framework where the recipient is certified, otherwise on the European Commission’s Standard Contractual Clauses (Art. 46 GDPR) as recognised by the FDPIC. For Canada, EU and Swiss adequacy decisions apply.

Kayak: our contract partner is Kayak Europe GmbH in Zurich, an independent controller. For Switzerland the European Commission has adopted an adequacy decision (Art. 45 GDPR); under the FADP this is no disclosure abroad. Kayak is responsible for any further transfer within its group, including to the USA. Viator: we send Viator no personal data. Our server loads the photos of experiences from Tripadvisor in the USA and passes them on without your IP address or other data about you, so Tripadvisor receives no data about you for them; your browser contacts Viator only when you open a booking link yourself.

Copies of the safeguards are available via privacy@travel76.ai.

6. Retention

• Registered account with trips and chats: until you delete the account. After 24 months without use (any signed-in request counts) we delete it automatically, with two email warnings beforehand.
• Guest account: 30 days after last use.
• Diet and walking limit: with your account, until you withdraw the consent (then at once, your travel note too); for a child without an account, until the consent ends or the child leaves the trip.
• Sign-in codes: 10 minutes, deleted when used; counters against abuse: 1 hour.
• The note that we sent your welcome email: about 13 months, by user ID only.
• Shared trips: the trip belongs to its owner. If you delete your account we remove your membership and your chat; items you added to the trip remain part of it.
• AI conversation state, including your position if you shared it: at most 30 days after the last conversation; partner offers inside it at most 24 hours.
• Cached partner search results: at most 24 hours.
• Technical logs: 90 days.
• Backups: 14 days; deleted data disappears from backups within 14 days at the latest.
• Receipts in the trip folder: until you remove them, the booking is deleted (one hour later), you leave the trip, the trip or your account is deleted or you withdraw your receipt consent, and no longer than 12 months after the trip’s last day. Then they are deleted at once, after at most 7 days also from the storage provider’s recovery copy.
• Receipt consent (when and in which version you gave it, when you withdrew it): with your account.
• Feedback: 24 months, then without personal reference; on account deletion immediately without personal reference.
• Reports of content: 12 months, then deleted; on account deletion the report stays for our decision, without your account and email address.
• Travellers’ age group and a child’s age: with the trip; on account deletion removed at once. What the owner or a companion entered for a traveller without an account stays with the trip.
• Discussions on trip items: the latest 15 comments per item; all of them go when the item or the trip is deleted. If you leave the trip your comments stay; if you delete your account they are deleted.
• Questions and answers: with the trip. If you leave the trip, your open questions are withdrawn and answers you gave stay; if you delete your account, your questions and answers are deleted.
• Trip history: with the trip. If you delete your account, your name at the time stays in the history, without a link to your account.
• Group costs: with the trip. If you leave the trip or delete your account, payments and shares stay, because they are the group’s accounts; you remain listed by name as a former traveller.
• Notice of a trip whose owner deleted it or their account (trip title, dates, cover photo, the owner’s name): until every other traveller has seen it or left, at most 90 days.
• Usage statistics: 12 months.
• Premium waitlist: until you remove the entry in your account or delete your account.
• AI traces for error analysis (LangSmith): at most 6 months.
• Email correspondence: at most 3 years.
• Product-update consent: with your account. After withdrawal or account deletion your address stays on a do-not-send list, stored only as a non-reversible hash.

7. Your rights

You may request access, rectification, erasure, restriction of processing and data portability, object to processing based on legitimate interest, and withdraw consent at any time with effect for the future.

Export (a ZIP file with your data as JSON) and deletion are in your account; deleting a registered account needs a code we email you; the export contains your profile, chats and summaries of your explorations, not full partner result lists.

You withdraw your receipt consent (reading and keeping receipts) in your account under “Your data”. We then delete all receipts you kept at once; your bookings and their fields stay.

You withdraw your consent to a diet and a walking limit in your account under “Your data”. We then delete them on your profile and all your trips, and your travel note, at once; the rest of your preferences stays. The consent for a child you speak for you withdraw at the child in the trip’s list of travellers.

