Privacy Policy
Last updated: October 2026
This policy explains who is responsible for your personal data at Travl, what we collect, which services receive it, where it is kept and for how long, and how you can use your rights.
Who is responsible
TRAVL AS (organisation number 928 882 624, Storgata 117, 3182 Horten, Norway) is the data controller for the personal data Travl processes. Questions and requests about your data: support@travl.no.
When you book, the airline and the hotel receive the booking details they need and use them under their own privacy policies.
Information we collect
We collect the following personal data:
- Account: your email address and password, or your Google sign-in.
- To book: the booker's name, date of birth, email address, phone number and address.
- For each traveller: name, date of birth and, if you give one, an email address. Gender and passport details only when the airline requires them (see Passport details below).
- When you plan: what you type in the chat, your searches and the travel preferences you save. If you rate a reply in the chat, we save that reply and your message.
- Payment: you enter your card in Stripe's card field and it goes directly to Stripe — Travl never sees your card number.
- Split payment: when a booking is split between several payers, we store each payer’s name and e-mail address (typed on their payment page), their share, and the reference of the reservation on their card — until the booking is completed or cancelled, then with the booking as above.
How we use your information
- To provide and improve our travel planning services
- To process bookings and payments
- To personalize recommendations and AI-generated plans
- To communicate important service-related updates
Who receives your data
These services process your data for Travl or receive it to deliver your trip. We never sell your personal data.
- Supabase
Receives: Your account and login, profile, travel preferences, saved travellers, price alerts, rated chat replies and bookings.
Why: Travl's database and login. The data is stored in the EU, in Ireland.
- Stripe
Receives: Your card details (entered directly with Stripe), the amount, a booking reference and the destination.
Why: Card payments. The amount is first reserved on your card and charged when we book; if the booking fails, the reservation is released or the charge refunded.
- Amadeus
Receives: Your searches (places, dates, number of travellers). When you book: each traveller's name, date of birth and any email given; gender and passport details when the airline requires them; the booker's email address, phone number and address.
Why: Flight and hotel search and booking. Amadeus passes the booking on to the airline and the hotel.
- The airline
Receives: The flight booking, through Amadeus: the travellers' names, dates of birth and any emails given, gender and passport details when required, and the booker's contact details.
Why: To issue your tickets and operate your flight.
- The hotel
Receives: The hotel booking, through Amadeus: the guests' names (with Mr/Ms when the gender is known), the booker's email address and phone number, and any bed request.
Why: To reserve your room.
- Anthropic (Claude)
Receives: What you type in the trip-planning chat and the trip details it plans from. Only if you scan your passport: the photo of the passport page.
Why: AI trip planning, and reading the passport page into the form for you. Travl does not store the photo.
- Resend
Receives: Your name, email address and booking details in the emails we send you (booking confirmation, receipt, travel reminders, price alerts, password reset). Co-travellers who gave an email get the booking confirmation.
Why: Sending email.
Receives: Only if you sign in with Google: Google confirms who you are and gives us your name and email address.
Why: Signing in.
- Vercel
Receives: Every request to Travl, including your IP address.
Why: Hosting: runs the Travl website and servers. Our server functions run in the EU, in Ireland, next to the database; Vercel's network delivers the pages from the location nearest you.
Maps, places, hotel photos and events: we send Google Maps Platform and Ticketmaster only place and hotel names, cities, coordinates and dates — and, for events, the favourite artists or genres you have saved, as search words. Not your name or contact details.
Some content loads in your browser directly from other services — photos (Unsplash), logos (logo.dev, Kiwi.com), maps (OpenStreetMap, unpkg.com), weather (Open-Meteo) and the card field (Stripe) — so these services see your IP address, as with any website. Our cookie policy says where each one is used.
Passport details
- We ask for passport details only when the airline requires them for your route, and only after your card has been authorized.
- They are sent to the airline through Amadeus when we book, and are not stored with your booking at Travl.
- They are kept in your account only if you choose to save the traveller. Saved travellers stay until you delete them under Profile in your account, or ask us to.
- If you scan your passport, the photo of the passport page is sent to Anthropic to read the details into the form. Travl does not store the photo.
The AI chat
- What you type in the chat is sent to Anthropic, whose AI model Claude writes the answers. Anthropic processes it under its commercial terms and data processing terms.
- Travl does not save the conversation in its database. It is kept in our server’s memory while you chat and forgotten after 6 hours without use.
- Your browser keeps only the conversation’s id, so the chat can carry on where you left off. It is removed when you sign out.
- If you rate a reply (thumbs up or down), we save it in our database together with your message and the trip details the chat had gathered so far, to improve the chat. When you're signed in, it is linked to your account: it's in “Download my data” and deleted when you delete your account. A rating made while signed out isn't linked to anyone — write to support@travl.no if you want it deleted.
What we keep, where, and for how long
Your account and bookings are kept in Travl's database at Supabase; carts and your planned trip only in your own browser. Stripe, Amadeus, the airline and the hotel keep their own records of payments and bookings under their own privacy policies.
- Bookings you started but did not pay for
Where: Travl's database (Supabase)
How long: Deleted automatically within 48 hours: a daily job removes them once they are 24 hours old. Any hold on your card for them is released.
- Passport details for a booking
Where: Not at Travl — sent to the airline through Amadeus
How long: Not stored with the booking. Kept in your account only if you save the traveller.
- Paid bookings
Where: Travl's database (Supabase)
How long: As long as you have your account. If you delete it, they are kept for our bookkeeping, without names, dates of birth or e-mail addresses.
- Account, profile, preferences, saved travellers and price alerts
Where: Travl's database (Supabase)
How long: Until you delete your account or ask us to delete them.
- Chat replies you rated, with your message
Where: Travl's database (Supabase)
How long: Until you delete your account (ratings made while signed in) or ask us to delete them.
- A trip you shared with “Share trip”: destination, dates, flights, hotel and price — never names, passports, contact details or payment
Where: Travl's database (Supabase)
How long: 30 days, or until you stop sharing (on the trip, its link page or your account page); with your account if you delete it. Anyone with the link can see it until then.
- The chat conversation
Where: Travl’s server memory — not the database
How long: Forgotten after 6 hours without use.
- Carts (the flight and hotel you chose, with prices)
Where: Your browser
How long: 24 hours
- Your planned trip and search
Where: Your browser
How long: 7 days
- Imported traveller lists
Where: Your browser
How long: 24 hours
You can delete the trip from your browser at any time on the results and checkout pages.
What Travl keeps in your browser, and for how long, is listed in our cookie policy. Signing out removes the trip, the search history and the other personal data from the browser; on a shared computer, sign out when you’re done or use a private window.
Your rights
You can see the personal data we hold about you, have it corrected or deleted, and take it with you in a file (data portability). Much of this you can do yourself, under Account → Security:
- “Download my data”: everything stored with your account — profile, preferences, saved travellers, bookings, price alerts and flight watches — in one file (JSON) you can keep or take to another service.
- “Delete account”: deletes your account and the personal data stored with it — profile, preferences, saved travellers, price alerts and flight watches — and signs you out everywhere. Bookings you started but never paid for are deleted, and any amount reserved on your card is released. Paid bookings are kept for our bookkeeping — amount, booking reference and dates — but without names, dates of birth or e-mail addresses.
- “Sign out of all devices”: ends your login on every phone, tablet and computer.
Requests about your data — any of the above, or anything else — can also be sent to support@travl.no or through our contact page. We answer within one month.
You can also complain to a data protection authority — in Norway, Datatilsynet.
Contact: support@travl.no