iVaCay plans and books travel with you. To do that we need some information about you and your trips. This policy explains what we collect, why, who we share it with, and the choices you have. We never sell your personal information.
1. Who we are
iVaCay LLC (“iVaCay”, “we”, “us”) operates the iVaCay mobile app and the website at ivacay.co. Questions about this policy go to combinedsun@ivacay.co.
2. What we collect
Account. Your name, email address, username, password (stored as a salted hash) and, if you add them, a profile photo, bio, country and phone number.
Trip details you give Kaya. Destinations, dates, budgets, party size, travel style, lodging preferences, home airport and the messages you exchange with Kaya, our AI concierge. Voice input is converted to text on your device by the operating system; we receive the text, not the audio.
Bookings. Traveler names, dates of birth and passport or ID details required by airlines, hotels and experience providers; booking references; receipts. Payment card details are entered directly into Stripe's secure form and never touch our servers.
Journals and community content. Photos, videos, captions, comments, ratings and travel-buddy connections you choose to post. You control who sees each journal entry (everyone, buddies only, or only you).
Travel buddies and invites. Buddy requests, blocks and reports you make, and invite links you create. If you opt in to Find friends from contacts, your phone hashes your contacts' numbers on the device (SHA-256 of the international format) and sends only the hashes; we match them against users who also opted in and never receive names or raw numbers.
Meet me there. If you turn this on in Settings, we use your date of birth to confirm you are 18 or over, and the destination and approximate dates of your upcoming booked trips to find another opted-in traveler landing around the same time. When Kaya has a match, the other traveler sees only your first name, up to four preference tags from your Travel Graph, whether you arrive the same day and an overlap score; they never see your surname, username, photo, exact dates, or anything about your flight or hotel, until you both say yes. If only one of you says yes, nothing is shared and the other traveler is never told a match existed. Turning this off removes you from matching immediately.
Crew. A crew you start or join, its membership and the messages posted in its thread, visible to the other members of that crew for as long as the crew exists. If you turn on Nearby for a crew, while its trip is on we store your location rounded to about a kilometre; every other opted-in member sees only your first name and a rough distance ("about 2 km away"), never your exact coordinates and never anyone's location once the trip ends. A location ping is replaced by your next one and is deleted automatically after 30 minutes, when you turn Nearby off, or when the trip ends, whichever comes first.
Device and usage. Device model, OS version, app version, language, time zone, IP address, crash reports and which screens you use, to keep the app working and secure. Location is used only while you allow it, for nearby places and Discover; you can turn it off in Settings at any time.
Searching on ivacay.co. The search lanes and Smart search on our website run under a temporary guest profile created in your browser session (no name or email). It holds only what you searched and what Kaya proposed, is deleted after 7 days, and is merged into your account only if you choose "Continue in iVaCay" and sign in.
Deferred invite links. When you tap an invite link on ivacay.co before installing the app, we store the invite code for 24 hours together with a coarse fingerprint (a hashed IP address, platform, time zone and language) so the app can pick the invite up after installation. It is deleted once claimed or after 24 hours.
A flight you bring in yourself. If you already booked a flight elsewhere and bring it into iVaCay by forwarding the confirmation email, uploading a screenshot or PDF, or typing it in, we read the airline, flight number, airports, times, dates, traveler names and confirmation code. The confirmation code is encrypted; only its last two characters are ever shown to you. iVaCay never books, sells, changes or cancels this flight, only reads it to plan the rest of your trip around it. Travel buddies matched through Meet me there see only the arrival day from a flight you bring in, never the airline, flight number or time.
Collections. Browsing one of our curated collections (viewing it, tapping its "Bring my flight" banner) and Kaya's suggestion of a collection in chat being accepted or skipped are recorded against your account so we can tell which collections are useful. This stays inside iVaCay; it is never sold or shared with anyone.
3. How we use it
- To plan and book your trips, show live prices and availability, and keep your itinerary, references and receipts in one place.
- To let Kaya remember your preferences and past trips so her suggestions improve (“How Kaya sees you” in your profile shows exactly what she has inferred, and you can correct or delete it).
- To process payments, prevent fraud and send transactional messages (booking confirmations, changes flagged by Trip Guardian, security notices).
