Privacy Policy

Travlin (“Travlin,” “we,” “our,” or “us”) respects your privacy. This Privacy Policy explains how we collect, use, store, share, and protect information when you use our website, mobile application, and related services.

Travlin is an AI-powered travel organizer that helps users organize trips, import travel confirmations, build itineraries, and receive personalized travel tips and guidance.

By using Travlin, you agree to the practices described in this Privacy Policy.

1. Information We Collect

Travlin may collect the following types of information:

Account Information

When you create an account or use Travlin, we may collect:

• Name
• Email address
• Account login information
• Profile preferences
• App settings
• Support messages or requests

Travel and Itinerary Information

Travlin may collect or generate travel-related information, including:

• Trip names
• Destinations
• Travel dates
• Flight details
• Hotel or accommodation details
• Train, bus, cruise, car rental, or activity details
• Confirmation numbers or booking references
• Notes, preferences, or itinerary items you manually add

Email and Pasted Travel Information

Travlin may allow users to import travel confirmations by connecting an email account or by forwarding emails to a Travlin email address. In the future, Travlin may also support connecting additional email providers; any such providers will be handled in accordance with this Privacy Policy.

If you choose to connect or forward email content, Travlin may process travel-related confirmation emails to identify and extract trip details.

Travlin does not ask for or store your email account password.

You can also add travel information by pasting the text of a booking confirmation into Travlin on the Travlin website. Travlin processes pasted text the same way it processes a forwarded confirmation email — to identify and extract trip details.

If you use Travlin without creating an account, the trip and the pasted text created that way are deleted automatically after 24 hours, along with the temporary account behind them, unless you create an account to keep them.

Documents You Upload

If you have a Travlin account, you can attach documents to a trip — for example a photo of a ticket, a booking confirmation, an invitation, or a PDF itinerary.

What we accept. Images and PDF files, up to 10 MB each. Uploading requires an account: visitors using Travlin without signing in can paste travel details as text, but cannot upload files.

What we store. The file itself, its filename, its type and size, and the trip you attached it to.

Who can see it. Only you. Uploaded documents are stored in Google Firebase Storage and are visible only to the account that uploaded them. Travel companions you share a trip with cannot open your uploaded files, and the files are not public.

How AI is used. Travlin uses AI to read documents you upload, so that it can create the right itinerary items from them. See AI Features and AI Data Use below.

How long we keep it. A document is kept for as long as the trip it belongs to, and is deleted with it. See Data Retention below.

What not to upload. Please do not upload passports, national identity documents, driving licences, payment card details, or boarding passes showing a full booking reference. Travlin does not need these to organise a trip, and you should not store them here.

Documents you upload may contain information about other people — for example, the names on an invitation, or the details of a travelling companion. You are responsible for making sure you are entitled to share that information with Travlin. Travlin uses it only to build your itinerary and does not contact those individuals.

Device and Usage Information

We may collect basic technical information, such as:

• Device type
• Operating system
• App version
• Browser type
• IP address
• Log data
• Error reports
• Usage activity within the app

Where Travlin uses your IP address to limit abuse of its free features, it stores only a one-way hashed value and never the address itself.

This information helps us improve performance, troubleshoot issues, and protect the security of our services.

2. Google User Data and Gmail Access

Travlin may allow users to connect their Gmail account using Google OAuth.

If you choose to connect Gmail, Travlin requests read-only Gmail access through the following Google OAuth scope:

https://www.googleapis.com/auth/gmail.readonly

Travlin uses Gmail read-only access only to identify and process travel-related confirmation emails, such as:

• Flights
• Hotels
• Vacation rentals
• Trains
• Car rentals
• Cruises
• Buses
• Activities
• Other travel booking confirmations

Travlin may extract travel-related details such as:

• Provider names
• Confirmation numbers
• Travel dates
• Departure and arrival times
• Airports
• Terminals
• Gates
• Accommodation names and addresses
• Check-in and check-out dates
• Rental details
• Destination information

Travlin uses this information to create and update your trip itinerary and provide relevant travel guidance inside the app.

