Last updated: 01/11/2026 v0.1

Touravel.AI helps you discover attractions and plan your travels using AI-powered tools. This policy explains what personal information we collect, how we use and share it, how long we keep it and the choices you have when using our website at https://touravel.ai.

1 Who we are and how to contact us

Touravel.AI is operated by MICS365 LIMITED, a company registered in ENGLAND/UNITED KINGDOM under company number 10531291, with its registered office at 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. In this policy, “we”, “us” and “our” refer to that company.

We are the controller of the personal information described in this policy. This means we decide why and how that information is used.

For privacy questions, requests or complaints, contact us at [email protected], write to the address above, or use https://touravel.ai/contact-us/. Please mark correspondence “Privacy”.

2 Information we collect

The information we collect depends on which features you use. We obtain information directly from you, automatically through your use of the website, and from providers involved in delivering the services you request.

Account information. When you register, we collect your email address, account identifier and password information used for authentication. We also hold any optional profile or country information you provide. Required fields: email address, Country, Street Address. Optional fields: First name, Last name, Company name, Town, Postcode, Phone. Passwords are stored only as secure hashes.

Travel planning information. This can include your destination, travel dates and arrival or departure times, selected attractions, interests, preferred pace, transport choices, accommodation location or starting point, and information you enter into planning forms. We also process the recommendations and itineraries generated for you. We hold saved plans and their association with your account when you use the save feature.

Support payments. If you choose to support Touravel.AI financially, we process information needed to record and manage the payment. This may include your email, billing country, any billing details collected at checkout, payment amount, currency, date, status and transaction reference. Section 5 explains payment processing in more detail.

Messages. When you contact us, we receive your contact details, message and any attachments you choose to send. We may retain our replies to help resolve your enquiry.

Technical information. Our website and service providers may process your IP address, browser and device information, request timestamps, pages requested, and error or security logs to deliver and protect the website. Cookies and similar technologies are described in section 8.

Information from providers. Payment providers send us payment confirmations and related transaction information.

Please provide only information relevant to your request. Do not enter passport numbers, payment-card details or sensitive personal information into AI planning fields or general messages. Avoid identifying other travellers unnecessarily. If you provide another person’s information, make sure you are entitled to do so and make this policy available to them.

3 Why we use information and our lawful bases

We use personal information for the purposes below. The lawful basis explains the legal reason for each use under applicable data protection law.

Providing accounts and requested planning tools. We use account details, travel inputs and generated plans to register and authenticate users, generate recommendations, save and retrieve plans, and send essential service messages. Our basis is performance of our contract with you, or taking steps you request before entering that contract, where the processing is necessary to provide the service.

Managing support payments. We use transaction information to record your contribution, send confirmations and deal with payment enquiries or refunds. Our basis is our legitimate interest in administering voluntary support payments and maintaining accurate records. Where a payment instead relates to a purchase, we rely on performance of the relevant contract. We rely on legal obligation for records required by applicable accounting or tax law.

Answering enquiries. We use correspondence to respond and resolve issues. Our basis is our legitimate interest in providing support; where necessary to fulfil a service contract with you, we rely on that contract.

Protecting and maintaining the website. We use necessary technical and account information to prevent abuse, investigate errors, secure accounts and maintain service reliability. Our basis is our legitimate interest in operating a secure, dependable service. We consider the effect on your rights before relying on legitimate interests.

Where we use optional analytics or send promotional emails on the basis of consent, you can choose whether to participate and withdraw that consent. Essential account and payment messages are separate from promotional emails.

Legal responsibilities and disputes. We use relevant records to comply with applicable legal duties. Where necessary to establish, exercise or defend legal claims, we rely on our legitimate interest in protecting our legal rights, unless a legal obligation applies.

We identify required information at the point of collection. Without information needed for a particular feature, we may be unable to provide that feature, create an account or process a payment. Optional fields may be left blank. Agreeing to this policy is not, by itself, consent to optional processing.

4 How our AI features use your information

Our AI-powered tools help estimate your ideal trip length, suggest an area to stay, provide trip advice and create an itinerary from your selections and preferences.

To generate a response, we send: First Day of Activities, Last Day of Activities, Leave Accommodation At, Return By, Starting Location, Getting Around information to OpenAI API service (AI).  This can include the travel details you submit and relevant context from your planning request. Account identifiers, email addresses, IP addresses, accommodation details or previous requests are not included in the communication with AI.

The provider processes these inputs to generate recommendations that we return to you. We handle the resulting plan as described in this policy, including when you choose to save it.

Prompts and responses are not used for model training; provider retention periods; any abuse monitoring or human review; our own logging and retention.

Our travel recommendations use automated processing to personalise suggestions. They are intended to help you make your own travel choices. We do not use these tools to make solely automated decisions about you that have legal or similarly significant effects.

This policy covers the features currently available on our website. If we introduce microphone, precise device location or other materially different processing, we will explain the new use before it begins and request any consent or device permission required. Permission to use a device feature does not replace our responsibility to explain how the resulting data is handled.

5 Payments

Our travel planning tools are free to use. You may choose to make a voluntary support payment.

Support payments are processed through Stripe.  Payment-card information is entered through the provider’s payment interface. We do not receive or store full card numbers or card security codes on our servers.

We may retain transaction and billing records described in section 2. Card brand, last four digits, payment-method identifiers or other details actually received and retained. These records are different from full payment-card details.

Stripe also processes information for its own payment, security and legal responsibilities, as described in its privacy policy at https://stripe.com/privacy. The role it performs depends on the processing activity.

