Itinerova Privacy Policy

This policy explains how ITINEROVA LLC ("Itinerova," "we," "us"), a Puerto Rico limited liability company, collects, uses and shares personal information when you use the Itinerova website, web app, mobile app and related services (the "Service"). We are the "controller" of this information (the business responsible for it).

1. Information we collect

You give us:

Account: name or display name, email, password (stored as a secure hash), language and preferences (home city, currency, etc.). If you sign in with Google or Apple, we receive your basic profile and email from them.

Trip content: trips, dates, places, itinerary items, notes, wishlists, checklists, expenses, files and photos you upload (such as booking documents, receipts and outfit photos), and information about travel companions you add or invite.

Imported bookings: emails and attachments you forward to us, or, if you connect Gmail, booking-related messages we retrieve with your permission.

AI prompts and voice: text you type to AI features is sent so we can respond. When you use voice features, your voice audio is streamed to our AI provider to transcribe it (see section 4). We don't keep that audio or the transcript on our servers.

Support: messages you send us.

Collected automatically:

Usage and device data: log data such as IP address, browser and device type, pages and features used, timestamps, error logs, and an activity log of account actions (not the content of your notes or emails).

AI and voice usage records: per-account counts of AI requests, voice minutes, spoken briefings and receipt scans, used for billing and fair use.

Analytics (only if you choose Accept on the cookie banner): pages and features used, clicks, referring page, approximate location (country or city), device and browser type, and, in the app, session replays with everything you type masked. In-app analytics are linked to an internal account ID, never your name or email. See section 5 and our Cookie Notice.

Cookies and local storage: see our Cookie Notice.

Push tokens: if you enable notifications.

From payment processing: Stripe gives us your subscription status, plan, billing country and address and any VAT ID you enter (needed to calculate tax), and the last digits/brand of your card if shown. We don't receive or store full card numbers.

We don't ask for passport numbers or government ID numbers. Please don't put them, or other sensitive information (health, etc.), in notes unless you need to.

2. How we use it (and legal bases for EU/UK users)

Provide the Service: accounts, trips, sharing, imports, AI and voice features you request — Contract

Billing, subscriptions, receipts, fair-use limits — Contract; legal obligation (tax/accounting)

Security, fraud and abuse prevention, debugging — Legitimate interests

Service emails (verification, receipts, renewal reminders, important changes) — Contract; legal obligation

Improve the Service using aggregated or de-identified usage data — Legitimate interests

Analytics with Google Analytics (public pages) and PostHog (in the app, including session replay), and other optional cookies — Consent, given by clicking Accept (you can withdraw it anytime in Cookie settings)

Connecting Gmail; microphone access — Consent (you can withdraw it anytime)

Comply with law and respond to lawful requests — Legal obligation

We do not use your trip content, prompts or audio to train AI models, and our AI providers are contractually restricted from using API data to train their models.

We don't make decisions with legal or similarly significant effects about you based solely on automated processing.

3. AI features

AI features (for example, itinerary suggestions, booking import parsing, place details, the day assistant and spoken briefings) use third-party model providers OpenAI and Anthropic as our processors/subprocessors. When you use these features, relevant content (your prompt, related itinerary details, imported booking text, and voice audio for voice features) is sent to the provider to generate a response. Providers may keep API data for a limited period for abuse monitoring under their terms (generally up to 30 days). AI output may be inaccurate — please check it.

4. Voice features

We use your microphone only after you turn on a voice feature and your browser or device grants permission. We'll show a notice before first use.

Voice audio is streamed to our AI provider (currently OpenAI) to transcribe it and produce a spoken reply.

We don't store your voice recordings or the transcript on our servers. Audio is processed in real time and isn't saved by Itinerova. The transcript stays in your browser for the visit so you can see the conversation. It is removed when you leave the trip, and the browser drops it when that tab's session ends. It is not written to our database, logs, or file storage.

Spoken briefings are generated audio of your itinerary; we may cache the generated audio (not your voice) to avoid regenerating it. That cached audio is deleted 15 days after the trip ends. If a briefing is replaced, its previous audio is deleted immediately.

