Summary
TRIPSORA CAPITALS LTD (Company Number 16549250), 124 City Road, London EC1V 2NX, United Kingdom, is the controller for personal data processed through tripsora.com, routeplanner.ai, trip-planner.ai and tripbuilder.ai. Contact: [email protected].
Payments are processed by Stripe. We receive confirmation of the payment (amount, currency, date, Stripe session reference) and the email address used; we never receive or store full card numbers. See Stripe's privacy policy.
If you apply to sponsor our websites we collect your company name, website, contact name and email address, any message you send, the tier and sites you choose, the display name, short description, link and logo you provide for your listing, and the date and time you accepted our Terms. We store a one-way hash of your IP address with your application to prevent abuse. Signing in to the sponsor dashboard uses a strictly necessary session cookie that ends when you close your browser. We count clicks on sponsor links as daily totals per sponsor, without identifying the visitor. Your display name, description, link and logo are published on our websites (and your name may appear in our posts on X) once we approve them.
If you apply to be a creator on trip-planner.ai we collect: your name, e-mail address, chosen handle, a password (stored only as a one-way hash) and your country; the profile information you add (photo, bio, social media handles); the Trips you write, including text, photos, links and embedded clips; the date you accepted the Creator Terms; sign-in times, security and activity records (including IP address); and the content moderation decisions we make. If you add a tips link or a full-guide link, we store the web address you enter.
We do not take payments from or for creators. If we agree a fixed fee with a creator for a commissioned Trip, we use the bank details they give us only to pay that fee, and keep the payment records for 7 years (accounting).
Your name, handle, photo, bio, country, social handles and published Trips are public on your creator page and can be found by search engines.
If you use the AI import, the text you paste is sent to our AI providers to produce a draft itinerary. We do not store the pasted text; we only record that you used the feature and its length.
If you rate a Trip with the stars, we add your rating to an anonymous total for that Trip (for example "one more 5-star rating"). We do not store who rated, and creators see only the totals. To stop ratings being stuffed, we keep a scrambled (hashed) form of your IP address for up to two days to count how many times you rated; we do not keep the IP address itself for this.
When you visit a creator page, or click a booking, full-guide or tips link on it, we add one to a daily total for that creator and Trip. Links go through our own address (trip-planner.ai/go/...) which counts the click and sends you on to the partner or creator's site. The totals do not include your IP address, a cookie or any identifier, so we cannot tell who visited; automated visits and creators' own visits are not counted. We do not set a cookie to remember which creator you visited, and creators do not receive your personal data: they see totals only.
If you use "Remix", we process the dates, number of travellers, budget, pace and interests you enter (and any note you type), and the Creator Trip you chose, to generate your plan. We send these to our AI providers (Groq and Google). We keep your answers and the plan for 30 days at a private web address (a long random link that only people you share it with can open), together with a scrambled (hashed) form of your IP address that we use to limit abuse; we do not store your IP address itself, your name or your e-mail. Please do not put personal details in the note.
On TripBuilder itineraries and Trip-Planner trip pages you can ask us to email you a link to the itinerary. We first send a 6-digit code to the address to confirm it is yours (the same code check as the Tripsora AI agent). We keep a record that the address was verified, and your browser keeps a signed confirmation for up to 30 days so that you do not need a new code each time.
Pre-trip tips (optional). If you tick this, we keep your email address (encrypted), the itinerary link and title, the destination and your travel date, so that we can send you one email with a practical checklist a few days before you travel. That email may contain partner links, for example to tours or an eSIM, on which we may earn a commission. We delete these details as soon as that email has been sent, once your travel date has passed, or straight away when you use the cancel link in our email. In the Tripsora AI agent you sign up with the “Pre-trip tips by email” button after emailing yourself a plan, and we send you a short notice with a cancel link.
Newsletter (optional). If you tick this, we add your address to our newsletter list with our email provider, Brevo. You can unsubscribe at any time with the link in every newsletter.
Account (optional). If you tick this, we create a Tripsora account for your verified address, with the password you choose or a temporary password that we email to you and that you should change. Accounts are also added to our accounts list with Brevo, for service emails about your account.