Travlin does not send, modify, delete, archive, label, move, or create emails.

Travlin does not use Gmail data for advertising.

Travlin does not sell Google user data.

Travlin’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3. How We Use Your Information

Travlin uses your information to provide, improve, and protect our services.

We may use information to:

• Create and manage your account
• Build and organize travel itineraries
• Import and process travel confirmations
• Display trip timelines and travel details
• Provide AI-powered travel tips and suggestions
• Personalize recommendations based on your preferences
• Send important account or service notifications
• Respond to support requests
• Improve app functionality and performance
• Detect, prevent, and investigate fraud, abuse, or security issues
• Comply with legal obligations

Travlin uses your information only for legitimate app functionality and user-facing travel organization features.

4. AI Features and AI Data Use

Travlin includes AI-powered features that help users understand and organize trips, receive destination guidance, review itinerary details, and get personalized travel suggestions.

Travlin may use the following information to generate AI-powered responses:

• Trip details
• Travel dates
• Destination information
• Travel preferences
• Itinerary items
• User-provided prompts or questions
• Relevant booking details

Travlin does not use your personal data, Gmail data, trip data, or AI chat content to train Travlin’s AI models.

Travlin does not use Gmail data or Google user data to train AI models.

Travlin does not sell your AI interaction data.

Where third-party AI service providers are used to generate responses, Travlin sends only the information reasonably necessary to provide the requested AI feature. These providers process information on Travlin’s behalf and are not permitted to use Travlin user data to train their models unless separately disclosed and permitted by applicable law and user consent.

Reading documents you upload. When you upload a document to a trip, Travlin sends it to Anthropic (Claude) to be read — that is, to transcribe what the document says and identify whether it describes a booking, an event, or something else. If the document is a booking, the resulting text is then sent to Travlin’s booking extraction providers, in the same way as the text of a forwarded confirmation email, so that the correct itinerary items can be created. The providers process the document and the text solely on Travlin’s behalf and return the result to Travlin. They are contractually prohibited from using it to train their models.

Documents are read only when you upload them, or when you ask the AI concierge a question about a document already on your trip. Travlin does not scan your uploaded documents for any other purpose.

5. Data We Do Not Use for AI Training

Travlin does not use the following data to train AI models:

• Gmail messages or Gmail metadata
• Google user data
• OAuth tokens or connected account credentials
• Personal trip itineraries
• Travel confirmation emails
• AI chat messages or prompts
• User preferences or profile information
• Uploaded or forwarded travel confirmations
• Documents, images and PDFs you upload to a trip

Travlin uses this information only to provide user-facing app features, such as itinerary creation, trip organization, travel recommendations, and AI-powered trip guidance.

To deliver these features, Travlin may send relevant content — including travel confirmation email content and documents you upload — to trusted AI service providers (such as OpenAI, Google Vertex AI, and Anthropic) that process it solely on Travlin's behalf to return results. These providers are contractually prohibited from using your content to train their own models. "Not used for AI training" means Travlin does not use this data to train Travlin's models, and our providers do not use it to train theirs.

6. Email Forwarding and Third-Party Email Processing

Travlin may allow users to import travel confirmations by forwarding emails to a Travlin email address or by connecting a supported email account. Travlin may add support for additional email providers in the future, and any such providers will be subject to this Privacy Policy.

When users forward travel confirmations or connect an email account, Travlin uses the information only to identify travel-related bookings and create itinerary entries.

Travlin does not use forwarded emails or connected email data for advertising or AI model training.

Travlin processes travel confirmation emails within its own secure cloud infrastructure (Google Firebase and Google Cloud). To identify bookings and extract itinerary details, Travlin uses trusted AI service providers — including OpenAI and Google Vertex AI — that process this content solely on Travlin's behalf to return extracted trip details. These providers are contractually restricted from using your content to train their models or for any purpose other than providing results to Travlin. Travlin does not sell this data and does not use it for advertising.

7. How We Share Information

Travlin does not sell personal information.