We record how many voice minutes you use for fair-use limits.

5. Who we share it with

We share personal information only as needed to run the Service, with service providers that process it on our behalf under contract:

Amazon Web Services (AWS) — Hosting, database, file storage — United States

Stripe — Payment processing and subscription billing — United States / global

OpenAI, Anthropic — AI features, transcription and speech — United States

Postmark (ActiveCampaign) — Transactional email and inbound booking email — United States

Google — Maps/Places data, Google sign-in, Gmail connection (if you connect it) — United States / global

Apple — Sign in with Apple — United States / global

Cloudflare (Turnstile) — Bot protection on sign-in and registration — Global

AeroDataBox (via API.Market) — Flight status alerts you turn on (flight numbers and dates only) — Canada

Google LLC (Google Analytics) — Website analytics on our public pages, only if you choose Accept: pages viewed, referring page, approximate location, device and browser, and a random cookie ID. For visitors in the EU, Switzerland and the UK, Google uses the IP address only to estimate location and doesn't store it — United States / global (EU-U.S. Data Privacy Framework and its UK and Swiss extensions; Standard Contractual Clauses)

PostHog Inc. (PostHog Cloud EU) — In-app product analytics and session replay, only if you choose Accept: features used, clicks and page views, approximate location, device and browser, and replays with everything you type masked, linked to an internal account ID (not your name or email) — European Union (Frankfurt, Germany)

We also share information: with people you choose to share a trip with (files and photos you upload, including outfit photos, stay private to you unless you choose to share them); if required by law or to protect rights, safety and security; and in a merger, acquisition or sale of assets (we'll notify you).

No sale or sharing. We don't sell personal information and don't "share" it for cross-context behavioral advertising (as those terms are defined under California law), and we haven't done so in the past 12 months. Google Analytics and PostHog act as our service providers: we keep Google Signals, ads personalization and data sharing with other Google products and services turned off, don't link Google Analytics to any advertising account, and don't use analytics data for targeted advertising.

Google user data. Itinerova's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Gmail data only to find and import your travel bookings; we don't use it for advertising, and people can't read it except with your permission, for security, or where the law requires.

6. International transfers

We're based in Puerto Rico (United States) and store data in the United States. If you're outside the U.S., your information will be transferred to and processed in the U.S. and other countries where our providers operate. For transfers from the EEA, UK or Switzerland, we rely on safeguards such as the European Commission's Standard Contractual Clauses (and UK addendum) or the provider's certification under the EU-U.S. Data Privacy Framework, where applicable. Google Analytics data may be processed in the U.S. under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) or Standard Contractual Clauses. PostHog analytics and session replays are stored in the EU (Frankfurt, Germany); PostHog Inc. is a U.S. company and may access them to provide its service, under Standard Contractual Clauses.

7. How long we keep it

Account and trip content: while your account is active. You can delete trips or items anytime; deleted trips are kept for 30 days so they can be restored, then purged.

After account deletion: we delete or de-identify your personal information within 30 days, except backups (overwritten within 35 days) and records we must keep.

Billing and tax records: as required by law (generally 7 years; 10 years for EU VAT non-Union OSS records). Stripe keeps its own records under its policies.

Activity log (account actions such as sign-ins and settings changes, not the content of your notes or emails): 90 days.

Server and error logs (IP address, browser and device type, request details): Server logs are kept for 30 days and then deleted automatically.

Analytics (only if you chose Accept): Google Analytics event-level data, 2 months; PostHog events, 1 year; PostHog session replays, 30 days. Your PostHog data is deleted within 30 days after you delete your account. See the Cookie Notice.

AI usage records: 24 months for billing and fair use, then aggregated or deleted.

Voice: we don't store voice recordings or transcripts on our servers. The transcript stays in your browser for the visit (section 4). Cached briefing audio is deleted 15 days after the trip ends, and immediately when that briefing is replaced.

Imported booking emails: until you delete them or your account.

Support emails: 24 months.

