What we collect
- Account: name, email, hashed password (bcrypt), preferred currency / locale.
- Booking: traveller details required by suppliers (name, email, phone) plus the booking reference and supplier confirmation.
- Payment: handled entirely by Stripe — we receive a payment reference, never card numbers.
- Usage: search queries, look-to-book telemetry (per supplier, never per user), basic device + locale info.
Why we collect it
- To make and manage your bookings.
- To improve search relevance and the AI concierge.
- To prevent fraud and abuse.
- To send the booking confirmations and (if you opt in) the deal newsletter.
Who we share it with
- Suppliers needed to fulfil your booking (airline, hotel, transfer operator).
- Stripe for payment processing.
- Resend for transactional email (confirmations, alerts).
- Anthropic for AI-drafted support replies (the messages you send through our support form). Anthropic processes per their data terms; messages are never used to train Claude.
We do not sell your data. Period.
Your rights
Access, correction, deletion, portability, withdrawal of consent — email hello@app3x.com with the request and we'll act within 30 days.
Retention
Booking data: kept for 7 years for tax/audit reasons. Account data: kept while your account is active, deleted on request. Search telemetry: aggregated, no personal identifiers retained.