Legal

Privacy Policy

Last updated: 1 May 2026

TravalBee is a product of OpsisX LLC. In this policy, "we", "us" and "our" mean OpsisX LLC, which is committed to protecting your personal data and respecting your privacy. This policy explains exactly what information we collect, why we collect it, how we use and protect it, how long we keep it, and your rights under applicable privacy laws — including the UK GDPR, EU GDPR, California Consumer Privacy Act (CCPA/CPRA), Brazil's LGPD, Canada's PIPEDA, and Australia's Privacy Act.

OpsisX LLC is the data controller for the personal data you provide to us. If you have any questions about this policy or wish to exercise your rights, contact us at contact@opsisx.com.

1. What Personal Data We Collect

We collect only what is necessary to provide the service. Here is a specific breakdown:

Account Information

  • Email address (provided through our sign-in provider)
  • A unique account identifier
  • If you sign in using a social login provider, your name and profile photo as returned by that provider

Itinerary Preferences You Provide

  • Travel destination, departure and return dates
  • Travel party type (solo, couple, family, group)
  • Travel pace, budget tier, dietary requirements, and interests
  • Accommodation status and hotel name (if you choose to provide it)
  • Preferred transport mode and walking tolerance

Generated Itineraries

  • The full itinerary content we generate for you is stored in our database linked to your user identifier, so you can access it later. This includes destination names, activity descriptions, and place data.

Technical & Operational Data

  • IP address, browser type, device type, and operating system
  • Request timestamps and pages visited
  • Anonymised usage analytics (page views, generation counts) — no cross-site tracking
  • Short-lived security counters, keyed by user identifier or IP address, used to prevent abuse and automatically expiring after one hour

Browser Local Storage

  • We store a cached copy of your saved itineraries in your browser's local storage to enable offline access. This data never leaves your device and is cleared when you clear your browser storage.

We do not collect payment card numbers (handled entirely by our PCI-DSS certified payment partners), passport or government ID details, precise GPS location, or any sensitive special-category data as defined under GDPR Article 9.

2. Legal Basis for Processing (GDPR & UK GDPR)

If you are in the European Economic Area (EEA) or United Kingdom, we rely on the following legal bases under GDPR Article 6:

  • Performance of a contract — processing your travel preferences and generating your itinerary is necessary to provide the service you requested.
  • Legitimate interests — we process technical and operational data to maintain security, prevent fraud and abuse, enforce fair-use limits, and improve the service. Our legitimate interests do not override your fundamental rights.
  • Legal obligation — we may retain certain records (such as usage records without personal identifiers) where required by applicable law.
  • Consent — where we rely on consent (e.g., optional analytics), you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

3. How We Use Your Data

  • To generate personalised travel itineraries based on your stated preferences
  • To save and retrieve your itineraries when you are signed in
  • To authenticate your identity and manage your account session
  • To enforce fair-use limits and prevent abuse of the service
  • To monitor service health, fix errors, and improve quality
  • To display anonymised analytics about overall usage trends
  • To present hotel and accommodation recommendations and earn affiliate commission if you complete a booking via our links — this does not affect the price you pay

We do not sell your personal data. We do not use your data for targeted advertising. We do not build profiles about you beyond what is needed to run this service.

4. Service Providers & Data Recipients

We share limited personal data with trusted service providers who help us operate TravalBee. These include providers of hosting, user authentication, database storage, payments, email delivery, analytics and error monitoring, maps and place information, and the technology that generates your itinerary from your trip preferences. They may use your data only to provide their services to us, under agreements that require them to protect it and not to use it for their own purposes. Where a provider has its own privacy policy, that policy also applies to the data it handles.

Some hotel links on TravalBee are affiliate links. If you book through one, we may earn a commission at no extra cost to you. Booking partners receive only standard browser information, such as the page you came from, and not the details of your account or itinerary.

5. International Data Transfers

TravalBee operates globally and uses service providers based in the United States. If you are located in the EEA, UK, or other regions with data transfer restrictions, your personal data may be transferred to and processed in the United States or other countries that may not offer the same level of data protection as your home country.

Where we transfer data internationally, we rely on appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission, the UK's International Data Transfer Agreement (IDTA), or other legally recognised transfer mechanisms. Our service providers that process data outside your region are subject to SCCs or equivalent safeguards. You may request a copy of the relevant safeguards by contacting us.