Travlin does not sell Google user data.

Travlin does not use Gmail data for advertising.

We may share information only in limited circumstances, including:

Service Providers

We work with trusted service providers who help us operate Travlin. These providers process information only on Travlin's behalf, only as necessary to provide their service, and are not permitted to use your data for their own purposes or to train AI models.

• Google Firebase / Google Cloud — Hosting, database, authentication, and secure storage
• OpenAI — Identifies and extracts travel details from confirmation emails and from documents you upload
• Google Vertex AI — Assists with extracting travel details from confirmation emails and from documents you upload
• Anthropic (Claude) — Powers the AI trip concierge and local tips features, and reads documents you upload to identify bookings and events
• Resend — Sends Travlin-generated emails such as travel companion invitations, email-verification codes, and account notifications; does not access the contents of your Gmail messages
• Google Maps and Places — Location, mapping, and place details
• Aviationstack — Live flight status, terminal, and gate information
• Unsplash, SerpAPI, and Google Custom Search — Destination images and travel information used in tips and recommendations
• PostHog — Product analytics and session recording for the Travlin website, hosted on EU Cloud

Travlin parses your travel confirmation emails using its own systems and the AI service providers listed above. The contents of your Gmail messages are not sent to any external email-parsing partner.

Legal and Safety Reasons

We may disclose information if required to:

• Comply with applicable law
• Respond to legal requests
• Protect the rights, safety, or property of Travlin, users, or others
• Detect or prevent fraud, abuse, or security threats
• Enforce our Terms of Service

Business Transfers

If Travlin is involved in a merger, acquisition, financing, reorganization, or sale of assets, user information may be transferred as part of that transaction, subject to appropriate protections.

8. Data Retention

Travlin retains personal information only for as long as reasonably necessary to provide the app’s features, maintain user accounts, comply with legal obligations, resolve disputes, prevent abuse, and enforce our agreements.

Travel itinerary details may be stored while your account remains active or until you delete the trip, disconnect an email account, or request account/data deletion.

OAuth credentials are removed when you disconnect your connected email account.

In practice:

• Trips and pasted text created without an account are deleted automatically after 24 hours, unless you create an account to keep them.
• When you delete a trip, it is recoverable for 30 days and is then permanently removed, along with any documents and chat messages attached to it.
• Documents you upload are kept for as long as the trip they belong to, and are deleted with it.
• When you delete your account, your trips, documents and chat history are permanently deleted from Travlin’s systems immediately. Travlin’s AI service providers may retain a short-term copy of content sent for processing for up to 30 days for abuse monitoring, after which they delete it.

Users may request deletion of their account or personal data by contacting:

help@travlin.ai

9. Disconnecting Gmail or Connected Email Accounts

Users can disconnect Gmail or other connected email accounts from Travlin at any time.

To disconnect Gmail or a connected email account inside the Travlin app:

1. Open the Travlin app.
2. Go to Profile or Account Settings.
3. Open Email Automation or Connected Email settings.
4. Tap Disconnect Email or Disconnect Gmail.
5. Confirm the disconnect action.

When a user disconnects Gmail, Travlin removes stored Gmail credentials and makes a best-effort request to Google’s OAuth revoke endpoint to invalidate the authorization grant.

After disconnecting, reconnecting Gmail requires the user to approve Gmail read-only access again through Google’s consent screen.

Users may also revoke Travlin’s access directly from their Google Account permissions page:

https://myaccount.google.com/permissions

10. Data Deletion Requests

You can delete your Travlin account and all of its data yourself, at any time, from your Profile — on the Travlin website and in the Travlin app. Deletion is immediate and cannot be undone.

If you would rather Travlin do it for you, or you can no longer sign in to your account, email help@travlin.ai with the email address associated with your account and “Data Deletion Request” in the subject line.

Upon receiving a verified data deletion request, Travlin will delete or anonymize personal account data and trip data associated with the user, subject to legal, security, and operational requirements.

If Gmail or another email account is connected, users should also disconnect the account inside the Travlin app or revoke access from the relevant account permissions page.

