Privacy Policy

1. Who we are and scope

This policy covers the Vaylido website at vaylido.com and the Vaylido trip-planning app (together, the "Service"). Vaylido decides how and why your personal information is used, which makes us the "controller" (or "business") for that information under privacy laws.

This policy applies to visitors, waitlist members, account holders, and travelers invited to a trip. It does not cover third-party websites you open from Vaylido, such as hotels, airlines, or booking partners, which have their own policies.

To contact us about privacy, including to reach whoever handles data protection for Vaylido, use our contact form and choose the privacy topic.

2. Information we collect

We collect only what we need to help you plan trips:

• Identifiers and account details: display name, email address, and password (stored securely by our sign-in provider), or basic profile details (name, email, profile picture) from Google if you sign in with Google.
• Profile preferences you choose to add: home airport or city, preferred currency, budget range, pace, accommodation, travel interests, and optional accessibility and dietary notes.
• Trip details: destinations, dates, number of travelers, children's ages (never names or birthdays), budgets, itinerary items, poll votes, and comments.
• Communications: messages you send to the Vaylido concierge, through our contact form, or when joining the early access waitlist.
• Usage and device information: pages visited, device type (mobile, tablet, or desktop), referring website, a random analytics ID, browser type, and IP address in our service providers' security logs.
• Approximate location: only what can be inferred from a home airport or city you enter. We do not collect precise GPS location.

3. Where your information comes from

We get information directly from you; from travelers who invite you to a trip (for example your email address); from Google if you sign in with Google; from your device and browser when you use the Service; and from Google Maps Platform for public place details such as hotel addresses and ratings.

4. How we use your information

We use your information to:

• Create and run your account and the trips you plan.
• Generate personalized recommendations for stays, dining, flights, car rentals, and activities.
• Let travelers you invite view and collaborate on shared trips.
• Respond to your questions and tell you about launch or important service updates.
• Measure which pages are used so we can improve Vaylido (first-party analytics, which you can switch off).
• Prevent fraud and abuse, keep the Service secure, fix problems, and meet legal obligations.

5. Legal bases for processing (EEA, UK, and Switzerland)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on these legal bases:

• Contract: to provide your account, trips, collaboration, and recommendations you ask for.
• Legitimate interests: to keep the Service secure, prevent abuse, understand usage in a privacy-friendly way, and improve Vaylido. You can object at any time.
• Consent: for optional accessibility or dietary notes that may reveal health information, for analytics where local law requires consent, and for marketing messages. You can withdraw consent at any time without affecting earlier processing.
• Legal obligation: where we must keep or disclose information under law.

6. Sensitive information

Accessibility and dietary notes are optional and may reveal health or religious information. We use them only to tailor your recommendations, never for advertising, and you can delete them from your profile at any time. In Washington, Nevada, and other states with consumer health data laws, this information is collected only with your consent and is not sold.

Please do not enter passport numbers, payment card numbers, medical records, or other sensitive details into the concierge or trip notes.

7. AI processing

When you ask Vaylido to plan a trip or answer a question, the details you provide, along with relevant saved profile preferences, are sent to AI service providers to produce a response. We do not send your password or payment details, and our providers process this information on our behalf to generate responses.

AI suggestions are recommendations only. Vaylido does not use automated decision-making that produces legal or similarly significant effects about you, and we do not use your information for profiling of that kind.

8. Place and map information

To show hotel and restaurant details such as addresses, phone numbers, ratings, websites, and photos, Vaylido looks up place names with Google Maps Platform. Google's own privacy policy applies to that data. Hotel photos load only when you choose to show them and are not saved by Vaylido.

9. How we share information

We do not sell your personal information, and we do not share it for cross-context behavioral (targeted) advertising. We disclose it only:

• With people you invite to a trip, who can see that trip's details.
• With service providers (processors) who host our app and database, provide sign-in, send email, power AI responses, and supply maps, only as needed to run Vaylido and under contracts that limit their use of your information.
• With booking partners only when you choose to follow a link to book with them.
• In a merger, acquisition, or sale of assets, where the new owner must honor this policy.
• When required by law, or to protect the safety and rights of our users and Vaylido.