The legal basis for the tips and the newsletter is your consent, which you can withdraw at any time. For the account it is our contract with you to provide it.
| What | Why | Where it goes |
|---|---|---|
| Email address and first name, verified with a 6-digit code | To identify you, count your free and paid questions, and address you by name | Our servers; verification codes are sent by email |
| Your messages and the last messages of the conversation | To understand your request and keep the conversation coherent | Our servers; sent to our AI providers (Groq, Google) with your first name and saved preferences – never your email address |
| Saved travel preferences | So you don't have to repeat them in later conversations | Our servers; included in requests to our AI providers |
| Trip details needed for searches (cities, airports, dates, number of travellers, hotel and activity names) | To find recent flight fares, create booking links, check the weather and place your stops on a map | Travelpayouts (fares and links), Open-Meteo (weather), Mapbox (map locations). These requests contain no name or email address. |
| Booking links you click | To take you to the Partner with your trip details filled in | The Partner receives the destination, dates and number of travellers in the link, plus whatever you enter on their site |
| Shared plans | So you can open, email or share a plan | Our servers; anyone with the share link can view the plan |
| Question balance and payments | To provide free and paid questions and handle refunds | Our servers; Stripe for payments |
| Plan emails you request | To send the plan to your own verified address | Our email server; the email includes a map image loaded from Mapbox |
The agent also detects the language you write in, to answer in that language. This uses only the text of your messages.
| What | Why | Where it goes |
|---|---|---|
| Email address and first name, verified with a 6-digit code | To identify you and count your free and paid route questions | Our servers; verification codes are sent by email |
| Your message, up to the last 12 messages of the conversation and your current route (stop names, coordinates, route wishes) | To plan or change your route | Our servers; sent to our AI provider Groq – never your name or email address |
| Place names of the stops | To find their coordinates | Photon (Komoot) and, if needed, Nominatim (OpenStreetMap Foundation). These requests come from our server and contain no name, email or IP address of yours. |
| Coordinates of the stops and route wishes (avoid tolls, motorways, ferries) | To calculate roads, distances and driving times | The OSRM routing service run by FOSSGIS e.V. Requests come from our server and contain no personal details. |
| Coordinates along your route (points on the road) and, for electric cars, that you want charging stops | To find real charging stations and fuel stations near your route | Open Charge Map and, as a fallback and for fuel stations, the Overpass API (OpenStreetMap data). Requests come from our server and contain no name, email or IP address of yours. |
| The route shown on the map | To draw the map and the road line in your browser | Mapbox, which receives the stop coordinates and your IP address |
| Hotel and Google Maps links you click | To show hotels at an overnight stop or open the route in Google Maps | Stay22 and its hotel partners, or Google, receive the place or route in the link, plus whatever you enter on their site |
| Question balance and payments | To provide free and paid route questions and handle refunds | Our servers (email address, free and paid questions, number of questions, Stripe payment reference, amount); Stripe for payments, invoices and receipts |
The route assistant does not save travel preferences and does not keep a record of your conversations on our servers. Our server logs keep a short excerpt of each request and the stop names for troubleshooting (see section 7).
| Purpose | Legal basis (UK GDPR) |
|---|---|
| Providing the AI travel agent, the route assistant, itineraries and other services you request; email verification; counting questions | Contract (Art. 6(1)(b)) |
| Reviewing sponsor applications, managing sponsorships, publishing approved listings, billing, and sending sponsor emails and click reports | Contract or steps before entering a contract (Art. 6(1)(b)); legitimate interests in running our sponsor programme (Art. 6(1)(f)) |
| Payments, refunds, accounting and tax records | Contract and legal obligation (Art. 6(1)(b), (c)) |
| Saving travel preferences for later conversations | Legitimate interests in a convenient service (Art. 6(1)(f)) – you can delete them at any time |
| Security, preventing abuse (rate limits, one allowance per person), troubleshooting | Legitimate interests (Art. 6(1)(f)) |
| Keeping chat records for support, quality and improving our service | Legitimate interests (Art. 6(1)(f)) |
| Analytics, advertising and non-essential cookies | Consent (Art. 6(1)(a)) |
| Marketing emails | Consent, or soft opt-in for customers (PECR) |
| Running creator accounts, publishing Trips, approving and moderating creators, and showing creators their totals (account and profile data, Trips, activity records) | Contract; legitimate interests (safe, accurate content) |
| Generating Remix plans and draft itineraries from pasted notes (Remix answers, pasted text, the Trip used) | Contract (the feature you asked for) |
| Rating Trips and preventing abuse such as fake accounts or rating stuffing (scrambled IP counters for readers; IP address in creators' security log) | Legitimate interests |
Please do not include special category data (for example health information) in your messages. If you do, we process it only to answer your request, on the basis of your explicit choice to share it.
