Privacy policy

Last updated: 14 October 2026

This policy applies to TripVera Ltd (company registration number 17518623), which trades as TripVera through the TripVera website and related pages ("we", "us", "our"). It explains what personal information we collect, why we collect it, how it is used and shared, and the choices and rights available to you.

By using the website you agree to the practices described in this policy. Where the law requires consent, we ask for it before processing.

1. Who we are

TripVera Ltd is the controller of the personal information described in this policy (subject to final confirmation of the registered office details that apply to your case). You can contact us at hello@tripvera.net. For privacy requests and data protection matters, use the contact details in section 11.

Company details (confirmed): TripVera Ltd, Companies House registration number (CRN) 17518623. This website states only company and contact details that have been confirmed; it does not claim unverified registered addresses, VAT or data protection registration numbers.

2. What personal information we collect

2.1 Account and authentication information

• Name and email address provided at sign up or account update.
• Password credentials are handled by our authentication provider (Supabase). We do not store or receive your plaintext password.
• If you choose "Continue with Google", your Google account name and email address are received from Google for sign in.
• A session reference is stored in your browser's local storage so that you remain signed in.

2.2 Trip planning information

• Destination country, city or cities, arrival and stay details, travel dates, number of travellers, budget and travel style.
• Preferences and free-text notes you enter when requesting a personalised plan.
• These details are saved as an order record in our Supabase database and submitted to our inbox so that we can prepare your brief.

2.3 Payment information

• We do not collect or store full card numbers, expiry dates or security codes. Payment details are entered on Stripe's checkout pages.
• We may receive payment status, amount, currency, product and a transaction reference from Stripe through its webhook and the payment flow.

2.4 Technical and usage information

• Basic technical information such as browser type, device type and pages visited.
• If you accept optional analytics, aggregated page-view data is collected through Vercel Analytics.
• Country and city landmark images may be cached in local storage to reduce repeated downloads.

2.5 AI travel assistant messages

• Questions you type into the Ask AI feature are sent to a third-party AI service (currently Pollinations/OpenAI-compatible API) to generate a response.
• The conversation is stored only in your current browser session for display; we do not retain a transcript in our database.
• The AI provider processes the text you submit. Do not enter special category or sensitive personal data into the assistant.

2.6 Contact information

• Name, email address and message content submitted through our contact form (handled by Formspree).

3. How we use personal information

• To create and manage your account and authenticate you.
• To prepare, deliver and support your personalised travel-planning brief.
• To process payments, create orders and verify successful purchase confirmation.
• To respond to contact enquiries and support requests.
• To keep the website secure, prevent abuse and improve reliability.
• To understand how the website is used where you have consented to analytics.
• To comply with legal, tax and accounting obligations.

4. Lawful bases (where applicable)

Where UK or EU data protection law applies, we rely on the following lawful bases:

• Contract: processing needed to create your account, deliver your plan and process your order.
• Legitimate interests: operating, securing and improving the service, and understanding usage where consent is not required.
• Consent: optional analytics cookies and the AI travel assistant interactions where consent is required by law.
• Legal obligation: keeping records required for tax, accounting or legal purposes.

5. Cookies and similar technologies

We use essential browser storage for authentication sessions, saved trip briefs and cached images. Optional analytics are loaded only if you accept them through the cookie banner. Full details are in our Cookie policy.

6. Who we share personal information with

We do not sell your personal information. We share it only with service providers who need it to operate the service:

• Supabase - authentication and database storage for accounts and orders.
• Stripe - payment processing and payment status confirmation.
• Vercel - website hosting and, if you consent, analytics.
• Google - optional Google sign-in.
• Formspree - handling of contact form submissions.
• Pollinations / AI provider - processing of AI travel assistant requests.
• Google Fonts, Unsplash and Wikimedia - delivery of fonts, photos and landmark imagery (these may receive your IP address as part of standard web requests).
• OpenStreetMap Nominatim - city and place search where you use that feature.

Some of these providers are based outside the United Kingdom. Where that happens, transfers are made with appropriate safeguards such as standard contractual clauses or equivalent measures implemented by the provider. Exact processing locations are determined by each provider's own infrastructure and terms.

7. International transfers

TripVera Ltd is a UK company and the website may be accessed worldwide. If you access it from outside the UK, your information may be processed in the UK and in the countries where our providers operate. Where required by law, we apply appropriate safeguards to cross-border transfers.

8. Retention and deletion

• Account information is kept while your account is active and for as long as needed to resolve inquiries or meet legal obligations.
• Order and payment records are kept for legal, tax and accounting purposes for up to the period required by applicable law.
• Saved trip briefs are stored by you in your browser's local storage and are not automatically deleted by us; you can clear them at any time.
• Cached images and consent choices are stored in your browser and can be removed through your browser settings.
• You may request deletion of your account and associated server-side data, subject to any records we must keep by law.

9. Your rights

Depending on where you live, you may have rights to access, correct, delete or export your data, to object to or restrict certain processing, to withdraw consent (without affecting processing already carried out), and to lodge a complaint with your local data protection authority. To exercise these rights, contact us at hello@tripvera.net. We will respond within the period set by applicable law.

10. Children

TripVera is not directed at children under 16 and we do not knowingly collect personal information from children under 16. If you believe a child has provided personal information, contact us and we will take appropriate steps.

11. Contacting us about privacy

Privacy and data protection requests: hello@tripvera.net.

General contact: Contact page. For complaints about a purchase, see our Terms of service and Refund policy.

12. Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last revised. Continued use of the website after an update means you accept the updated policy where the law permits.