Privacy requests: a record of each request and our answer, 24 months.

8. Your choices and rights

For everyone: in Settings → Account you can Download your data, open Legal & privacy → Manage cookie preferences, and Delete account. You can update your information in Settings → Account, Settings → Preferences and Settings → Travel, disconnect Gmail in Settings → Integrations → Gmail Inbox Sync, and turn off notifications in Settings → Notifications. You can also email privacy@itinerova.com.

Your data export. Download your data gives you a JSON file with your account, trips, itinerary, wishlist, details about your files (such as names and types) and your imported booking emails. It doesn't yet include the files and photos themselves; you can open and download those in the trip where you added them, or email privacy@itinerova.com and we'll send you a complete copy, including your files and photos, within the time limits below.

California (CCPA/CPRA) and other U.S. state laws, to the extent they apply to us: you can request to know/access the personal information we have about you (including a copy in a portable format), delete it, and correct it, and you have the right not to be discriminated against for using these rights. We don't sell or share personal information, and we don't use sensitive personal information for purposes that would require offering a right to limit. You can use an authorized agent; we'll verify requests by confirming control of your account email. Categories we collect: identifiers, customer records, commercial information (subscription), internet/network activity, geolocation inferred from trip content and IP (not precise device location), audio (voice features), photos you upload, and inferences limited to product preferences — all collected from you, your devices, and the providers above, for the purposes in section 2. If we decline your request, you can appeal by emailing privacy@itinerova.com with "Appeal" in the subject line.

EEA/UK/Switzerland (GDPR, UK GDPR and Swiss FADP): you have the right to access, correct, delete, restrict, or object to processing, to data portability, and to withdraw consent at any time. You can complain to your local data protection authority (in the UK, the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner).

EU and UK representatives. Because we're based outside the EU and the UK, we have appointed representatives under Article 27 of the GDPR and of the UK GDPR. You can contact them instead of us about any privacy matter:

EU representative: [EU REPRESENTATIVE: name, address, email]

UK representative: [UK REPRESENTATIVE: name, address, email]

Global Privacy Control and Do Not Track. If your browser sends a Global Privacy Control (GPC) or Do Not Track signal, we treat it as a Reject of analytics in that browser: Google Analytics and PostHog don't load. You can still choose Accept in Cookie settings. We don't sell or share personal information, so there's nothing else for these signals to switch off.

How fast we respond. We confirm we received your request within 10 business days and answer as soon as we can, within these limits:

EEA and UK: within 1 month of receiving your request. If a request is complex or you've sent several, we may extend this by up to 2 more months; we'll tell you within the first month and explain why.

Switzerland: within 30 days. If we need longer, we'll tell you within those 30 days and say when you'll hear from us.

California: within 45 calendar days. We may extend this once by up to 45 more days when reasonably necessary; we'll tell you within the first 45 days.

Other U.S. states with privacy laws: within 45 days, extendable once by 45 days when reasonably necessary, with notice. We answer appeals within 45 days.

Puerto Rico and everywhere else: Puerto Rico doesn't currently have a general privacy law that sets a deadline, but we apply the same standard: within 45 days, extendable once by 45 days, with notice.

If we need to confirm your identity, we'll ask promptly, and the time limit runs from when we can verify the request.

9. Security

We use encryption in transit (TLS), encryption at rest provided by our hosting, access controls, secure session cookies, and limited staff access. No system is 100% secure. If a data breach affects you, we'll notify you and authorities as the law requires.

10. Children

You must be at least 16 to use the Service. The Service is not directed to children, and we don't knowingly collect personal information from anyone under 16 (including children under 13). If you believe a child gave us personal information, contact us and we'll delete it.

11. Changes

We'll post updates here with a new effective date. If changes are material, we'll notify you by email or in the app before they take effect.

12. Language

This policy is available in English and Spanish. If there's a conflict, the English version controls, except where the law requires otherwise.

13. Contact

ITINEROVA LLC · Privacy: privacy@itinerova.com · Support: support@itinerova.com · Mail: PO BOX 261832, San Juan, PR 00926