| Recipient | Role and data |
|---|---|
| Groq, Inc. (GroqCloud, USA) | Processor – generates AI answers from your messages, conversation context, first name and saved preferences (Tripsora AI); and from your messages, conversation context and current route, without name or email (RoutePlanner.ai) |
| Google (Gemini API) | Processor – generates AI answers (same data as Groq) when used; under the Gemini API terms that apply to our use, Google does not use prompts or responses to improve its products and logs them only for a limited time for abuse prevention |
| The public and X (x.com) | Sponsor display name, description, link and logo that you submit and we approve, shown on our websites; sponsor names may be named in our posts on X |
| Stripe | Payment processing (independent controller for its own regulatory purposes) |
| Travelpayouts | Recent flight fares and creation of tracked booking links (routes, dates, number of travellers – no name or email) |
| Mapbox (USA) | Map display in your browser (receives your IP address), drawing routes on roads on routeplanner.ai (stop coordinates) and finding the locations of places in plans (place names only) |
| Komoot (Photon, Germany) and OpenStreetMap Foundation (Nominatim, UK) | Finding the coordinates of route stops (place names only, sent from our server) |
| FOSSGIS e.V. (OSRM routing service, Germany) | Calculating roads, distances and driving times (stop coordinates and route wishes only, sent from our server) |
| Open Charge Map (United Kingdom) and the operators of public Overpass API servers (OpenStreetMap data) | Finding charging and fuel stations near your route (coordinates of points on the road only, sent from our server). Charger data is licensed CC BY 4.0 (Open Charge Map and its data providers) and ODbL (OpenStreetMap contributors). |
| Cloudflare (cdnjs) | Delivers the map software used on routeplanner.ai to your browser (receives your IP address) |
| Open-Meteo | Weather data (destination and dates only) |
| Hosting and email providers | Store our databases and send verification codes and plan emails |
| Booking Partners (e.g. Trip.com, hotel sites via Stay22, GetYourGuide, Kiwitaxi, Ubigi) | Only when you click a link: trip details in the link; their own cookies and terms apply |
| Google Analytics and advertising partners | Only with your consent – see the Cookie Policy |
| Authorities | Where required by law |
| The public | Creator name, handle, photo, bio, country, social handles and published Trips, shown on trip-planner.ai |
| Groq, Inc. and Google (Gemini API) | Processors – generate draft itineraries from creators' pasted notes and Remix plans from readers' inputs (see the existing entries) |
| Ko-fi, Buy Me a Coffee, Patreon, Gumroad, Lemon Squeezy (links chosen by creators) | If you click a creator's tips or full-guide link you go to that website, which receives what your browser sends. Any purchase or tip is between you, the creator and that website; we do not receive your payment details or data. |
| Stay22 and GetYourGuide (partners) | When you click a booking link on a creator page you go to their website; they receive what your browser sends and the campaign tag (which identifies the creator page, not you) |
| TourRadar (group tours widget) | Trip pages on trip-planner.ai include a widget from TourRadar that lists guided group tours. When you scroll to it, your browser loads TourRadar's script and content from TourRadar's servers (assets.api.b2b.tourradar.com), so TourRadar receives your IP address and browser details and may set cookies or use similar technologies, under its own privacy policy. If you click a tour and book, TourRadar tells us about the booking so that we can be paid a commission. No cookie of ours is involved in loading the widget. |
| Pexels (photos of destinations) | Trip pages show free photos of the destination, loaded from Pexels' servers (images.pexels.com) with the photographer credited. Pexels receives your IP address and browser details when the photos load, under its own privacy policy. No cookie of ours is involved. |
| YouTube, Instagram, TikTok and X | If a creator embeds a clip, your browser loads it from that service only after you press "Load video"; that service may then receive your IP address and set its own cookies (see the Cookie Policy) |
We do not sell your personal data.
