1. Introduction

Tinerary LLC (“Tinerary,” “we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our collaborative travel planning application, website, and related services (collectively, the “Service”), which are available to users worldwide.

Tinerary LLC is a company organized under the laws of the State of Texas, United States. For the purposes of data protection laws, Tinerary LLC is the data controller (or equivalent designation in your jurisdiction) responsible for your personal information.

By using the Service, you acknowledge the practices described in this Privacy Policy. Where required by applicable law, we will obtain your explicit consent before collecting or processing your personal information.

2. Information We Collect

2.1 Information You Provide Directly

We collect information that you voluntarily provide when you use the Service:

2.2 Information Collected Automatically

When you access or use the Service, we automatically collect certain information:

2.3 Information from Third Parties

We may receive information from authentication providers, payment processors (Stripe), analytics providers, and partner businesses.

3. Legal Bases for Processing

We process your personal information on the following legal grounds:

• Contractual Necessity: Processing necessary to perform our contract with you (account creation, trip planning, booking processing)
• Consent: Processing based on your explicit consent (location tracking, marketing emails, personalized recommendations)
• Legitimate Interests: Service improvement, analytics, fraud prevention, security monitoring
• Legal Obligation: Tax records, financial reporting, law enforcement requests

Where we rely on consent, you have the right to withdraw your consent at any time.

4. How We Use Your Information

• Provide the Service: Create and manage your account, enable trip planning, facilitate collaboration, process bookings
• Personalization: Customize discovery feed recommendations, AI-powered travel suggestions
• Communications: Send push notifications about trip updates, booking confirmations, collaboration invites
• Analytics & Improvement: Analyze usage patterns, monitor performance, improve features
• Safety & Security: Detect and prevent fraud, abuse, and security threats
• Legal Compliance: Comply with applicable laws and regulations
• Marketing: With your consent, send promotional content about new features and travel deals

5. How We Share Your Information

We do not sell your personal information.

5.1 With Other Users

• Your public profile information is visible to other users
• Itineraries you mark as public are visible in the discovery feed
• Collaborators on shared itineraries can view and edit shared trip content

5.2 With Service Providers

We share information with trusted third-party service providers:

• Supabase (USA): Database hosting, authentication, real-time services
• Stripe (USA): Payment processing for bookings and subscriptions
• Google Analytics (USA): Website and app usage analytics

5.3 For Legal Reasons

We may disclose your information if required by law or to protect our rights, prevent wrongdoing, or ensure user safety.

6. International Data Transfers

Tinerary is based in the United States. Your personal information may be transferred to, stored, and processed in the United States and other countries where our service providers operate.

When we transfer personal information outside your jurisdiction, we implement appropriate safeguards including Standard Contractual Clauses (SCCs) and Data Processing Agreements.

7. Data Retention

We retain your personal information only for as long as necessary:

• Account data: Until account deletion + 30 days
• Usage data: 24 months, then anonymized or deleted
• Transaction records: Up to 7 years (legal obligation)
• Support communications: 3 years after resolution

8. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate and improve the Service:

• Strictly Necessary: Essential for the Service to function (no consent required)
• Functional: Remember your preferences and settings
• Analytics: Measure usage patterns and performance
• Marketing: Deliver relevant promotional content

You can control cookies through your browser settings or our cookie consent banner.

9. Your Rights and Choices

Regardless of your location, all Tinerary users have the following rights:

• Access: Request a copy of the personal information we hold about you
• Correction: Update your account and profile information at any time through Settings
• Deletion: Request deletion of your account via Settings > Account > Delete Account
• Opt-Out of Marketing: Unsubscribe from marketing emails using the link in any email
• Location Tracking: Disable GPS location services in your device settings
• Personalization Controls: Toggle personalized recommendations in Settings > Privacy

To exercise any of your rights, contact us at legal@tinerary.app.

10. Jurisdiction-Specific Rights

European Economic Area, United Kingdom, and Switzerland (GDPR)

Additional rights include: restriction of processing, data portability, right to object, rights related to automated decision-making, and the right to lodge a complaint with your local supervisory authority.

California (CCPA/CPRA)

California residents have the right to know, delete, correct, and opt out of sale/sharing. We do not sell or share your personal information.

Brazil (LGPD)

Brazilian users have rights to confirmation of processing, access, correction, anonymization, portability, deletion, and revocation of consent.

Other Jurisdictions

We honor your rights under applicable data protection laws in your jurisdiction.

11. Data Security

We implement industry-standard security measures including:

• Encryption of data in transit (TLS/SSL) and at rest
• Row Level Security (RLS) policies
• Secure authentication with email and phone verification
• Regular security assessments and vulnerability monitoring
• Access controls limiting employee access to personal information

12. Children's Privacy

The minimum age to use the Service is 13 years old (or higher in certain jurisdictions). Users aged 13-17 are considered “minor accounts” with limited features:

• Cannot make purchases or process payments without parental consent
• Cannot enable location tracking without parental consent
• Can join shared itineraries and use planning features

We comply with COPPA (United States), GDPR requirements for children's data (EU/UK), and applicable local child protection laws.

If we discover that we have collected personal information from a child below the applicable minimum age without proper consent, we will delete that information promptly. Contact us at legal@tinerary.app if you believe a child has provided us with personal information inappropriately.

13. Third-Party Links and Services

The Service may contain links to third-party websites and services. We are not responsible for the privacy practices of these third parties. Please read their privacy policies before providing any personal information.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Post the revised Privacy Policy with an updated Effective Date
• Provide at least 30 days' advance notice via email or in-app notification
• Obtain your consent where required by applicable law

15. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at:

Tinerary LLC
Email: legal@tinerary.app

For data protection inquiries, please include “Privacy Request” in the subject line.