For anything else write to privacy@travel76.ai; we reply within 30 days and may ask for proof of identity where in doubt.

Complaints: Federal Data Protection and Information Commissioner (FDPIC / EDÖB), Switzerland; in the EEA, the supervisory authority where you live.

8. AI processing

Travel76 is an AI-powered trip planner. Chat answers, route and day suggestions are generated by a language model: Google Gemini (Vertex AI, EU), with Anthropic Claude via OpenRouter as fallback. For this we send your messages, the itinerary and your preferences to the provider; on a shared trip also what your companions let the group see of their preferences, the party’s totals (number of adults, children’s ages, number of infants) and, for a question round, the written answers without names; if you shared your position, the position rounded to about 1 km. For current information about places the model can run Google searches through Vertex AI; the search queries it derives from your conversation go to Google, without your account.

Under our contracts the providers do not use your content to train their models and do not store it permanently. Recognisable card numbers, bank account numbers (IBAN), email addresses, phone numbers, IP addresses and passport and identity-card numbers (Swiss, EU and US formats) are masked automatically before transmission, and your chat keeps only the masked line; names, places, trip titles and what you enter in your preferences (such as things to avoid) remain because planning needs them. Exception: a booking confirmation you have read goes to the same models in full, without masking (section 2). Recognition is not perfect, so please still do not enter document numbers.

To find errors and check the quality of AI answers, we may record AI requests and answers (traces) with LangChain (LangSmith) in its EU instance, under a data processing agreement. A trace contains the masked messages, the itinerary and the model’s answer. LangChain does not use them for its own purposes. Booking confirmations, the sentence you write about yourself, the AI’s check of plan items against your preferences and your assistant’s messages about items that clash with them are never recorded this way.

No solely automated decision with legal effect takes place. AI answers can be wrong or outdated: check prices, dates, visa, health and legal questions with official sources before you book or travel.

9. Cookies, local storage, usage statistics

We use necessary cookies and local storage for sign-in, the access-code session, language and theme, security tokens, the status of the cookie notice and which version of this policy the notice of changes last showed. The sign-in stays on your device until you sign out.

For usage statistics and error reports we use PostHog without cookies and without a persistent identifier. Events are counted with a daily rotating, non-reversible hash; there is no linking across devices. We do not record sessions. Addresses of pages are sent without invitation codes and trip IDs; an error report can still contain them in its error text. The statistics are not required for the service; your browser’s tracking protection is respected.

We use no marketing cookies and no ad networks.

10. Minors

Travel76 is intended for people aged 16 and over. Younger users may use the service only with parental consent; we delete accounts that were evidently created without it. Bookings with partners require legal age under the partner’s terms.

11. Security

Connections are encrypted (TLS). Only the managing partners have access to servers and data, with keys rather than passwords. Backups are encrypted and the key is not held by the storage provider. Test and production environments are separated. Identifiers are masked before AI processing as described in section 8, except in booking confirmations you have read.

12. The AI system

Travel76 uses an AI system to plan trips. It answers questions in the chat, proposes routes, stops and day plans, searches stays, flights, rental cars and experiences with our partners, summarises the answers of a question round and reads booking confirmations into booking fields.

Language models do this work: Google Gemini (Vertex AI, EU), with Anthropic Claude via OpenRouter as fallback. Which data they receive is described in section 8.

The chat marks the assistant with “AI”. What the assistant put into your trip carries the mark “AI suggestion”: the places and experiences of a day proposal, suggestions for a free slot and stops a route change in the chat added.

AI content can be wrong, incomplete or out of date. Prices and availability are binding only at the provider; check opening hours, dates and visa, health and legal questions with official sources.

You decide. The assistant changes your trip only when you or a companion ask it to or take over a suggestion, and everything it added can be changed or removed. Bookings are made only with the provider, never by the AI system.

13. Changes

We update this policy when the service or the law changes. The version with the date at the top applies. The app announces every change once with a notice; a material change (new purposes, recipients or legal bases, fewer rights) at least 14 days before it takes effect.