Privacy Policy
TravelAI ("we", "us") respects your privacy and is committed to protecting your personal data in line with the EU General Data Protection Regulation (GDPR) and Bulgarian Personal Data Protection Act. This policy explains what we collect, why we collect it, and what rights you have.
1. Who we are
TravelAI is an AI-powered travel concierge that helps you discover and book flights, hotels and packages via our affiliate partners. We operate the website travelaibg.com. Our contact email is travelaibg@gmail.com.
2. What data we collect
We collect: • Account data — email address and (for password-based accounts) a salted bcrypt hash of your password. If you sign in with Google, we receive your name, email and profile picture from Google. • Trip data — destinations, dates, traveller counts and other parameters you enter in the AI chat or save to your dashboard. • Email-alert subscriptions — origin/destination IATA, threshold price, language. • Technical data — IP address, browser type, device, language, referring URL. Used for analytics and abuse prevention. We do NOT collect payment-card details. All bookings happen on the partner's checkout — we never see your card.
3. Why we collect it (legal bases)
We process data on three GDPR bases: • Contract — to provide the service you asked for (save trips, send alerts, deliver confirmations). • Legitimate interest — to improve the product, prevent fraud, and operate the website. • Consent — for marketing emails, where applicable. You can withdraw consent at any time.
4. Who we share it with
We share data only with the processors needed to run the service: • Brevo (Sendinblue) — transactional email delivery. • Travelpayouts / Aviasales — flight metadata and affiliate tracking. • Booking.com, Hotels.com, Agoda — when you click through to book hotels. • MongoDB Atlas — database hosting. • Emergent / Google — authentication (only if you use Google sign-in). All processors are GDPR-compliant and bound by Data Processing Agreements.
5. How long we keep it
Account data: as long as your account is active. You can delete your account anytime — we permanently remove your personal data within 30 days (some anonymised logs may remain for fraud prevention up to 12 months). Saved trips and alerts: until you delete them or close your account.
6. Your rights under GDPR
You have the right to: (a) access your data, (b) correct it, (c) delete it, (d) restrict processing, (e) data portability, (f) object to processing, (g) lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP, www.cpdp.bg). To exercise any of these, email travelaibg@gmail.com.
7. Cookies & tracking
We use a small number of essential cookies (session, language preference, A/B variant). We don't run third-party advertising trackers. Affiliate partners may set their own cookies once you click through to their site — review their cookie policies.
8. Changes to this policy
We may update this policy occasionally. The "Last updated" date at the bottom always reflects the latest version. Significant changes will be announced via email to active users.