IMPORTANT PRIVACY INFORMATION: This Privacy Policy and GDPR Notice explains how Tripivor collects, uses, stores, shares and otherwise processes personal data in connection with the Tripivor private beta. It is intended to provide the information required by Articles 12, 13 and, where applicable, 14 of Regulation (EU) 2016/679 (the “GDPR”). Please read it carefully before using the Service.
1. Who We Are And Who Controls Your Personal Data
Tripivor is presently a pre-incorporation, private beta project operated jointly by Duru Naz Akkaya and Yigit Efe Karabulut, based in Milan, Italy (together, “Tripivor”, “we”, “us” or “our”).
For the processing activities described in this Notice, Duru Naz Akkaya and Yigit Efe Karabulut jointly determine the purposes and essential means of processing and therefore act as joint controllers within the meaning of the GDPR. You may exercise your rights against either joint controller. The controllers have designated info@tripivor.com as the single contact point for privacy enquiries and data-subject requests.
Privacy contact: info@tripivor.com Website: tripivor.com Location: Milan, Italy
Tripivor has not appointed a Data Protection Officer because, based on the present scale and nature of the private beta, we do not consider the mandatory DPO appointment criteria to be met. We will reassess this position if our processing activities materially change.
2. Scope Of This Notice
This Notice applies to personal data processed through the Tripivor website, account-registration and authentication flows, AI travel companion, itinerary builder, saved chats and itineraries, beta feedback and surveys, technical and security systems, analytics, mapping features and communications relating to the private beta (collectively, the “Service”).
This Notice does not govern the independent processing carried out by third-party travel providers or platforms after you follow an external link or otherwise interact with them. Providers such as Booking.com, Skyscanner, Hotels.com, Uber, airlines, hotels and activity providers determine their own processing under their own privacy notices.
3. Who May Use The Service
The beta is intended only for persons aged 18 years or older. We do not knowingly offer the Service to children and do not intentionally collect personal data from persons under 18. If we become aware that an under-18 user has provided personal data in breach of this restriction, we will take reasonable steps to delete or otherwise appropriately handle the data.
4. Categories Of Personal Data We Process
4.1. Account and authentication data
Depending on the sign-in method you choose, we may process your email address, account identifier, authentication status, account settings and technical authentication information. If you use Google Sign-In, Google may provide us with account information necessary to authenticate you, in accordance with the permissions presented during sign-in. Tripivor does not need your Google password.
4.2. Travel-planning and preference data
We may process information that you intentionally provide for itinerary personalization, including your departure point, destination, travel dates, approximate budget, age range, group size, interests, preferred travel style or pace, dietary preferences, accessibility preferences, accommodation or activity preferences, and other ordinary trip-planning instructions.
4.3. AI conversation and itinerary data
We process prompts, messages, follow-up questions, AI-generated responses, itinerary selections, edits, saved itineraries, interaction history and related content necessary to provide and maintain the AI travel-planning experience. Where enabled, chats and itineraries may be stored in your account so that you can return to them later.
4.4. Beta feedback and research data
We may process ratings, survey answers, feature requests, usability comments, reported problems, willingness-to-pay responses, whether you tell us that you followed or booked a recommendation, and other feedback voluntarily supplied during the beta. We do not currently receive automatic confirmation from travel providers that you completed a booking unless a future integration expressly states otherwise.
4.5. Technical, security and device data
When you use the Service, our systems and service providers may process IP address, browser and device information, operating system, timestamps, session identifiers, request logs, authentication events, error information, security events and similar technical information necessary to operate, secure and troubleshoot the Service.
4.6. Analytics and cookie data
Where enabled in accordance with applicable cookie and tracking rules, we may process information about how users interact with the website, including page views, events, session information, referral information, device/browser information and similar usage metrics through Google Analytics. Further information is provided in our Cookie Policy and cookie-preference interface.
4.7. Communications
If you contact us, we process your email address, message content and any information you choose to include so that we can respond, keep appropriate records and resolve the matter.
