Privacy Policy

1. Introduction

TravelFun.ai ("we", "our", or "us") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered assistant platform designed for travel agents (the "Service").

By accessing or using the Service, you agree to the collection and use of information in accordance with this Privacy Policy.

2. Information We Collect

We may collect the following types of information:

• Account Information: Name, email address, and password when you create an account.
• Usage Data: Information about how you interact with the Service, including chat conversations, prompts used, mini-apps accessed, and features utilized.
• AI Interaction Data: Content you submit to our AI chatbot, including text prompts, image generation requests, and template usage.
• Technical Data: IP address, browser type, device information, and operating system.
• API Keys: Third-party API keys you voluntarily provide for AI provider integrations (e.g., xAI, OpenAI, Google).

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service.
• Process and respond to your AI chat requests and image generation prompts.
• Personalize your experience and provide relevant content and templates.
• Communicate with you about updates, security alerts, and support.
• Monitor and analyze usage trends and activity to improve the Service.
• Detect, prevent, and address technical issues and security threats.

4. Data Storage and Security

Your data is stored securely using industry-standard encryption and security measures. We use Supabase for database storage with Row Level Security (RLS) policies to ensure users can only access their own data. API keys are stored securely and are never exposed to other users.

While we strive to use commercially acceptable means to protect your personal information, no method of transmission over the Internet or method of electronic storage is 100% secure.

5. Third-Party Services

Our Service integrates with third-party AI providers (such as xAI, OpenAI, and Google) to deliver AI-powered features. When you use these features, your prompts and interactions may be processed by these third-party providers in accordance with their own privacy policies. We encourage you to review the privacy policies of these providers.

6. Data Sharing

We do not sell, trade, or rent your personal information to third parties. We may share information only in the following circumstances:

• With third-party AI providers to process your requests (as described above).
• To comply with legal obligations or respond to lawful requests from public authorities.
• To protect and defend the rights or property of TravelFun.ai.
• With your consent or at your direction.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you the Service. You may request deletion of your account and associated data at any time by contacting us.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of your personal data.
• Object to or restrict the processing of your data.
• Withdraw consent at any time where processing is based on consent.

Erasing your marketing data

When a TravelFun.ai account is deleted, we also erase the marketing record we keep about it: the e-mail address, the scrambled copy of it (a hash) that we use to recognize the same person, and the links between that record and the account and its visits. We keep only counts that name no one.

If you only joined our waitlist or blog list and never made an account, you can ask for the same erasure yourself. Enter your address below and we e-mail you a one-time link. Nothing is erased until you open the link, type the address again and confirm. The form gives the same answer whether or not the address is on our list, so it cannot be used to find out who is. The matching contact in our e-mail system (GoHighLevel) is deleted separately by our team within 30 days.

9. Cookies and visit log

We use essential cookies for authentication and session management. On our public pages (the home page, this policy, the terms and the blog) a cookie banner asks whether we may measure visits. Until you choose, and if you reject, we set no analytics cookie, record no visit and load no Google Analytics (we only add to the anonymous page count described below). We do not use advertising cookies.

These are the cookies we set on our public pages:

The visit log

Whether or not you accept analytics, each public page you open adds one to a plain page count. The count holds only the day, the page address (path), the website you came from (its host name only), the utm_source tag in the link and the channel we sorted that into. It holds no visitor ID, no network address, no hash, no browser details and sets no cookie, so it cannot be tied to you or to any other visit. If your browser sends the Global Privacy Control signal, we do not add to it at all.

If you accept analytics, each page you open on our public pages adds one line to our visit log. A line holds the page address (path), the website you came from (its host name only, not the full address), the campaign tags in the link you used (utm_source, utm_medium, utm_campaign, utm_content and utm_term), the channel we sorted that into (such as search, social, e-mail or direct), whether it was your first visit, and a salted hash of your network address. The hash is a one-way scramble that lets us count one visitor once; we never store your network address itself and cannot turn the hash back into it. Visit log lines are deleted automatically after 400 days.

When you send a sign-up form (the waitlist, the blog e-mail box or a free guide), the form also sends the campaign tags of the page you are on, the website you came from (host name only) and the page path, together with the e-mail address you typed. We store them with your sign-up so we know which post or link brought you, whether or not you accepted analytics. This is data you submit with your own form: it sets no cookie and tracks nothing else.

If you accept analytics we also load Google Analytics, which sets its own cookies under Google's privacy policy. Without your consent it is not loaded. Inside the signed-in app we use Vercel Analytics to understand general usage patterns.

Changing or withdrawing your choice

Use the "Cookie settings" link at the bottom of this page (or of the home page or terms) to open the banner again. Choose Reject to withdraw: we stop recording your visits, remove the tf_src and tf_lt cookies from your browser, and switch Google Analytics off. Visit log lines already stored cannot be tied back to you, but you can ask us to delete them by contacting us (section 12). You can also delete cookies in your browser settings at any time; the banner will then ask again.

You can change your cookie choice at any time with the "Cookie settings" link on this page. If your browser sends the Global Privacy Control signal and you have not made a choice, we treat it as Reject: no analytics cookie, no visit record and no Google Analytics. We do not sell or share your personal information.

10. Children's Privacy

Our Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal data from a child under 18, we will take steps to delete such information.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have any questions about this Privacy Policy, please contact us at www.TravelFun.Biz.