Privacy Policy

TravelBook runs this website and is responsible for your personal data. You can reach us at privacy@3-134-68-5.sslip.io about anything in this policy.

We only collect what the service needs:

• Account details: your name, email address and a scrambled (hashed) version of your password. We never store the password itself.
• Profile details you choose to add: photo, preferred language, the countries of the passports you hold, and loyalty points.
• Trips and plans you create: itineraries, places, notes, packing lists, expenses and any photos or documents you upload.
• Trip requests you send to our travel agents: destination, dates, number of travellers, budget, travel style, interests, occasion, and how you would like to be contacted (including a phone number if you give one).
• Bookings and payments: what was booked, the price and what has been paid. Card details are entered directly with Stripe and never reach our servers.
• Messages between you and our agents, and the notes agents keep to look after your booking.
• Technical data: your IP address and browser details, used to keep the service secure (for example, to limit repeated login attempts), and error reports when something breaks.

• To provide the service you signed up for: your account, your trips, and the bookings you ask us to arrange (performance of a contract).
• To take payments and keep the records that tax and accounting law requires (legal obligation).
• To keep the service secure, prevent abuse and fix errors (our legitimate interest in running a safe, working service).
• To send the emails the service needs, such as verifying your address, resetting your password, and updates about your requests and bookings.
• For optional features such as linking your Dropbox, only when you turn them on (consent, which you can withdraw at any time).

We do not sell your data, and we do not use it for advertising.

Your trips are private unless you share them. If you make a trip public or share its link, anyone with the link can view it. Friends and trip members see what you share with them.

When you send a trip request or book with us, our travel agents see the details they need to plan and book your trip. Airlines, hotels and other suppliers receive only what they need to confirm your booking, such as travellers’ names.

We use these service providers, who process data on our behalf and only for the purposes above:

• Amazon Web Services: hosting, database and file storage.
• Stripe: card payments and subscriptions.
• Resend: sending emails.
• Dropbox: only if you link your account, to attach files you keep there.

Some features load content from other services, which then see your IP address: map tiles (OpenFreeMap, OpenStreetMap, OpenTopoMap, Esri, Waymarked Trails) and photos hosted by Unsplash. Weather forecasts come from the Norwegian Meteorological Institute and place searches from OpenStreetMap’s Nominatim service; we request both from our own servers, sending only a place or its coordinates, never your name or account.

We may disclose data if the law requires it, or to protect the rights and safety of our users or of TravelBook.

Our providers may process data outside your country. Where the law requires it, we rely on safeguards such as the European Commission’s standard contractual clauses.

• Your account and its content: until you delete your account.
• Trip backups: up to five recent versions of each trip; backups of a deleted trip are removed within about a day.
• Payment and booking records: for as long as tax and accounting law requires, even after you delete your account.
• Error reports: resolved ones are deleted after 90 days.

We use a small number of cookies and browser storage entries, all needed for the site to work or to remember your choices:

• A sign-in cookie that keeps you logged in.
• A cookie and a local storage entry that remember your language.
• A local storage entry that remembers your light or dark theme.

We do not use advertising or analytics cookies. When you pay, Stripe may set its own cookies to prevent fraud.

Depending on where you live, you can ask to access, correct, delete or receive a copy of your personal data, and object to or restrict how we use it. You can delete your account at any time from Settings. For anything else, or if an agent set up your account for you, write to privacy@3-134-68-5.sslip.io. We will answer within one month.

If you think we have mishandled your data, you can also complain to your local data protection authority.

We encrypt connections to the site, store passwords only as hashes, encrypt the keys for linked accounts, keep uploaded files private, and limit who at TravelBook can access personal data. No system is perfectly secure, so please use a strong password that you do not use anywhere else.

The service is not meant for children under 16, and they should not create an account. Children can be included as travellers in a request or trip made by an adult.

If we change this policy, we will update the date at the top. For significant changes, we will also let you know by email or on the site.