Privacy policy

1. Overview and scope

Explore Beyond AI, Inc., doing business as Tripcreator AI (“Tripcreator AI”, “we”, “us”) provides a business-to-business travel planning platform for tour operators and other custom-travel operators, host agencies and consortia and the travel advisors who work with them, destination marketing organisations, and event organisers. This Privacy Policy explains the categories of personal data we process, the purposes and legal bases for processing, our retention practices, and the rights available to data subjects.

It covers this website, the Partner Hub (the sign-in for travel businesses and the advisors they invite), the planners we run on our customers’ sites, Triage (triage.tripcreator.ai), and MarcoPolo Chat (chat.tripcreator.ai).

This Policy is written to comply with, and is interpreted in light of, the following frameworks where they apply:

• the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the UK GDPR,
• the EU Artificial Intelligence Act (Regulation (EU) 2024/1689, “EU AI Act”), in particular Articles 5 (prohibited practices), 9-11 (data and data governance), and Articles 50 and 52 (transparency obligations for AI systems and general-purpose AI),
• the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (“CCPA / CPRA”), the Virginia Consumer Data Protection Act (“VCDPA”), the Colorado Privacy Act (“CPA”), the Connecticut Data Privacy Act (“CTDPA”), the Utah Consumer Privacy Act (“UCPA”), and successor or comparable US state privacy laws,
• sector-specific US laws where applicable, including the Children’s Online Privacy Protection Act (“COPPA”) and the Federal Trade Commission Act §5 (unfair or deceptive practices),
• the Brazilian Lei Geral de Proteção de Dados (“LGPD”) and Canada’s PIPEDA, for partners and data subjects in those jurisdictions.

2. Our role: controller and processor

For the operator-facing platform, Tripcreator AI typically acts as a data processor under GDPR Article 28 (and a service provider / contractor under CCPA / CPRA): the operator (our customer) determines the purposes and means of processing, and we process traveller data on their documented instructions under a Data Processing Agreement (“DPA”).

Triage. The advisor or agency that forwards an enquiry to Triage decides what to forward and remains the controller of that enquiry. We process it as their processor, to score it and draft a reply for them.

For data we collect about our own customers, prospects, and website visitors, for example contact forms, demo requests, and analytics, Tripcreator AI acts as a data controller under GDPR (and a business under CCPA / CPRA). We are also the controller for travellers who use MarcoPolo Chat at chat.tripcreator.ai directly.

3. Categories of personal data

We process the following categories, only to the extent necessary for the stated purposes:

• Operator account data. Names, work email addresses, organisation, role, and authentication identifiers of authorised users of the Partner Hub, including the advisors a host agency or consortium invites.
• Operator inventory data. The operator’s products (hotels, transfers, experiences, time windows, pricing) ingested via API or file upload. Inventory data may include personal data of the operator’s suppliers. The operator is responsible for ensuring it has a valid legal basis to transmit such data.
• Traveller intent data. Preferences, interactions, and itinerary refinements collected via the embedded planner. This data is transmitted from the operator’s website and is processed under the operator’s privacy notice and lawful basis.
• Forwarded enquiries (Triage). When an advisor forwards an enquiry to their Triage address, we receive the email, including the sender’s name, email address and message. Two AI models read it to score it and draft a reply, and the result is emailed back to the advisor. For the advisor’s digest and account page, Triage stores the label, score, priority, a one-line summary, the channel where the mail shows it, the lead status and the sender’s name. Triage does not store the message itself in its database. Host agency administrators see each advisor’s plan and weekly counts, never their enquiries.
• MarcoPolo Chat. Travellers can make a first plan, and one change of it, without an account. Every plan the chat makes is saved in our database with no name, email or address, so it can be shared and reused. To give each browser one free plan, the chat keeps a random identifier in a first-party cookie (tc_chat_anon, kept for 90 days after the last visit) and stores only a one-way key of it with a count of the plans made. To plan more, the traveller creates a free account with Google, and the plans made in that browser in the day before move to the account. The page chat.tripcreator.ai/privacy clears what is kept for a browser at any time. A traveller who signs in with Google has a profile, saved trips with their most recent messages, and notes the assistant keeps to tailor later plans. A quote request sends the traveller’s name, email, notes and itinerary to our team by email. A flight search sends airports, dates, the number of travellers, children’s ages and the cabin to our flight-data provider, with no names. Voice input uses the browser’s own speech recognition. The browser maker may process the audio, and we receive only the text.
• Website and product telemetry. IP address, device, locale, page-level events, error traces. Used to operate the service and detect abuse. The cookie notice lists what this website keeps in your browser.
• Communications. Email correspondence, demo notes, support tickets.

We do not intentionally collect or process special-category data (GDPR Art. 9) or sensitive personal information (CPRA §1798.140(ae)), and our embedded planner is not designed for use by children under 13 (COPPA) or under 16 (GDPR Art. 8, Member-State default).

