Privacy Policy

1. Data we collect

Account information: your name, email, phone (optional), bio, and avatar.

Trip data: trips you host or join, participant form answers, messages, reviews, and saved/wishlisted trips.

AI planner inputs: destinations, dates, budget, preferences, and the plans generated for you.

Identity documents: if you submit KYC verification, the ID image you upload (stored securely and shown only to administrators for review).

Approximate location: when you use “Near me”, we use your browser geolocation or your IP-based location to sort trips by distance.

Usage and device data, and cookies (see our Cookie Policy).

2. How we use your data

To operate the platform — create and manage trips, connect hosts and travellers, run chat and notifications, and generate AI plans.

To keep accounts secure, prevent abuse, and enforce our terms.

To send transactional emails (verification, approvals, trip updates). We do not sell your personal data.

3. Who we share data with

Hosts & travellers: when you join a trip, the host can see your name and the participant details you provide. Reviews and messages are visible to relevant members.

Service providers: hosting and storage (AWS S3), AI generation (Google Gemini — your planner inputs are processed to create itineraries), and email delivery (Brevo / SMTP). These providers process data on our behalf.

Legal: we may disclose data where required by law.

4. Data retention

We keep your data while your account is active. When you delete your account, we deactivate and anonymise your personal information; some records may be retained where required for legal or integrity reasons (e.g. another user’s trip history).

5. Your rights

You can access and update your profile, export a copy of your data, and delete your account directly from your profile page. Depending on your location you may have additional rights (access, correction, erasure, portability, objection).

6. Security

We use industry-standard measures including hashed passwords, token rotation, rate limiting, and encrypted transport (HTTPS). No system is perfectly secure, but we work to protect your data.

7. Children

Tripmates is not intended for anyone under 18, and we do not knowingly collect data from children.

8. Changes & contact

We may update this policy and will notify you of material changes. Contact privacy@jointripmates.com for any privacy request.

Note: This is a starting template and should be reviewed by qualified legal counsel and adapted to your jurisdiction (e.g. GDPR, DPDP) before launch.