Privacy Policy

1.1 Information you give us

• Search inputs — origin, destination, dates, number of passengers, cabin class, currency.
• Passenger details — name, date of birth, gender, email, phone, and for international itineraries, passport number, issuing country, and expiry date. Required by airlines and travel suppliers to issue tickets. We do NOT store passport / national-ID / visa data on our servers. These fields are transmitted directly to the supplier (airline, hotel, cruise line) in the same request that creates your booking, and are not written to our database, logs, caches, or analytics. The supplier becomes the data controller for that information once it is sent. See section 4 below for the pass-through model.
• Payment information — when payment is launched, payment data is collected by our PCI-DSS-compliant payment processors (e.g., Stripe, Duffel Payments). We do not store raw card numbers.
• Communications — emails or messages you send us.
• AI trip-planner inputs — the destination and preferences you enter (dates, party size, budget, interests, dietary and accessibility needs) and any free-text notes. These are sent to OpenAI (our AI processor) to generate your itinerary and to resolve the destination you typed, and destination/venue names are sent to Google Maps Platform to resolve places and fetch photos. All planner free-text is also screened by automated content-safety moderation (OpenAI's moderation service) to keep the product family-safe; requests in prohibited categories are declined. Don't put passport numbers, payment details, or other sensitive personal data in planner free-text fields — it isn't needed to plan a trip.
• Venue reports — if you flag an AI-recommended place as closed or wrong, we record the venue, the problem, and your optional note (with your IP, for abuse prevention) in our 30-day activity log to fix recommendations.

1.2 Information collected automatically

• Device & browser — IP address, user agent, language, time zone, referring URL.
• Usage — pages visited, search queries, clicks, errors encountered.
• Activity log — for authenticated requests and key anonymous funnel actions (search, start-checkout, register) we record one server-side row per event: timestamp, page/action, IP address, coarse country (derived from IP — no city, no precise geo), parsed browser/OS/device-type, and referrer. This is used only for security (abuse / account-takeover detection) and product analytics (which features need work). It is never sold, never used for ad targeting, and is automatically deleted after 30 days by a daily retention job.
• Cookies & similar technologies — see Cookie Policy for details and how to manage your preferences.
• Affiliate referrals — when you click through to an insurance, hotel, or other third-party partner from PlanMyTrip, we forward generic trip metadata (dates, destination, total trip cost, number of travelers) so the partner can pre-fill a quote. We do not forward your name, email, date of birth, passport, or payment details. We may earn a commission on purchases made through these links. Coverage, customer service, and the post-purchase relationship belong to the partner, not PlanMyTrip.

1.3 Information from third parties

• Travel suppliers (airlines, hotel chains) may share booking-status updates and itinerary changes with us so we can keep you informed.
• Analytics & marketing partners (when enabled) share aggregated insights about how visitors discover and use the Service.

• To execute the bookings you request (the main reason we exist).
• To send transactional emails: confirmations, schedule changes, refunds, support replies.
• To improve the Service: which routes are most searched, where users hit errors, etc.
• To prevent fraud and protect both customers and suppliers.
• To comply with legal obligations (tax, government reporting, court orders).
• With your explicit consent (cookie banner): personalized advertising, marketing emails, cross-device tracking.

We share only what's necessary, and only with parties that have a legitimate role in fulfilling your booking or operating the Service.

• Travel suppliers — airlines, hotels, cruise lines, tour operators, insurance providers — to fulfill the booking.
• Aggregators & APIs we use to source inventory: Duffel (flights), Hotelbeds (hotels), CCRA, and others as our service grows.
• Payment processors — Stripe, Duffel Payments — to collect funds.
• Infrastructure providers — Vercel, Cloudflare, AWS — to host and serve the Service.
• Email & SMS providers — Resend, Twilio — to send transactional messages.
• AI & mapping processors — OpenAI (itinerary generation, destination understanding, and automated content-safety moderation of planner inputs) and Google Maps Platform (place resolution, place photos, route maps). They receive only the trip inputs needed for those features — never your account password, payment details, or identity documents.
• Analytics & marketing — Google Analytics, Microsoft Clarity, Meta Pixel, etc. (only when enabled and only if you have consented).
• Affiliate networks — Travelpayouts and direct affiliate partners. When you click an affiliate link, the partner receives standard referral parameters (no personal identity unless you log in there).
• Legal recipients — when required by law, court order, or to protect rights and safety.