4. Purposes and legal bases

For controller processing, we rely on the following GDPR Article 6 legal bases (with corresponding state-law business purposes under CPRA §1798.140(e) and analogues):

• Performance of a contract (Art. 6(1)(b)): providing the Partner Hub, Triage and MarcoPolo Chat, generating itineraries, scoring enquiries for the advisors who forward them, answering quote requests, and enabling integrations.
• Legitimate interests (Art. 6(1)(f)): securing our service, preventing fraud, improving model accuracy and latency on aggregated, de-identified signals. Processing on this basis is subject to a documented balancing test available to supervisory authorities on request.
• Legal obligations (Art. 6(1)(c)): tax, accounting, lawful requests by competent authorities.
• Consent (Art. 6(1)(a)): for marketing communications and optional analytics cookies, withdrawable at any time without affecting prior processing.

5. AI systems, training data and EU AI Act compliance

Tripcreator AI builds and operates AI systems (preference embeddings, graph-attention priors, an inventory-constrained beam search, and a narrative model) that together form a routing intelligence layer. We comply with the transparency and data-governance obligations of the EU AI Act, including:

• Article 50 transparency. Users are informed when they are interacting with an AI system. AI-generated content is identifiable as such where the AI Act requires.
• Article 10 data governance. Training, validation, and test datasets are documented. We retain a model card and data lineage record for each production model.
• Article 5 prohibited practices. We do not use AI for social scoring, exploitation of vulnerabilities, or any practice listed in Article 5.

Operator data is not used to train base or foundation models. Enquiries forwarded to Triage are not used to train any model. An advisor’s own feedback on past verdicts adjusts only that advisor’s future scores. Where we fine-tune a model on aggregated operator data (for example, narrative voice or routing priors), we do so only with contractual authorisation, on a per-operator basis, and the resulting weights are not shared across operators.

Automated decision-making. Itinerary suggestions are not solely-automated decisions producing legal or similarly significant effects within the meaning of GDPR Article 22. Human operators remain the bookers, sellers, and pricing authority. We provide meaningful information about the logic involved on request.

6. International transfers

Tripcreator AI is established in the United States and operates infrastructure in the United States and the European Union. International transfers of personal data are protected by appropriate safeguards under GDPR Chapter V, including:

• the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914), where applicable, with transfer-impact assessments performed in line with EDPB Recommendations 01/2020,
• the EU-US Data Privacy Framework (and its UK and Swiss extensions) for transfers to certified US recipients, and
• equivalent contractual safeguards for transfers from the United Kingdom (UK IDTA / UK Addendum) and Switzerland.

7. Sub-processors and vendors

Our sub-processors include Google Cloud (hosting, databases and AI model services), Resend (email), Stripe (Triage payments), Duffel (flight search in MarcoPolo Chat), Mapbox (maps), Cloudflare (site delivery) and AI providers that screen and score messages. A current list is available on request from privacy@tripcreator.ai and is provided to operators under the DPA. We bind every sub-processor to data-protection terms equivalent to those we accept from operators (GDPR Art. 28(4)), and we provide reasonable notice of changes to allow operators to object.

8. Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, plus a limited statute-of-limitation tail. Default schedules:

9. Your rights

Depending on your residence, you have the right to access, correct, delete, port, restrict, and object to processing of your personal data. In particular:

• EU, UK and Swiss residents: rights under GDPR Articles 12-22, including the right to lodge a complaint with a supervisory authority.
• California residents: rights under CCPA / CPRA, including the right to know, delete, correct, opt out of sale or sharing (we do not sell personal information), limit the use of sensitive personal information, and non-retaliation.
• Virginia, Colorado, Connecticut and Utah residents: equivalent rights under VCDPA / CPA / CTDPA / UCPA, exercisable as set out in those statutes.
• Brazilian residents: rights under Article 18 of LGPD.

To exercise any right, contact privacy@tripcreator.ai. We respond within statutory timeframes (one month under GDPR, and 45 days under CCPA / CPRA). The CCPA / CPRA period is extendable once for cause.

10. Security

We maintain technical and organisational measures appropriate to the risk (GDPR Art. 32), including encryption in transit (TLS 1.2+) and at rest, role-based access control, audit logging, vulnerability management, and incident-response procedures. To report a vulnerability, contact security@tripcreator.ai.

11. Children

Our service is intended for adult professional users (operators) and adult travellers. We do not knowingly collect personal data from children under the COPPA / GDPR thresholds. If we become aware that we have collected such data, we delete it promptly.

12. Changes to this policy

We may update this Policy to reflect changes in our practices or applicable law. Material changes will be notified to operator administrators by email and posted on this page with an updated “last updated” date. The current version date is shown above.

13. Contact

Explore Beyond AI, Inc., Austin, Texas, United States.
Privacy: privacy@tripcreator.ai. Data Protection Officer: dpo@tripcreator.ai. Security: security@tripcreator.ai.