6 Who we share information with

We share personal information when needed to operate the website, provide a feature you request, administer payments or meet legal obligations. Relevant recipients include:

• Hosting, infrastructure, website-security and backup providers that store or transmit website data and help protect the service.
• AI providers that process the planning inputs described in section 4.
• Payment providers that process support payments and related transactions.
• Email delivery and support providers that deliver account messages, payment confirmations or responses to enquiries.
• Analytics or consent-management providers, where used, subject to the choices explained in section 8.
• Professional advisers, regulators, courts or other authorities where disclosure is necessary and lawful.

Where providers process personal information on our behalf, we require appropriate contractual and security protections. Some providers act as independent controllers for their own processing; their privacy notices explain those activities.

If our business is sold, merged or reorganised, relevant information may be disclosed to advisers and a prospective or actual successor, subject to appropriate confidentiality and data protection safeguards.

We do not sell your personal information or share it for third-party behavioral advertising.

7 Affiliate links and other websites

Touravel.AI may include links to accommodation, attraction-ticket or other travel providers. If you follow an affiliate link and make a qualifying booking, we may receive a commission.

An affiliate link may contain a referral identifier. The destination website may also receive technical information from your browser and use its own cookies or tracking technologies. Touravel.AI does not send any personal or trip information with the referral. We receive identifiable booking information, and name applicable affiliate networks.

When you provide information or make a booking on another provider’s website, that provider’s privacy policy governs its processing. Please read it before supplying information. This policy does not describe another provider’s independent services.

8 Cookies and similar technologies

We use cookies and, where applicable, similar browser technologies to operate website features and remember relevant settings. These technologies can store information on, or read information from, your device.

Some technologies are necessary for a service you request, such as keeping you signed in or maintaining security. Optional technologies can serve other purposes, such as measuring usage or attributing referrals.

Where consent is required, we ask before using the technology. You can refuse optional categories and change or withdraw your choices. Refusing optional technologies does not prevent basic browsing, although features depending on them may be unavailable.

You can also manage cookies through your browser. Blocking necessary cookies may affect sign-in or other requested functions. Browser settings do not replace any choice controls we are required to provide.

9 Where information is processed

Our principal website hosting is in United Kingdom. Providers may process information in all over the Globe.

A transfer is restricted under applicable UK or EEA data protection law, we use an appropriate transfer mechanism.

You can contact us for information about the safeguards relevant to your data and how to obtain a copy. We may redact confidential commercial information while explaining the protection provided.

10 How long we keep information

We keep personal information for the time needed for its stated purpose, taking account of legal requirements, security needs and unresolved disputes. Our retention arrangements are:

• Account and profile information: while the account is active, then 2 years after closure. Inactive accounts are handled under.
• Saved plans: 6 months, including what happens when you delete a plan or close your account.
• Unsaved requests, AI prompts and responses, and application caches: 6 months.
• Provider retention is explained in section 4.
• Payment and accounting records: 6 months.
• Enquiries and correspondence: 6 months after the enquiry is resolved, unless an ongoing dispute requires longer retention.
• Technical, security and email-delivery logs: 6 months with relevant incident records retained for 6 months.
• Consent and marketing-preference records: 2 years. A minimal suppression record may be kept to honour an opt-out.
• Backups: deleted information may remain in protected backups for 2 years before those copies expire or are overwritten.

Where a legal duty or dispute requires longer retention, we retain only the information necessary for that purpose. When information is no longer needed, we delete it or anonymise it so that it no longer identifies you.

11 Keeping information secure

We use technical and organisational measures appropriate to the information and risks involved. Access is limited to those who need it for the purposes described in this policy.

No website or method of transmission can be guaranteed completely secure. Please keep your account credentials confidential and contact us if you suspect unauthorised access. Where a personal data breach occurs, we will notify affected people and regulators when the law requires us to do so.

12 Your rights and choices

Depending on the applicable law and the circumstances, you may have rights to request access to your personal information, correct inaccurate information, ask for deletion, restrict processing, or receive eligible information in a portable format. These rights are subject to applicable conditions and exceptions; for example, some payment records may need to be retained to meet legal obligations.

Your right to object. You may object to processing based on legitimate interests for reasons relating to your situation. We will consider your objection and stop that processing unless we have a lawful overriding reason to continue. You can object to direct marketing at any time, and we will stop using your information for that purpose.

Where we rely on consent, you may withdraw it at any time. This does not affect the lawfulness of processing before withdrawal. Use the relevant settings, an unsubscribe link where available, or contact us using section 1.

To exercise a right, contact us and explain your request. We may ask for information proportionate to the need to verify your identity. We normally respond within one month, subject to the applicable legal rules on timing, clarification and permitted extensions. If an extension or exception applies, we will explain it. Requests are normally free of charge; we will explain any legally permitted fee or refusal.

Deleting your account does not necessarily remove every record immediately. Section 10 explains retention for legal records and backups. You can also ask us about information held by providers acting on our behalf.

13 Children and information about other travellers

Proposed wording if accounts are intended for adults: Our account and support-payment features are intended for people aged 18 or over. Adults planning family travel should use general information such as the number of children and age ranges, where needed, rather than children’s full names or other identifying details.

If you believe a child has provided personal information inappropriately, contact us so that we can investigate and take appropriate action.

14 Complaints

Please contact us using the details in section 1 if you are unhappy with how we handle your information. We will investigate your complaint and explain our response.

You also have the right to complain to the UK Information Commissioner’s Office. Information about making a complaint is available at https://ico.org.uk/make-a-complaint/.

If the EU GDPR applies to our processing of your information, you may also complain to the relevant data protection authority in the EEA, including in the country where you live or work, or where you believe an infringement occurred. You do not need our permission to contact a regulator.

15 Changes to this policy

We may update this policy as our services or legal responsibilities change. We will publish the revised version here and update the date at the top. Where appropriate, we will draw significant changes to your attention through the website or a service message. If a new use requires consent, we will obtain it before starting that processing.