5. Special-Category Data And Sensitive Information
Tripivor is not designed to collect medical records, detailed health information, religious beliefs or other special categories of personal data. However, a dietary or accessibility preference may in some circumstances reveal information concerning health, disability or religion and may therefore constitute special-category data under Article 9 GDPR.
Where Tripivor intentionally offers an optional field that may require the processing of special-category data for personalization, we will request explicit consent where required before processing that information for that purpose. Such consent is voluntary and may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal. Where possible, users should provide a functional preference (for example, “step-free options preferred” or “vegetarian”) rather than unnecessary medical or religious details.
Do not submit passport numbers or copies, national identification numbers, payment-card details, banking credentials, medical records, diagnoses, biometric information, political opinions, sexual-life information or other highly sensitive information that is not necessary for ordinary travel planning.
6. Purposes Of Processing And Legal Bases
We process personal data only where we have an appropriate legal basis. The principal purposes and legal bases for the beta are summarized below.
Purpose Typical data GDPR legal basis
Create and manage your account; Email, account ID, authentication data, Art. 6(1)(b) - performance of the beta agreement authenticate you; provide saved chats and saved content. / steps at your request. itineraries.
Purpose Typical data GDPR legal basis
Generate and personalize travel Travel preferences, prompts, itinerary Art. 6(1)(b). If special-category data is recommendations and itineraries. data. intentionally processed, Art. 9(2)(a) explicit consent where required.
Operate, secure, debug and protect the Technical logs, IP, security events, Art. 6(1)(f) - legitimate interests in security, Service. account identifiers. reliability and abuse prevention; Art. 6(1)(c) where a legal duty applies.
Evaluate and improve the private beta. Usage patterns, feedback, interaction data, Art. 6(1)(f) - legitimate interests in product de-identified or aggregated metrics. testing and improvement, balanced against user rights; consent where separately required.
Optional analytics through Google Cookie/identifier and usage data as Art. 6(1)(a) consent where consent is required by Analytics. configured. applicable cookie/tracking law. Analytics remain subject to the Cookie Policy and user choices.
Respond to requests and service Email and correspondence. Art. 6(1)(b) and/or Art. 6(1)(f), depending on the communications. request.
Comply with law and establish, exercise or Relevant account, communication, Art. 6(1)(c) legal obligation and/or Art. 6(1)(f) defend legal claims. security or transaction-related records. legitimate interests.
Where we rely on legitimate interests, we consider the necessity of the processing and balance our interests against the rights, interests and reasonable expectations of beta users. You may object to processing based on Article 6(1)(f) in the circumstances described in Section 18.
7. Ai Processing
Tripivor uses artificial-intelligence and related technology providers to generate or support travel-planning functionality. Depending on the feature used, relevant prompts, travel preferences and generated content may be processed through services supplied by Google Gemini, OpenAI (including GPT-family models) and ElevenLabs for audio or voice-related functionality.
We aim to send only information reasonably necessary for the requested feature and to avoid transmitting unnecessary direct identifiers. Tripivor should be configured to use appropriate API/business arrangements for production beta processing. Provider-side retention and processing may vary according to the service, configuration, region and contractual terms in effect at the time of processing.
Tripivor does not use AI recommendations to make decisions that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR. You remain free to reject, modify or ignore any recommendation.
8. Service Providers, Processors And Recipients
We may disclose or make personal data available to service providers where reasonably necessary to operate the beta. Current or expected categories and principal providers include:
• Supabase - database, backend infrastructure, account authentication and storage of account, chat and itinerary data; • Google - Google Sign-In, Google Analytics, Google Maps and Gemini functionality, depending on the feature used; • OpenAI - AI-assisted travel-planning functionality where enabled; • ElevenLabs - audio or voice generation where enabled; • technical infrastructure, security, hosting, communications or professional advisers where added and appropriately documented; and
• public authorities, courts or other recipients where disclosure is required by law or necessary to establish, exercise or defend legal claims. Our providers may act as processors, subprocessors or independent controllers depending on the service and processing context. Where the GDPR requires a processor agreement, we seek to put appropriate Article 28 terms in place.
