Just Travel

Privacy Policy

Effective date: April 26, 2026

This document describes how Just Travel ("we", "us", "our") collects, uses, shares, and protects personal information. It is informational and does not constitute legal advice; please review with qualified counsel before publication.

1. Data Controller

The data controller for personal information processed through Just Travel is Data Sense, registered at 689 West Building Pracha Chuen Rd, Bangkok, 10800, Thailand. For privacy questions, contact info@justtravel.io.

2. Information We Collect

  • Account data — email address, name, password hash, and profile preferences. Authentication is handled by Supabase Auth.
  • Travel and usage data — search queries, itineraries, bookings, saved trips, favorites, and chat transcripts processed by our AI agents.
  • Payment data — billing transactions are processed by Stripe. Just Travel does not store full card numbers, CVCs, or bank credentials; we receive only tokenized identifiers and high-level status.
  • Technical data — IP address, browser and device characteristics, cookies and local-storage entries, and an anonymous session identifier cached in Redis to support unauthenticated usage and rate limiting.
  • Legacy integration data — Just Travel does not currently offer new Google Calendar or Gmail connections. Previously connected accounts may still have stored connection tokens, and data imported through those integrations may remain while operational cleanup is pending. This does not mean existing tokens have been revoked or imported data has been deleted.

3. How We Use Your Information

  • To provide, operate, and personalize the Just Travel service.
  • To generate AI-driven travel suggestions, itineraries, and chat responses.
  • To process payments and manage subscriptions.
  • To prevent fraud, abuse, and misuse, including via Cloudflare Turnstile.
  • To analyze aggregate usage and improve the product.
  • To communicate service notices, security alerts, and (with consent) updates.
  • To comply with legal obligations.

4. Legal Bases for Processing (GDPR Article 6)

  • Performance of a contract — to deliver the service you request.
  • Legitimate interests — to secure, improve, and operate the service.
  • Consent — where required, for optional processing and communications.
  • Legal obligation — to comply with applicable law.

5. AI Processing Disclosure

Chat content, search prompts, and itinerary inputs are sent to Google's Gemini / Agent Development Kit (ADK) for processing. Per Google's enterprise terms applicable to our use, this content is not used to train Google's general-purpose models. Processing is transient and limited to fulfilling your request. AI outputs are suggestions only and should be verified by you before booking.

6. Sharing & Sub-processors

We share personal information only with vetted sub-processors necessary to operate the service:

  • Supabase — authentication, database, and file storage.
  • Google (Gemini, ADK, Maps, sign-in) — AI processing, mapping, and account authentication.
  • Stripe — payments and subscription billing.
  • Cloudflare Turnstile — anti-abuse / CAPTCHA verification.
  • Redis — short-lived session, credit, and rate-limit caches.
  • Email delivery provider — transactional and security email.
  • Hosting provider — application and database hosting.

We do not sell or rent your personal information.

7. International Data Transfers

Some sub-processors are located outside your country of residence (including the United States). Where applicable, we rely on Standard Contractual Clauses (SCCs), adequacy decisions, or other lawful transfer mechanisms to protect your data.

8. Data Retention

  • Account data is retained while your account is active and for a limited period after closure to satisfy legal and accounting obligations.
  • Chat transcripts and itineraries follow your in-app deletion controls.
  • Operational logs are retained for up to 90 days.
  • Anonymous session and credit data expires automatically after the configured TTL (default 24 hours).
  • Encrypted backups are rotated on a routine schedule.

9. Data Security

We use TLS for data in transit and encryption at rest via Supabase. Passwords are hashed by Supabase Auth. Payment processing occurs within Stripe's PCI-DSS environment. Access to production systems is restricted, logged, and reviewed. Cloudflare Turnstile mitigates automated abuse. No system is perfectly secure; we cannot guarantee absolute security but commit to industry-standard practices.

10. Your Rights

If you are in the EU/EEA, UK, or Switzerland (GDPR / UK GDPR), you have the right to:

  • Access your personal data and request a copy.
  • Rectify inaccurate or incomplete data.
  • Request erasure ("right to be forgotten").
  • Restrict or object to processing.
  • Data portability.
  • Withdraw consent at any time, without affecting prior lawful processing.
  • Lodge a complaint with your local supervisory authority.

If you are a California resident (CCPA / CPRA), you have the right to:

  • Know what personal information we collect, use, disclose, and (where applicable) share.
  • Request deletion of your personal information.
  • Correct inaccurate personal information.
  • Opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined under CPRA.
  • Limit the use of sensitive personal information.
  • Non-discrimination for exercising your rights.

To exercise any of these rights, email info@justtravel.io. We will verify your identity before responding and will reply within the timeframes required by applicable law.

11. Cookies & Tracking

Just Travel uses three categories of cookies and local-storage entries:

  • Essential — required for the service to function (authentication session, CSRF protection, Cloudflare Turnstile, anonymous session/credit identifiers). These cannot be disabled.
  • Functional — remembers preferences such as theme or last-selected currency. Off by default.
  • Analytics — anonymous, aggregated usage events sent to our backend to help us improve the product. Off by default.

Your consent choice is stored in browser localStorage under the key jt_cookie_consent_v1 (this storage entry is itself essential). You can change your preferences at any time using the Cookie preferences link in the site footer. We do not use third-party advertising or marketing trackers.

12. Children's Privacy

Just Travel is not directed to children under 16 (or under 13 where applicable under COPPA) and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us so we can delete it.

13. Automated Decision-Making

Just Travel uses AI to suggest travel options, itineraries, and prices. These are recommendations, not automated decisions producing legal or similarly significant effects. You retain full control over whether to accept, modify, or reject any suggestion before booking.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced in-app or by email and the effective date above will be updated. Continued use of Just Travel after changes take effect constitutes acceptance of the updated policy.

15. Contact

Data Sense
689 West Building Pracha Chuen Rd, Bangkok, 10800, Thailand
Email: info@justtravel.io