6. Data Retention

  • Account & itinerary data: retained for as long as your account is active. If you request deletion of your account, all personal data and associated itineraries will be permanently removed from our database within 30 days.
  • Temporary technical data: automatically deleted within 14 days.
  • Security counters: expire automatically after 1 hour.
  • Usage records: retained for internal financial record-keeping. These logs contain destination names and aggregate cost figures but no other personal data.
  • Infrastructure and provider logs: retained per each provider's own retention policy (typically 30–90 days).

7. Cookies & Local Storage

  • Authentication cookies: set by our sign-in system to manage your login session. These are strictly necessary and cannot be opted out of while signed in.
  • Local storage (offline cache): we store your saved itineraries in your browser's local storage for offline access. This is first-party only and never transmitted to third parties.
  • Analytics: Our analytics tool uses cookieless, privacy-preserving techniques to measure aggregate page performance. No cross-site tracking cookies are used.

We do not use third-party advertising cookies, retargeting pixels, or social media tracking cookies.

8. Your Rights

Depending on where you live, you have the following rights regarding your personal data. We honour these rights for all users worldwide, not just those in regulated jurisdictions.

Right to Access

You can request a copy of the personal data we hold about you, including what categories of data we have, where it came from, and how it is used.

Right to Rectification

You can ask us to correct any inaccurate personal data we hold about you.

Right to Erasure ("Right to be Forgotten")

You can request the deletion of your account and all personal data we hold about you. We will process this within 30 days and confirm once complete. Note that anonymised data (e.g., aggregate usage records with no personal identifiers) is not subject to erasure requests.

Right to Restriction of Processing

You can ask us to restrict how we process your data in certain circumstances, such as while a dispute is being resolved.

Right to Data Portability

You can request a machine-readable export of your personal data (e.g., your saved itineraries in JSON format).

Right to Object

You can object to processing of your personal data where we rely on legitimate interests as the legal basis. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests.

Right to Opt Out of Sale (CCPA — California)

We do not sell your personal information. We do not share it with third parties for cross-context behavioural advertising.

Right to Non-Discrimination

We will never discriminate against you for exercising any privacy right. Exercising your rights will not affect your access to the service.

9. How to Exercise Your Rights

To exercise any of the rights listed above — including requesting deletion of your account and all associated data — please email us at:

contact@opsisx.com

Please include your registered email address and a brief description of your request. We may need to verify your identity before processing the request to protect your data from unauthorised access.

Response times: We will acknowledge your request within 72 hours and respond in full within 30 days(as required by GDPR and UK GDPR). For CCPA requests, we will respond within 45 days. If we need additional time due to complexity, we will notify you of the extension before the deadline.

10. Supervisory Authority & Complaints

If you believe we have not handled your personal data in accordance with applicable privacy law, you have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction. Examples include:

  • United Kingdom: Information Commissioner's Office (ICO) — ico.org.uk
  • European Union: your national Data Protection Authority (DPA) — find your authority at edpb.europa.eu
  • Australia: Office of the Australian Information Commissioner (OAIC) — oaic.gov.au
  • Canada: Office of the Privacy Commissioner of Canada — priv.gc.ca
  • Brazil: Autoridade Nacional de Proteção de Dados (ANPD) — gov.br/anpd
  • California (USA): California Privacy Protection Agency (CPPA) — cppa.ca.gov

We ask that you contact us first at contact@opsisx.com so that we have an opportunity to resolve your concern directly.

11. Automated Decision-Making

We use third-party artificial intelligence technology to generate travel itinerary content. This is an assistive tool — the output is a creative suggestion based on your stated preferences and does not produce any legal or similarly significant decision about you. No automated profiling is used to make decisions that affect your rights or access to services.

12. Children's Privacy

TravalBee is not directed at children. We do not knowingly collect personal data from anyone under the age of 13, or under 16 in the EEA and UK. If you believe a child has provided us with personal information, please contact us at contact@opsisx.com and we will delete it promptly.

13. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These include HTTPS encryption for all data in transit, encryption at rest, strict separation of secrets and access keys, role-based access controls, and measures to prevent abuse. No method of transmission or storage is 100% secure; if you have concerns about a specific security issue, please contact us immediately.

14. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. For material changes, we will notify signed-in users by email where we hold your address. Continued use of the service after changes are posted constitutes your acceptance of the revised policy.

15. Contact Us

For any privacy-related questions, data access requests, or deletion requests:

Email: contact@opsisx.com

We will respond to all privacy requests within 30 days. For urgent matters regarding a potential data breach affecting you, please mark your email "URGENT — Data Privacy" and we will prioritise your request.

← Back to TravalBee