9. Third-Party Travel Providers
Tripivor may link or redirect you to independent providers such as Booking.com, Skyscanner, Hotels.com, Uber, airlines, accommodation providers, activity providers or transportation providers. During the current beta, Tripivor does not itself take payment for those travel services and does not intentionally transmit your passport or payment-card information to those providers.
When you choose to visit or transact with a third-party provider, that provider processes personal data under its own privacy notice and acts independently from Tripivor for the relevant booking or service. You should review the provider’s privacy information before supplying personal data.
10. Google Sign-In, Google Analytics And Google Maps
10.1. Google Sign-In
If you choose Google Sign-In, Google authenticates your Google account and provides Tripivor with the information permitted by the sign-in flow. Use of Google Sign-In is optional where another supported sign-in method is available.
10.2. Google Analytics
Tripivor uses or intends to use Google Analytics to understand how the private beta is used. Analytics implementation is subject to applicable cookie and tracking rules and to the choices presented through our cookie interface. Where consent is required, the relevant analytics technology should not be activated until the required consent has been obtained. You may withdraw optional consent through the Cookie Settings mechanism.
10.3. Google Maps
Tripivor may use Google Maps to display destinations, routes, points of interest or other map-based information. When map functionality is loaded or used, Google may process technical information in accordance with its own applicable terms and privacy documentation.
11. Cookies And Similar Technologies
Tripivor uses cookies, local storage and/or similar technologies for purposes such as authentication, session management, security, remembering privacy choices and, where enabled, analytics. Strictly necessary technologies may be used without optional consent where permitted by applicable law. Non-essential technologies are handled in accordance with applicable consent requirements.
Our separate Cookie Policy describes the technologies used by the production website, their purposes, categories and available controls. Because cookie and SDK behaviour depends on the deployed production configuration, the live Cookie Policy and preference interface must reflect the technologies actually present on tripivor.com.
12. International Data Transfers
Some service providers may process personal data in countries outside the European Economic Area (EEA) or make data accessible from such countries. Where the GDPR restricts a transfer of personal data to a third country, Tripivor seeks to rely on an appropriate transfer mechanism, which may include an adequacy decision under Article 45 GDPR, Standard Contractual Clauses adopted by the European Commission under Article 46 GDPR, or another legally recognized safeguard or derogation where applicable.
Where required, we also assess supplementary measures and relevant transfer risks in light of the nature of the data, provider, destination and service configuration. Users may contact info@tripivor.com for information about applicable transfer safeguards, subject to lawful confidentiality restrictions.
13. Data Retention
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, taking into account the private-beta context, account functionality, security, legal obligations and the need to establish or defend legal claims.
13.1. Active beta accounts
Ordinary account data, saved chats and itineraries may be retained while your account remains active so that the Service can provide account history and saved-planning functionality.
13.2. Account deletion
If you delete your account, Tripivor will aim to delete or de-identify ordinary account data from active Tripivor systems without undue delay and generally within 30 days, except where continued retention is necessary for security, legal compliance, dispute resolution, fraud/abuse prevention or another lawful purpose. Data may remain temporarily in protected backups until normal backup rotation and deletion cycles complete.
13.3. End of the private beta
Unless you have already deleted your account, remaining identifiable beta account, chat and itinerary data will generally be deleted or anonymized within 90 days after the private beta program ends, subject to legitimate legal, security or technical exceptions.
13.4. Feedback and research
Identifiable feedback may be retained during the beta evaluation period. Where useful findings are retained for longer-term product, business or investor analysis, we aim to use aggregated or properly anonymized information. Properly anonymized information is not personal data under the GDPR.
13.5. Security and compliance records
Security logs, consent records, privacy-request records and legal/compliance records may be retained for periods reasonably necessary to protect systems, demonstrate compliance or address legal claims, subject to periodic review and data-minimization principles.
14. Aggregated And Anonymized Beta Metrics
Tripivor may create aggregated or anonymized statistics concerning beta performance, such as itinerary-completion rates, feature usage, satisfaction, retention, recommendation acceptance, reported booking intent or willingness-to-pay metrics. We may use such non-identifying information for product development, internal analysis and communications with potential investors, advisers or partners.