10. Analytics and cookies

We use essential storage to keep you signed in and remember your settings. We also use first-party analytics that is on by default and records the pages you visit, your device type, the referring website, and a random ID, not your name or email. We don't use outside analytics or advertising companies.

You can switch analytics off anytime on our Cookie Preferences page. If your browser sends a Global Privacy Control signal, we treat it as an opt-out. We do not currently respond to "Do Not Track" signals because there is no common standard for them.

11. International data transfers

Vaylido and our service providers may process information in the United States and other countries whose data protection laws may differ from yours. When we transfer personal information from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision.

12. Data retention

We keep information only as long as needed:

• Account, profile, and trip information: while your account is active. When you delete your account, we delete or anonymize it within 30 days, except shared trip content that other travelers still need, which is anonymized.
• Waitlist emails: until launch invitations are sent or you ask us to remove you.
• Contact form messages: up to 2 years after your request is resolved.
• Analytics records: up to 25 months.
• Records we must keep for legal, tax, security, or dispute reasons: for the period the law requires.

13. Your privacy rights

Depending on where you live, you may have the right to:

• Know and access the personal information we hold about you, and how we use and disclose it.
• Correct inaccurate information.
• Delete your information.
• Receive a copy of your information in a portable format.
• Opt out of the sale of personal information, sharing for targeted advertising, and profiling (we do none of these).
• Limit the use of sensitive personal information, or withdraw consent you have given.
• Object to or restrict certain processing (EEA, UK, and Switzerland).
• Not be discriminated against for exercising your rights, we will never deny service or charge different prices because you made a request.

14. How to make a request

You can view and edit your profile at any time. For other requests, use our contact form and choose the privacy topic. We will verify your identity by confirming the email address on your account, and we respond within the time your local law requires (generally 30 days in the EEA and UK, and 45 days in U.S. states, which may be extended where allowed).

You may use an authorized agent to make a request for you; we may ask for proof that they are authorized and confirm your identity directly.

If we decline your request, you can appeal by replying to our decision or sending a new message through the contact form titled "Privacy appeal." We will respond within the time required by law, and if you are not satisfied you may contact your state Attorney General.

15. U.S. state privacy notices

California (CCPA/CPRA): In the past 12 months we collected identifiers, customer records, internet or other electronic activity, general geolocation inferred from your home city, inferences about travel preferences, and, if you choose to add them, sensitive information such as health-related accessibility or dietary notes. We collect these for the purposes in "How we use your information" and disclose them only to the recipients in "How we share information." We have not sold or shared personal information, including of consumers under 16, and we do not use sensitive personal information to infer characteristics about you. California residents may also request information about disclosures for direct marketing under the "Shine the Light" law; we do not make such disclosures.

Other states: Residents of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and other states with comprehensive privacy laws have the rights described in "Your privacy rights," including the right to appeal. Nevada residents may opt out of the sale of covered information; we do not sell it.

16. Other international rights

EEA, UK, and Switzerland: You may lodge a complaint with your local data protection authority, such as the authority in your EU country or the UK Information Commissioner's Office.

Canada (PIPEDA and provincial laws), Brazil (LGPD), Australia, and other countries: You have the rights your local law provides, including access and correction, and you may contact your national privacy regulator. Send requests through our contact form.

17. Children

Vaylido accounts are for adults 18 and older. We do not knowingly collect personal information from children under 13 (or under 16 in the EEA and UK). When planning family trips, we ask only for children's ages, never names or birthdays. If you believe a child has given us personal information, contact us and we will delete it.

18. Security

We use industry-standard safeguards, including encrypted connections, access controls, and database-level permissions that limit who can see each trip. No online service is completely secure, so please use a strong, unique password. If a security incident affects your personal information, we will notify you and regulators as required by law.

19. Changes to this policy

We may update this policy as Vaylido grows. If we make significant changes, we will update the date above and notify you by email or in the app before the changes take effect where required.