We do not sell your personal data. We do not share personal data with third parties for their own independent marketing.

Passport, national ID, and visa data are handled on a strict pass-through basis.

• We collect them only when a supplier (airline / cruise / hotel) legally requires them to issue your booking.
• They are transmitted directly to that supplier in the same request that creates your booking.
• They are not written to our database, our logs, our caches, or our analytics systems.
• They are not included in our marketing, advertising, or conversion-tracking events sent to third parties (Google, Meta, etc.).
• They are not retained in any form after the request completes — typically within a few hundred milliseconds.
• Once transmitted, the supplier becomes the data controller for that information and handles it under its own regulatory obligations (APIS, PNR, etc.).

If you would prefer to provide passport details directly to the airline after booking (some airlines accept this via their own portal), please contact info@planmytriphere.com before booking and we will guide you through that option where available.

We use cookies and similar technologies for: making the site work (necessary), measuring usage (analytics), serving and measuring ads (advertising), and remembering preferences (personalization).

You'll see a consent banner on your first visit. You can change your choices anytime via the "Cookies" link in the footer or in your browser settings. See our Cookie Policy for the full list.

We are based in United States. Personal data may be transferred to, stored in, and processed in countries other than the one you reside in (including the United States, European Union, and the United Kingdom) when our suppliers or service providers operate there. Where required, we rely on standard contractual clauses or equivalent safeguards.

We keep personal data only as long as needed for the purpose it was collected, plus any legally required retention period.

• Booking records: 7 years (financial/tax compliance).
• Account data: until you request deletion or your account is dormant for 3 years.
• Marketing data: until you opt out or 2 years of inactivity.
• Web logs: 90 days.

Depending on where you live, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data ("right to be forgotten"), subject to retention rules above.
• Restrict or object to certain types of processing.
• Portability — receive your data in a machine-readable format.
• Withdraw consent at any time (where processing is based on consent).
• Lodge a complaint with your local data protection authority (in the EU/UK) or your state Attorney General (US).

To exercise any of these rights, contact info@planmytriphere.com. We will respond within the legally required timeframe (typically 30 days).

California residents (CCPA / CPRA)

You have the right to know what personal information we collect, the right to delete, the right to correct, the right to opt out of "sale" or "sharing" (we do not sell, but cross-context behavioral advertising is treated as sharing under CPRA — opt out via the cookie banner), and the right not to be discriminated against for exercising these rights.

The Service is not directed to children under 13 (or the equivalent age in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact info@planmytriphere.com and we will delete it promptly.

When booking flights for minors, the personal data we collect (name, DOB) is provided by an authorized adult and is used solely to issue tickets.

We use industry-standard safeguards including TLS encryption in transit, encrypted storage at rest, access controls, audit logging, rate limiting, automated blocking of traffic that exhibits attack patterns, and PCI-DSS-compliant payment processors. No internet service can guarantee absolute security; we work continuously to reduce risk.

Child safety: we apply automated screening to user-submitted planner content and have zero tolerance for child sexual abuse material. Where U.S. law requires (18 U.S.C. § 2258A), apparent violations are preserved and reported to NCMEC.

We may update this Privacy Policy from time to time. Material changes will be announced via a notice on the site or by email (if you have an account). The "Effective" date at the top indicates the latest revision.

For privacy questions, data requests, or complaints:

• Email: info@planmytriphere.com
• Legal team: info@planmytriphere.com
• Postal: PlanMyTrip LLC, [Registered street address], [City], [State] [ZIP], United States

Note: this policy is intended to be plain-language and accurate. It is not a substitute for legal advice. We recommend consulting a licensed attorney for your specific obligations. Suggest improvements at info@planmytriphere.com.