Privacy Policy
Last updated: September 10, 2026
Itinara AI Inc. ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy ("Policy") describes how we collect, use, store, and share your personal information when you use Itinara AI (https://itinara.tech), an AI-powered travel planning service.
Please read this Policy carefully before using the Service. By using the Service, you confirm that you have read and agree to this Policy. We may update this Policy from time to time; significant changes will be communicated in advance via email or prominent notice on the Service.
1. Data Controller
The data controller for this Service is:
- Company Name: Itinara AI Inc.
- Registered Address: 123 Innovation Drive, San Francisco, CA 94105, United States
- Privacy Contact: privacy@itinara.tech
- Data Protection Officer: Not applicable at this time
2. Personal Information We Collect
2.1 Information You Provide
- Account Information: Email address, display name, password (stored using bcrypt hashing)
- Payment Information: Transaction amount, payment status, and billing address. We do not store full card numbers — card data is processed by our payment processor (see Section 5)
- Travel Preferences: Destination preferences, travel dates, duration, budget, interest categories (food, culture, adventure, etc.), group type (solo, couple, family, etc.)
- Communication Records: Emails, support tickets, and feedback you send to our team
- Generated Content: AI-generated itineraries, travel plans, articles, VLOG scripts, and social media posts created using the Service
2.2 Information We Collect Automatically
- Device & Network: IP address, device model, operating system, browser type, and time zone
- Usage Behavior: Pages visited, features used, operation logs, session duration
- Log Data: Request timestamps, error logs, and performance data
3. How We Use Your Information
| Purpose | Legal Basis |
|---|---|
| Provide and maintain the Service | Contract performance |
| Billing and payment processing | Contract performance |
| Customer support | Contract performance / Legitimate interest |
| Service notifications (billing, security, policy updates) | Legitimate interest |
| Security and fraud prevention | Legitimate interest |
| Product improvement and analytics | Legitimate interest |
| Legal compliance | Legal obligation |
| Marketing communications (optional) | Your consent |
We may aggregate or de-identify data for statistical analysis. Such data cannot be traced to a specific individual.
4. Cookies and Tracking Technologies
| Type | Purpose | Can Be Disabled |
|---|---|---|
| Strictly Necessary | Maintain login sessions, core functionality | No |
| Functional | Language preferences, personalized settings | Yes |
| Analytics | Anonymous usage statistics, product optimization | Yes |
| Marketing (optional) | Targeted advertising and performance measurement | Yes |
No analytical or marketing tools are currently deployed. You may adjust your cookie preferences through your browser settings or our cookie management center (when available).
5. Sharing and Disclosure of Personal Information
We do not sell your personal information, including as defined under applicable laws such as the CCPA. We share your information only in the following circumstances:
- Service Providers: Cloud computing, payment processing, customer support, and analytics vendors — all bound by confidentiality agreements. Payment card data is processed exclusively by our PCI-DSS-compliant payment processor, Waffo Pancake, and is never stored on our servers
- AI Model Providers: Trip preferences and destination data are processed by DeepSeek (under a Data Processing Agreement) to generate travel itineraries
- Legal & Regulatory: When required by law, court order, or legitimate government request
- Business Transactions: In the event of a merger, acquisition, or asset sale — with advance notice and continued protection obligations
- With Your Consent: For any other purpose not listed above, only with your explicit prior consent
6. Data Security Measures
- Transmission Encryption: TLS/HTTPS for all data in transit
- Storage Security: Passwords and sensitive data are encrypted or hashed (bcrypt)
- Access Controls: Least-privilege principle; staff sign confidentiality agreements
- Regular Security Audits: Periodic vulnerability scanning and security reviews
In the event of a security incident affecting your rights, we will notify you and the relevant supervisory authority within 72 hours of discovery. Please keep your account credentials secure and never share them with others.
7. Data Retention
| Data Type | Retention Period | Disposal on Expiry |
|---|---|---|
| Account Information | Active period; 90 days after account deletion | Secure deletion or anonymization |
| Transaction Records | Minimum 5 years (tax/accounting obligation) | Archived or deleted per law |
| Customer Support Records | 2 years | Secure deletion |
| Security Audit Logs | 12 months | Secure deletion |
| Travel Preferences & Generated Itineraries | Until deleted by user or account closed | Secure deletion |
8. Your Data Rights
To exercise the following rights, contact us at privacy@itinara.tech. We will process your request within 30 calendar days.
| Right | Description |
|---|---|
| Right to be informed | Know what data we collect and how we use it |
| Right of access | Receive a copy of your personal data |
| Right to rectification | Correct inaccurate or incomplete data |
| Right to erasure | Request deletion of your data under certain conditions |
| Right to restrict processing | Pause data processing under certain circumstances |
| Right to data portability | Receive your data in a machine-readable format |
| Right to object | Object to processing based on legitimate interest or marketing |
| Right to withdraw consent | Withdraw consent for processing based on consent at any time |
If you believe we have not handled your data appropriately, you have the right to lodge a complaint with your local data protection authority.
9. Marketing Communications and Opt-Out
With your consent, we may send marketing communications about Itinara AI features, promotions, and updates via email, SMS, or in-app notifications. You may opt out at any time by clicking the "unsubscribe" link in any marketing email, adjusting your account settings, or contacting us. Opting out does not affect service-related notifications (billing, security, policy updates) which are necessary for the Service.
10. Cross-Border Data Transfers
Our servers and service providers may be located in the United States and Singapore. When data is transferred across borders, we protect it through:
- Data Processing Agreements incorporating Standard Contractual Clauses (SCCs) for transfers from the EU/EEA
- Transfers only to recipients providing an equivalent level of data protection
- Additional safeguards such as adequacy decisions where applicable
11. Children's Privacy
The Service is intended for users aged 18 and older. We do not knowingly collect data from individuals under 18. If you believe your child has provided us with personal information, please contact us immediately at privacy@itinara.tech and we will promptly delete the data.
12. Third-Party Links and Services
The Service may contain links to third-party websites or integrate with third-party services. This Policy applies only to data collected directly by us. We are not responsible for the data practices of third parties; we recommend reviewing their privacy policies before using their services.
13. Changes to This Policy
We may update this Policy from time to time. Significant changes will be communicated at least 15 days in advance via email or a prominent notice on the Service. The "Last updated" date at the top of this page will be revised. Continued use of the Service after changes take effect constitutes acceptance of the revised Policy.
14. Contact Us
- Privacy Inquiries: privacy@itinara.tech
- Customer Support: support@itinara.tech
- Company: Itinara AI Inc. · 123 Innovation Drive, San Francisco, CA 94105, United States
- Hours: Monday to Friday, 09:00–18:00 Pacific Time
Itinara AI Inc. · https://itinara.tech
This Privacy Policy is for informational purposes only and does not constitute legal advice. We recommend consulting a qualified legal professional in your jurisdiction before publishing.