Privacy Policy

1. What we collect

Trip monitoring (watch_trip) — the one feature that stores anything server-side. When you (or your assistant, at your request) register a trip to monitor, we store the inputs of that tool call: the destination country codes (resolved from the countries, cities or airport codes you provided), the travel date window, and — only if you provide them — a free-text label and a webhook URL for push notifications. (A preferred language or audience role you pass shapes the assessment we return to you but is not stored.) If you set a webhook URL, we also generate and store a random signing secret used to HMAC-sign the notifications we send you. No name, no email, no account, no location tracking. At creation you receive two handles: a random, unguessable trip_id (the shareable URL) and a one-time owner_token — the private key needed to change or stop the trip. We store only a hash of the owner_token, never the token itself.

Read-only tools (assess_trip, whats_changed, explain_silence, get_trip_updates_since, country_briefing, list_events, country_tourism_profile) store nothing: they read published data and return it. Their outputs contain event and tourism data only, never data about you.

Optional Gemini translation — when you request a non-English language, source-derived event text and the target language may be sent to Google Gemini solely for translation. We do not send Gemini your destinations, travel dates, label, webhook URL, owner token, signing secret or assistant conversation. If translation is unavailable, the original source text is returned instead.

Tool call log — the MCP endpoint appends one line per tool call: timestamp and tool name only, never the arguments of your request.

Technical logs — our origin server keeps operational logs (errors, service events) that do not record per-request IP addresses. Rate limiting counts requests per IP address in memory only, in one-minute windows that are then discarded. Traffic to the site passes through Cloudflare (see Recipients), which processes connection data such as IP addresses under its own policy to route and protect the traffic.

Analytics — Cloudflare Web Analytics: cookieless, aggregated statistics only. No cookies, no fingerprinting, no cross-site tracking.

2. Purposes

We use this data solely to: provide the trip assessment and monitoring you asked for, deliver the webhook notifications you configured, measure aggregate usage of the public tools, translate source-derived event text when you request another language, and keep the service secure and available (abuse prevention, rate limiting, debugging). Nothing is used for advertising, profiling or sold to anyone.

3. Published trip pages

Each monitored trip is published as a machine-readable JSON file and a human status page (/trip/<trip_id> and /data/api/v1/trips/<trip_id>.json) so that you, your assistant, or anyone you share the link with can follow it. The URL is a capability: the trip_id is a random 128-bit value, not derived from your itinerary, so the page cannot be guessed or enumerated from the destinations and dates — only someone you give the link to can open it. The published copy contains the destinations, date window, label, updates log and latest assessment; it never contains your webhook URL, the signing secret, or your owner_token. To change or stop a trip you must present its owner_token, so no one else can alter or silence your monitoring. Treat the link as a shareable secret, and still avoid putting personal information in the trip label.

4. Recipients

We do not sell or share data for marketing. The parties that technically process data on our behalf or at your instruction are: Cloudflare (CDN/proxy in front of the site, and its cookieless analytics), our hosting provider (a virtual server in the EU, operated by us), the webhook endpoint you configure (trip updates are POSTed to the URL you chose — pick one you control), and, when you use Travel Trends through an AI assistant, that assistant's platform (for example OpenAI for ChatGPT): your conversation is processed by the platform under its own privacy policy; our endpoint receives only the tool call and returns event and tourism data. We never receive or store your conversation. For optional non-English localization, Google Geminiprocesses only source-derived event text and the requested target language under Google's Gemini API terms; it is not sent the trip inputs or secrets listed above.

5. Retention

A monitored trip (including its published page and any webhook configuration) is deleted automatically 90 days after the trip's end date, or earlier on request. Active monitoring itself stops at the end of the trip window; the record is kept for those 90 days so post-trip claims remain verifiable. The tool call log is a single size-capped file (oldest lines are dropped when it exceeds the cap). Operational logs contain no per-request IP addresses, so no personal data accumulates there. Travel Trends does not separately retain Gemini translation requests or responses; any provider-side processing is governed by Google's Gemini API terms.

6. Your controls & rights

You can remove a webhook at any time by re-calling watch_tripwith the trip's trip_id and owner_token and an empty webhook URL (notify_webhook_url=""); providing a new URL rotates the signing secret. The owner_token is what ensures only you can change or silence your own trip. You can request full deletion of a monitored trip before the 90-day cutoff by sending its trip_id to the contact address below — the record and its published page are removed. For access, correction or deletion under the GDPR, write to [email protected]. You also have the right to lodge a complaint with your data protection authority (in Romania: ANSPDCP). To avoid Gemini processing, omit lang or request English; the original source text remains available without machine translation.

Changes

When the tools' inputs, outputs or data flows change, this policy is updated in the same release and the effective date above moves accordingly.