Privacy Policy

The Index Labs Pte. Ltd. ("Travaio", "we", "us") runs the Travaio travel-planning service and is the controller of the personal data described here. This policy covers the Travaio website and the Travaio mobile app.

• Company: The Index Labs Pte. Ltd., Singapore
• Address: 7 Temasek Boulevard, #12-07, Suntec Tower One, Singapore 038987
• General contact: contact@travaio.co
• Privacy requests: privacy@travaio.co
• Data Protection Officer: dpo@travaio.co

We collect what is needed to plan trips (your travel preferences and trip details), run your account and keep the service secure. We do not collect payment card numbers.

• Generate itineraries and personalized recommendations from your trip inputs and preferences, using an AI model, and look up the places in them.
• Save, share, export and collaborate on trips, and keep your journal, documents and expenses with them.
• Run your account: sign-in, optional two-factor authentication, plan limits and billing.
• Send transactional email and notifications you would expect: collaboration invitations, billing notices, support replies, account confirmations, and trip reminders if you turn them on.
• Tally your thumbs up and down by category to shape your next itinerary.
• Measure anonymous page views and performance, and fix errors from server logs.
• Prevent abuse and fraud, enforce rate limits and our Terms, and meet legal obligations.

• Contract (Art. 6(1)(b)): account creation, itinerary generation, saving and sharing trips, payments and support.
• Legitimate interests (Art. 6(1)(f)): securing the service, preventing fraud and abuse, rate limiting and fixing errors.
• Consent (Art. 6(1)(a)): device location, push notifications, and any special-category details (such as dietary or accessibility needs) you choose to enter. You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)): tax and accounting records for payments, and responding to lawful requests.

We use these processors. Each receives only what its job needs. We do not sell your data and we do not share it with advertisers.

Travaio does not book or sell travel. If you use Import an itinerary, the text or file you submit is processed to extract trip details. We may also disclose data where the law requires it, or to protect the safety and rights of users and Travaio.

We are based in Singapore. The Travaio app runs on Singapore (Google Cloud Run, asia-southeast1). Our database and authentication provider is Supabase (managed Postgres), and our other processors operate their own infrastructure, so your data can be processed outside the country where you live.

Where data leaves your country, we rely on the data-processing terms and transfer mechanisms published by those providers. Each of them describes where it processes data in its own documentation. Contact the Data Protection Officer if you want to know more about a specific provider.

Analytics and error logs

• Page analytics use Cloudflare Web Analytics, which sets no cookies and stores nothing on your device. It records aggregated page views and page performance without personal identifiers or cross-site tracking, so there is no analytics choice to make.
• We do not record sessions, replay what you do on a page, or measure individual interactions.
• Server errors, including errors reported from your browser, are written to Google Cloud Run logs in Singapore (asia-southeast1) so we can fix them.

We do not use advertising cookies, marketing cookies, social-media trackers or Google Analytics.

• Traffic to Travaio uses HTTPS.
• Trip data lives in Postgres with row-level security, so a trip is readable by your account and by people you invite, and by nobody else.
• Passwords are handled by our authentication provider. Two-factor authentication (authenticator app) is available, and backup codes are stored only as one-way hashes.
• MCP API keys are stored only as one-way hashes. Treat a key like a password.
• Card data is handled by Stripe, Apple or Google. Server credentials are kept in managed secret stores, not in the code.
• Trip documents and journal photos sit in private storage and are opened through links that expire.

• Account, trips, journal, documents, expenses, comments, votes and API keys are kept until you delete them or delete your account.
• Deleting your account is permanent. It removes your profile and the data tied to it, deletes your journal photos and trip documents from storage, and cancels any web (Stripe) subscription. Subscriptions bought through Apple or Google must be canceled in the store. Feedback you gave is stripped of identifying details rather than deleted.
• Payment and invoice records are kept by Stripe, Apple or Google, and by us, for as long as tax and accounting law requires.
• Guest plan-limit counters (a hashed client identifier and a date, used to enforce the daily guest limit) are deleted after 30 days.
• Security and audit records (a log of changes to accounts, trips and collaboration, with IP address and device type) are deleted after 90 days.
• Backups held by our database provider age out under that provider's schedule. Logs and monitoring data are kept for the period set in our logging provider.
• Shared trips: if you delete a trip you own, collaborators lose access to it.

You can export your data and delete your account from Account settings.

• Access and portability: download your data from Account settings.
• Rectification: edit your profile and trips, or ask us to correct data.
• Erasure: delete your account from Account settings.
• Objection and restriction: ask us to stop or limit processing based on legitimate interests.
• Withdraw consent: turn off notifications or device location on your device.

Email privacy@travaio.co or dpo@travaio.co for anything the settings do not cover. We will answer within 30 days. We may ask you to confirm your identity first, and we may keep data the law requires us to keep.

• The rights above, plus the right to restriction of processing and to object to processing based on legitimate interests.
• You can complain to your local data protection authority. Our lead contact authority is the Singapore Personal Data Protection Commission (pdpc.gov.sg), and EU users can find their authority at edpb.europa.eu.

Data Protection Officer: dpo@travaio.co, c/o The Index Labs Pte. Ltd., 7 Temasek Boulevard, #12-07, Suntec Tower One, Singapore 038987.

• Right to know, delete and correct personal information, and to limit use of sensitive personal information.
• We do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of.
• Request through Account settings or email privacy@travaio.co. We verify requests against your account, and an authorized agent can act for you with your written permission.

Categories we collect: identifiers (name, email, IP address), commercial information (subscription), internet activity (anonymous, cookieless page-view and performance statistics), approximate or device location (if allowed), and health-related preferences you enter (dietary, accessibility, mobility).

You must be at least 18 years old, or have a parent or guardian's consent, to use Travaio. We do not allow accounts for anyone under 13, even with a parent or guardian's consent, and we do not knowingly collect personal data from them. If you believe a child has given us personal data without a parent's consent, email contact@travaio.co and we will delete it.

• An AI model drafts your itinerary from your inputs. After that, automated checks adjust or flag it (for example pace, opening hours and budget). The result is a suggestion for you to review. It has no legal or similarly significant effect on you.
• Automated rate limits and abuse checks can refuse requests. If you think one was applied in error, email us and a person will look at it.
• We do not train models on your data. See How We Use Your Data.

We do not send marketing email. We send transactional messages you need: collaboration invitations, billing and payment notices, support replies, account confirmations and security alerts. Push notifications (such as trip reminders) go out only if you allow them and can be turned off in your device settings or in the app.

If a breach affects your personal data in a way that is likely to cause you harm, we will tell you and the regulators the law requires us to tell, within the timelines that law sets (for example 72 hours to an EU supervisory authority under GDPR, and the Singapore PDPC's notification timeline under the PDPA).

If Travaio is merged, acquired or sold, your data may transfer to the new owner, who must honor this policy or give you notice of changes and a chance to delete your data first.

We update this page when our practices change and change the "Last updated" date at the top. For a material change we will notify you in the app or by email where we can. Continuing to use Travaio after a change means you accept the updated policy.

• General: contact@travaio.co
• Privacy requests: privacy@travaio.co
• Data Protection Officer: dpo@travaio.co
• Post: Privacy Officer, The Index Labs Pte. Ltd., 7 Temasek Boulevard, #12-07, Suntec Tower One, Singapore 038987

If you are not satisfied with our answer you can contact the Singapore Personal Data Protection Commission (pdpc.gov.sg) or, in the EU, your local data protection authority (edpb.europa.eu).