iVaCay plans and books travel with you. To do that we need some information about you and your trips. This policy explains what we collect, why, who we share it with, and the choices you have. We never sell your personal information.
1. Who we are
iVaCay LLC (“iVaCay”, “we”, “us”) operates the iVaCay mobile app and the website at ivacay.co. Questions about this policy go to combinedsun@ivacay.co.
2. What we collect
Account. Your name, email address, username, password (stored as a salted hash) and, if you add them, a profile photo, bio, country and phone number.
Trip details you give Kaya. Destinations, dates, budgets, party size, travel style, lodging preferences, home airport and the messages you exchange with Kaya, our AI concierge. Voice input is converted to text on your device by the operating system; we receive the text, not the audio.
Bookings. Traveler names, dates of birth and passport or ID details required by airlines, hotels and experience providers; booking references; receipts. Payment card details are entered directly into Stripe's secure form and never touch our servers.
Journals and community content. Photos, videos, captions, comments, ratings and travel-buddy connections you choose to post. You control who sees each journal entry (everyone, buddies only, or only you).
Travel buddies and invites. Buddy requests, blocks and reports you make, and invite links you create. If you opt in to Find friends from contacts, your phone hashes your contacts' numbers on the device (SHA-256 of the international format) and sends only the hashes; we match them against users who also opted in and never receive names or raw numbers.
Device and usage. Device model, OS version, app version, language, time zone, IP address, crash reports and which screens you use, to keep the app working and secure. Location is used only while you allow it, for nearby places and Discover; you can turn it off in Settings at any time.
Searching on ivacay.co. The search lanes and Smart search on our website run under a temporary guest profile created in your browser session (no name or email). It holds only what you searched and what Kaya proposed, is deleted after 7 days, and is merged into your account only if you choose "Continue in iVaCay" and sign in.
Deferred invite links. When you tap an invite link on ivacay.co before installing the app, we store the invite code for 24 hours together with a coarse fingerprint (a hashed IP address, platform, time zone and language) so the app can pick the invite up after installation. It is deleted once claimed or after 24 hours.
3. How we use it
- To plan and book your trips, show live prices and availability, and keep your itinerary, references and receipts in one place.
- To let Kaya remember your preferences and past trips so her suggestions improve (“How Kaya sees you” in your profile shows exactly what she has inferred, and you can correct or delete it).
- To process payments, prevent fraud and send transactional messages (booking confirmations, changes flagged by Trip Guardian, security notices).
- To operate community features: journals, comments, travel buddies, invite links, reports and blocks.
- To keep the service secure, debug problems and understand which features are used.
- To comply with law and enforce our Terms.
We do not use your content to train third-party AI models. Kaya's responses are generated with a third-party large-language-model provider under a contract that prohibits training on your data.
4. Who we share it with
- Travel suppliers that fulfil your bookings: airlines, hotels, transfer and experience providers and their booking platforms (for example Duffel and Hotelbeds). They receive only what the booking requires.
- Stripe, our payment processor, for payments, refunds, Travel Wallet credit and guide payouts (Stripe Connect).
- Local guides you book with receive your name, party size and the details needed to run the experience.
- Other users see what you choose to make visible: your public profile, public journal entries, and buddies-only content if you are buddies.
- Service providers that host our infrastructure, deliver email, provide AI responses and crash reporting, bound by confidentiality and data-processing terms.
- Authorities when the law requires it, or to protect the safety of our users and the public.
5. Retention
Account and trip data stay for as long as you have an account. Booking and payment records are kept for the period tax and travel regulations require (typically 7 years). Deferred-invite records live 24 hours. Reports about content are kept while an investigation is open and for 12 months after. When you delete your account we remove or anonymise your personal information within 30 days, except records we must keep by law.
6. Your choices and rights
- Access, correct, export or delete your data from Settings in the app or by emailing us. Deleting your account is available in Settings → Account.
- Location, contacts, camera and microphone permissions are controlled by your device settings and can be revoked at any time.
- Marketing email is opt-in; every message has an unsubscribe link. Transactional email about bookings cannot be switched off while a booking is active.
- Agent Authority lets you decide how much Kaya may do on her own; by default she asks before anything is booked.
- If you are in the EEA, the UK, California or another region with data-protection law, you may have additional rights (objection, restriction, portability, non-discrimination). Write to us and we will respond within 30 days. You may also lodge a complaint with your local supervisory authority.
7. Security
Data travels over TLS. Passwords are hashed. Access to production systems is limited to staff who need it. No system is perfectly secure; if we learn of a breach affecting you we will notify you as the law requires.
8. Children
iVaCay is for adults 18 and over. We do not knowingly collect information from children under 13 (or under 16 where that is the local threshold). If you believe a child has created an account, email us and we will delete it.
9. International transfers
We are based in the United States and our providers operate globally. Where data leaves your region we rely on recognised safeguards such as standard contractual clauses.
10. Changes
We will post updates here and, for material changes, tell you in the app or by email before they take effect. The date at the top is the version in force.
11. Contact
iVaCay LLC · combinedsun@ivacay.co