11. Security

Travlin takes reasonable technical and organizational measures to protect user information.

Security measures may include:

• Google OAuth for Gmail connection
• Secure credential storage
• Limited access controls
• Encryption where appropriate
• Monitoring and logging for security and reliability
• Restricting access to personal data to authorized personnel and service providers

Travlin does not ask users for their Gmail password.

No system is completely secure, and we cannot guarantee absolute security of information transmitted or stored through Travlin.

12. International Users

Travlin may be used by users in different countries. Your information may be processed and stored in countries other than where you live.

By using Travlin, you understand that your information may be processed in the United States or other locations where Travlin or its service providers operate.

Where required by law, Travlin will take appropriate steps to protect international transfers of personal information.

13. Children’s Privacy

Travlin is not intended for children under the age of 13.

We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will take reasonable steps to delete that information.

If you believe a child has provided us with personal information, please contact us at:

help@travlin.ai

14. Your Choices and Rights

Depending on your location, you may have rights regarding your personal information, including the right to:

• Access personal information we hold about you
• Correct inaccurate information
• Delete your personal information
• Object to or restrict certain processing
• Export certain data
• Withdraw consent where processing is based on consent

To exercise privacy rights, contact:

help@travlin.ai

We may need to verify your identity before fulfilling certain requests.

15. Analytics and Cookies

Travlin uses PostHog, a product analytics service, to understand how people use the Travlin website: for example, which pages are visited, where visitors come from (such as a search result or an ad), and which features they use. This helps us improve Travlin. PostHog stores this data on its EU Cloud, in the European Union.

Cookies. PostHog can set a first-party cookie (named ph_…) and similar browser storage on travlin.ai so it can recognise your browser across pages and return visits. These last up to 12 months. They are used only for Travlin’s own analytics. They are not used for advertising, not shared with advertising networks, and not used to follow you on other websites.

Your choice. If you are in the European Union, the European Economic Area, the United Kingdom or Switzerland, we ask before setting analytics cookies, and none are set unless you choose Accept. Elsewhere, analytics cookies are on by default. Wherever you are, you can change your choice at any time using the “Cookie settings” link at the bottom of our pages or in your account menu. We decide whether to ask by checking your device’s time zone setting, which is not stored or sent to us. We also treat a Global Privacy Control signal from your browser as a choice to decline.

If you decline, or haven’t chosen yet. We still count visits without cookies. PostHog calculates a temporary one-way code from your IP address and browser details, using a key that changes every day and is then destroyed. The visit is counted, but you cannot be recognised later, and nothing is stored on your device.

What is collected. Pages viewed; approximate location (country and city, worked out from your IP address; the IP address itself is not stored); device and browser type; the referring website and campaign tags; and actions such as building a trip or creating an account. When you are signed in, these events are linked to your Travlin account ID, never your name or email address. We never send the contents of your trips, bookings, emails or concierge messages to analytics.

Session recording. For visitors who accept analytics cookies, PostHog may record how pages are used (clicks, scrolling and page layout) so we can find and fix confusing parts of the site. Everything you type, and the text and images on our pages, is hidden in your browser before anything is sent. Recordings are kept for 30 days.

The Travlin mobile app does not run these analytics tools on your device. Travlin’s servers do send PostHog a small number of usage events for both the website and the app — for example, that an account was created, a trip was added, a forwarded email was processed, or the AI concierge answered a question, together with the general topic of that question (such as restaurants or weather). These events contain identifiers and counts only; they never include the text of your messages, your name or email address, or the contents of your bookings or emails.

Travlin does not use Gmail data or Google user data for advertising.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

If we make material changes, we may notify users by updating the effective date, posting a notice on our website, or providing notice through the app.

Your continued use of Travlin after changes are posted means you accept the updated Privacy Policy.

17. Contact Us

If you have questions about this Privacy Policy, your data, Gmail access, AI data use, or data deletion requests, please contact us:

Travlin Support

Email: help@travlin.ai

Website: https://www.travlin.ai