Privacy Policy

Effective Date: November 3, 2026 · TravelGPT Technologies Inc.

1. Information We Collect

• Account & Identity Data: Name, email address, phone number, encrypted password hash (bcrypt), or Google OAuth subject identifier when you sign in with Google.
• Passenger Manifest Data: Legal names, dates of birth, nationality, and passport/document numbers & expiry dates provided strictly for ticketing and reservation fulfillment.
• Payment & Ledger Metadata: Tokenized Stripe session/payment-intent identifiers, Travel Wallet credit balances, and hashed IP consent timestamps. TravelGPT never stores raw payment card numbers or CVV codes on its servers.
• Search & Alert Preferences: Travel chat prompts, saved route price alerts, and affiliate attribution cookies (tgpt_ref).

2. How We Use & Share Your Data

• Booking Fulfillment Only: Passenger manifests are excluded from bulk administrative tables, access-logged via AdminAuditLog, and shared exclusively with the TravelGPT Concierge Desk or the specific verified travel agency/supplier issuing your ticket or reservation.
• Transactional Communications: Sending booking pre-authorization receipts, PNR confirmations, printable vouchers, password reset links, and opted-in price-drop alerts.
• Zero Ad-Network Resale: We never sell your personal data, passport information, or travel history to data brokers or third-party advertising networks.

3. Security & Retention

All traffic is encrypted in transit via TLS 1.2+/1.3 with HSTS and strict Content Security Policy protections. Off-site database backups are encrypted with AES-256-CBC + PBKDF2 prior to storage. Accounting and booking records are retained as required by applicable tax, anti-fraud, and chargeback regulations.

4. Your Rights (GDPR / CCPA)

You may request access to, correction of, export of, or deletion of your personal account data at any time via your Cabinet Support Helpdesk or by emailing privacy@travelgpt.tech.