Some recipients are outside the UK (for example in the USA). We rely on UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with appropriate security measures.
| Data | Retention |
|---|---|
| AI agent conversation context (last messages of a conversation) | 7 days after your last message |
| RoutePlanner.ai route conversations | Not stored on our servers; kept only in your open browser page |
| AI agent chat records (questions, answers, email, first name, language, tools used) | 30 days |
| Saved travel preferences | Until you delete them ("Forget my preferences") or ask us to |
| Shared plans | 180 days, or earlier on request |
| Question balances (Tripsora AI and RoutePlanner.ai) | While the assistant is offered, or until you ask us to delete it (unused paid questions are then refunded where applicable) |
| Payment records | 7 years (tax and accounting) |
| Sponsor records (company and contact details, listing content, click totals) | While the sponsorship lasts plus 2 years, or earlier on request (payment records follow the 7 year rule above) |
| Sponsor applications that are not approved | 12 months |
| Earlier chatbot history and Message Boost session data | 90 days |
| AI-generated itineraries | Until the trip date, then deleted within 30 days |
| Account information | For the life of the account plus 2 years |
| Map location cache (place names and coordinates only) | No personal data; kept to speed up maps |
| Server and security logs (including short request excerpts and route stop names) | For a limited period needed for security and troubleshooting |
| Support communications | 3 years from last contact |
| Analytics data | 26 months |
| Marketing preferences | Until you withdraw consent |
| Creator account and profile | While the account is open, plus 2 years (disputes); public profile removed within 30 days of closure |
| Creator Trips and uploaded images | While published; deleted within 30 days of unpublishing or account closure (copies may remain in backups for a limited time, and in Remixes already created) |
| Payment records for commissioned Trips (if any) | 7 years (tax and accounting) |
| Creator sign-in and security records | 90 days, then deleted automatically |
| Daily visit and click totals (no personal data) | 400 days, then deleted automatically |
| Pasted notes for AI import | Not stored |
| Remix answers and generated plans (with hashed IP) | 30 days, then deleted automatically |
Itinerary emails and pre-trip tips: a plain itinerary email is not stored. For pre-trip tips, we keep your details until the tips email is sent, for at most 7 days if you do not confirm, and never beyond your travel date (see 2.7).
The AI travel agent stores in your browser's local storage: your verified email address, first name and verification time; a copy of your recent conversation (up to 30 messages, including plan and map data); your conversation reference; the time until you can send the next question; and whether you accepted the notice. This data stays on your device; "Sign out" and "New trip" remove parts of it, and clearing your browser data removes all of it. Details are in our Cookie Policy.
On routeplanner.ai, the route assistant stores in your browser's local storage your verified email address, first name, a signed sign-in token and the verification time, for up to 30 days. Your route conversation is not stored on your device; it is lost when you close or reload the page. A strictly necessary session cookie connects your browser to our service and limits the number of messages per hour. "Sign out" removes your details from your device.
We use encryption in transit (TLS), access controls, signed tokens for verified email addresses, separation of secrets from website files, and monitoring. If a personal data breach is likely to result in a risk to you, we will notify the ICO within 72 hours and inform you without undue delay where required.
Creators' e-mail addresses are stored encrypted (AES-256-GCM) and passwords are stored only as one-way hashes. Sign-in and security records are deleted after 90 days.
Under the UK GDPR you can ask to access, correct, delete, restrict or port your data, object to processing based on legitimate interests (including saved preferences and chat records), and withdraw consent at any time. Some rights you can use directly: "Forget my preferences" deletes saved preferences; "Sign out" removes your details from your device. For everything else email [email protected] or write to our address. We reply within one month (extendable by two months for complex requests) and may ask you to verify your identity.
Our services are only for people aged 18 or over, and we ask users to confirm this before using our AI assistants. We do not knowingly collect data from children. Travellers may tell the agent their children's ages to plan a family trip; we use this only for that purpose. If you believe a child has used our services, contact us and we will delete the data.
We send marketing emails only with your consent or, for customers, about similar services (soft opt-in). You can unsubscribe in any email or by contacting us. Service emails (verification codes, plans you request, payment confirmations) are not marketing.
Please contact us first. You can also complain to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF – ico.org.uk, 0303 123 1113.
We will post updates here and change the date above. For material changes we will notify you by email (if we have your address) or on the website, and ask for consent again where the law requires it.
Related documents: Terms of Service · Privacy Policy · Cookie Policy · Disclaimer & Affiliate Disclosure · Digital Product Purchase Agreement · Creator Terms
Contact: [email protected] (privacy and general) · [email protected] (technical) · [email protected] (payments and cancellations)