- To operate community features: journals, comments, travel buddies, invite links, reports and blocks.
- To keep the service secure, debug problems and understand which features are used.
- To comply with law and enforce our Terms.
We do not use your content to train third-party AI models. Kaya's responses are generated with a third-party large-language-model provider under a contract that prohibits training on your data.
4. Who we share it with
- Travel suppliers that fulfill your bookings: airlines, hotels, transfer and experience providers and their booking platforms (for example Duffel and Hotelbeds). They receive only what the booking requires.
- Stripe, our payment processor, for payments, refunds, Travel Wallet credit and guide payouts (Stripe Connect).
- Local guides you book with receive your name, party size and the details needed to run the experience.
- Other users see what you choose to make visible: your public profile, public journal entries, and buddies-only content if you are buddies.
- Service providers that host our infrastructure, deliver email, provide AI responses and crash reporting, bound by confidentiality and data-processing terms.
- Authorities when the law requires it, or to protect the safety of our users and the public.
5. Retention
Account and trip data stay for as long as you have an account. Booking and payment records are kept for the period tax and travel regulations require (typically 7 years). Deferred-invite records live 24 hours. Reports about content are kept while an investigation is open and for 12 months after. When you delete your account we remove or anonymize your personal information within 30 days, except records we must keep by law.
6. Your choices and rights
- Access, correct, export or delete your data from Settings in the app or by emailing us. Deleting your account is available in Settings → Account.
- Location, contacts, camera and microphone permissions are controlled by your device settings and can be revoked at any time.
- Marketing email is opt-in; every message has an unsubscribe link. Transactional email about bookings cannot be switched off while a booking is active.
- Agent Authority lets you decide how much Kaya may do on her own; by default she asks before anything is booked.
- If you are in the EEA, the UK, California or another region with data-protection law, you may have additional rights (objection, restriction, portability, non-discrimination). Write to us and we will respond within 30 days. You may also lodge a complaint with your local supervisory authority.
7. Security
Data travels over TLS. Passwords are hashed. Access to production systems is limited to staff who need it. No system is perfectly secure; if we learn of a breach affecting you we will notify you as the law requires.
8. Children
iVaCay is for adults 18 and over. We do not knowingly collect information from children under 13 (or under 16 where that is the local threshold). If you believe a child has created an account, email us and we will delete it.
9. International transfers
We are based in the United States and our providers operate globally. Where data leaves your region we rely on recognized safeguards such as standard contractual clauses.
10. Changes
We will post updates here and, for material changes, tell you in the app or by email before they take effect. The date at the top is the version in force.
11. Text messages (SMS)
You can plan and book a trip by texting Kaya (Text Kaya by iVaCay). This section covers those text messages.
What we collect. Your mobile number, and the trip details you send: where you want to go, your dates, how many people are traveling and your budget. If you ask Kaya for a booking link, we also keep the quote she sent and your number with that booking request, because the lodge needs a contact phone to confirm your stay. On the booking page you type each traveler's name and the payer's email; those are kept with the booking like any other iVaCay booking.
What we do not keep. We do not store the text of your messages. We keep only the trip details Kaya reads from them. Your conversation is stored under a coded key made from your number, not the number itself. Kaya never asks for, and never keeps, card numbers, passport numbers or ID numbers sent by text. If you send one, she tells you not to, and nothing from that message is saved. We do not download photos sent by text.
Why. To answer your questions, quote a trip, send you a secure booking link and tell you a booking's status when you ask. We do not send marketing texts.
How long we keep it. Your conversation (the trip details and the last quote) is deleted automatically 7 days after your last message. A booking request you asked for, with your number, stays with our booking records for the period travel and tax rules require, like every iVaCay booking. If you text STOP, we keep a coded record that your number opted out (not the number itself), for as long as needed to honor it.
Who handles it. Our messaging provider (Twilio) and mobile carriers carry the messages. They process them only to deliver them, under their own terms.
Opting out. Reply STOP at any time and we stop texting that number. Reply START to opt back in, or HELP for help.
We do not sell or share your mobile number or text message consent with third parties or affiliates for marketing purposes.
12. Contact
iVaCay LLC · combinedsun@ivacay.co