We will not intentionally disclose identifiable AI conversations or identify an individual beta participant in investor or public materials merely because that person participated in the beta.
15. Testimonials And Quotations
If Tripivor wishes to use your name, photograph, username or an identifiable quotation/testimonial in marketing, public materials or investor communications, we will request separate permission where required. Giving such permission is optional and is not a condition of participating in the beta. You may contact us to withdraw permission for future uses, subject to lawful limits concerning materials already published or distributed before withdrawal.
16. Data Security
Tripivor uses reasonable technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. Measures appropriate to the beta may include access controls, authentication controls, least-privilege administration, secure transport, provider security features, database security rules, logging and incident-response procedures.
No online service can guarantee absolute security. You should use a strong password, protect access to your email/Google account and notify us promptly at info@tripivor.com if you suspect unauthorized access to your Tripivor account.
17. Personal Data Breaches
If Tripivor becomes aware of a personal-data breach, we will assess the nature, scope and likely risk of the incident, take reasonable containment and remediation measures, document the incident, and make notifications to the competent supervisory authority and/or affected individuals where required by Articles 33 and 34 GDPR.
18. Your Gdpr Rights
Subject to the conditions and exceptions in applicable law, you may have the following rights in relation to your personal data:
• Access - obtain confirmation whether we process your personal data and receive a copy and related information; • Rectification - have inaccurate personal data corrected and incomplete data completed; • Erasure - request deletion in circumstances provided by Article 17 GDPR; • Restriction - request restriction of processing in circumstances provided by Article 18 GDPR; • Data portability - receive certain data in a structured, commonly used and machine-readable format and, where technically feasible, request transmission to another controller where Article 20 applies; • Objection - object, on grounds relating to your particular situation, to processing based on legitimate interests under Article 6(1)(f), subject to the conditions in Article 21; • Withdraw consent - withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal; and • Complaint - lodge a complaint with a competent data-protection supervisory authority. Tripivor does not presently use solely automated decision-making producing legal or similarly significant effects about beta users within the meaning of Article 22 GDPR.
19. How To Exercise Your Rights
To exercise a privacy right or ask a question about this Notice, email info@tripivor.com. Please describe your request clearly and provide enough information for us to identify the relevant account or data.
We may request proportionate information to verify your identity where reasonably necessary to protect your data. We will not request excessive identification merely because you made a privacy request. We will respond within the time limits required by applicable law. Under the GDPR, this is generally within one month of receipt, subject to permitted extensions for complex or numerous requests.
20. Right To Complain
If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a competent supervisory authority. Because Tripivor is operated from Italy, the Italian supervisory authority is the Garante per la protezione dei dati personali. Depending on applicable GDPR rules, you may also be entitled to approach the supervisory authority in the EU/EEA Member State of your habitual residence, place of work or place of the alleged infringement.
We encourage you to contact us first at info@tripivor.com so that we have an opportunity to address your concern, but doing so does not limit your right to complain to a supervisory authority.
21. Turkish Users
Tripivor may make the private beta available to users in Turkey. Where Turkish personal-data protection law applies, Tripivor provides a separate Turkish KVKK Aydinlatma Metni and, where required, separate consent or cross-border-transfer information. This GDPR Notice does not replace rights or notices that are mandatory under applicable Turkish law.
22. Changes To This Notice
We may update this Notice to reflect changes to the Service, providers, processing activities, applicable law or our organizational structure. The current version and effective date will be published through the Service. Where a change materially affects how we process personal data, we will provide appropriate additional notice and, where legally required, seek renewed consent.
23. Future Incorporation Or Transfer Of The Project
Tripivor is currently operated by the two individual joint controllers identified in Section 1. If Tripivor is incorporated or the project is lawfully transferred to a legal entity, the identity of the controller may change. We will update this Notice and provide any information required by applicable law before or when that change takes effect. Such a change does not remove rights that users have in relation to earlier processing.
24. Contact Details
Joint controllers: Duru Naz Akkaya and Yigit Efe Karabulut Milan, Italy Privacy email: info@tripivor.com Website: tripivor.com
END OF PRIVACY POLICY & GDPR NOTICE