TravelSync — Privacy Notice
- Version:
- [0.1 — closed beta]
- Effective date:
- 1 October 2026
- Last updated:
- 24 September 2026
1.Who we are and how to contact us
1.1TravelSync (the web app and progressive web app at travelsync.cloud, the "Service") is operated by Forvosync Ltd, trading as TravelSync, a company registered in England and Wales (company number 16960226) with its registered office at 167-169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom (the "Company", "we", "us"). We are the controller of the personal data described in this notice.
1.2Privacy questions and requests: privacy@travelsync.cloud. We have not appointed a statutory data protection officer (UK GDPR Article 37 does not require one for our processing); Mariia Ivenina, Director (privacy@travelsync.cloud), is the person responsible for data protection.
1.3We are registered with the Information Commissioner's Office (ICO) under registration number ZC224374.
2.Who this notice covers
2.1This notice applies to people who create an account on, or use, the Service during our closed beta, and to people who contact us. It does not cover the websites or services of third parties that we link to (for example, booking partners), which have their own privacy notices.
2.2The Service is for adults only. You must be 18 or older to create an account. We do not knowingly collect personal data from anyone under 18; if you believe we have done so, contact us and we will delete it.
3.What personal data we collect
3.1Account data: your email address (which is also your login identifier), a salted bcrypt hash of your password if you set one — we never store the password itself — the time you signed up, and a random account identifier. You can also log in without a password using an emailed single-use login link ("magic link").
3.2Trip data: the trips and itineraries you save — destination, travel dates, interests and preferences, and any free-text notes you type. Free-text notes may contain anything you choose to write; see section 3.6.
3.3Usage and device data: IP address, browser and device type, pages and features used, approximate location derived from IP (country/city), timestamps, and product-analytics events (which buttons you click, which features you use). Analytics data is pseudonymised — see section 5.3.
3.4Technical and security data: server logs, error reports (which may include the URL you were on, your browser details and a pseudonymous user ID) and login metadata (when a login link was sent, opened and expired; when a password sign-in was attempted and whether it succeeded).
3.5Communications: emails you send us, including feedback and support requests, and our replies.
3.6Please do not enter special category data (for example health, religion, sexual orientation or ethnicity) in free-text notes or interests unless it is genuinely needed for your itinerary. If you do, we treat it as being provided with your explicit consent (UK GDPR Article 9(2)(a)) for the sole purpose of generating your itinerary, and you can delete it at any time by editing or deleting the trip.
3.7We do not collect payment data in the beta. If we introduce paid subscriptions, payments will be handled by a payment processor and this notice will be updated first.
4.Where the data comes from
4.1Almost all data comes directly from you. Usage, device and technical data is generated automatically when you use the Service. We do not buy data about you or enrich your profile from third-party sources.
5.Why we use your data and our lawful basis
UK GDPR requires us to have a lawful basis for each use of your personal data. The table below sets out each purpose, the data used and the basis we rely on.
| Purpose | Data used | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| PurposeCreating and running your account; checking your password or sending a magic-link login email; letting you log in | Data usedAccount data (including the password hash); login metadata | Lawful basis (UK GDPR Art. 6)Contract (Art. 6(1)(b)) — necessary to provide the Service you have signed up for |
| PurposeGenerating, saving, editing and displaying itineraries, including sending your trip inputs to our AI provider and looking up places | Data usedTrip data; account identifier | Lawful basis (UK GDPR Art. 6)Contract (Art. 6(1)(b)) |
| PurposeSending service emails (login links, important changes to the Service or these terms, security alerts) | Data usedAccount data | Lawful basis (UK GDPR Art. 6)Contract (Art. 6(1)(b)); for security alerts also legitimate interests (Art. 6(1)(f)) |
| PurposeKeeping the Service secure: preventing abuse, rate-limiting, detecting fraud and unauthorised access, debugging errors | Data usedUsage, device and technical data | Lawful basis (UK GDPR Art. 6)Legitimate interests (Art. 6(1)(f)) — see 5.2 |
| PurposeProduct analytics: understanding how the beta is used so we can fix and improve it | Data usedPseudonymised usage data (PostHog) | Lawful basis (UK GDPR Art. 6)Consent (Art. 6(1)(a)) via the cookie banner [DECISION: see 5.3] |
| PurposeAsking beta users for feedback and telling them about beta updates | Data usedEmail address | Lawful basis (UK GDPR Art. 6)Legitimate interests (Art. 6(1)(f)) for closed-beta participants who asked to join — you can opt out of any such email at any time |
| PurposeMarketing emails (newsletters, offers) — not sent in beta | Data usedEmail address | Lawful basis (UK GDPR Art. 6)Consent (Art. 6(1)(a)); withdraw at any time via the unsubscribe link |
| PurposeComplying with legal obligations (e.g. responding to lawful requests, accounting records) | Data usedAny relevant data | Lawful basis (UK GDPR Art. 6)Legal obligation (Art. 6(1)(c)) |
| PurposeEstablishing, exercising or defending legal claims | Data usedAny relevant data | Lawful basis (UK GDPR Art. 6)Legitimate interests (Art. 6(1)(f)) |
5.2Balancing note for legitimate interests. Where we rely on legitimate interests we have assessed that: (a) the interest (secure, working, reliable software; understanding beta usage) is real and lawful; (b) the processing is necessary — we cannot run or debug a web service without logs and error reports; and (c) the impact on you is low: the data is technical, retained briefly (section 8), pseudonymised where practical, not used to profile you, and you would reasonably expect it from an online service. You can object at any time (section 9). Our assessment is recorded internally and available on request.
5.3Analytics — founder decision. [DECISION: Option A (default in this draft) — analytics run only after you accept analytics cookies in the banner (consent; PECR reg. 6). Option B — run PostHog in cookieless/anonymous mode with no device storage and rely on legitimate interests; this avoids a consent banner but loses cross-session user analysis. Option C — if the Data (Use and Access) Act 2025 statistical-cookies exemption is in force at launch, use it with a clear opt-out. Counsel to confirm which option and the commencement status of the DUAA cookie provisions.]
5.4We do not sell your personal data and do not use it for advertising.
6.AI-generated content and automated decisions
6.1Itineraries are generated by a large language model (Anthropic Claude) from the inputs you give us. The AI output is a suggestion, may be inaccurate or out of date, and is labelled as AI-generated in the Service. We do not use AI to make decisions that have legal or similarly significant effects on you (UK GDPR Article 22 does not apply). No human reviews individual itineraries before you see them.
6.2Under our contract with Anthropic your inputs and the generated itineraries are not used to train Anthropic's models. [Confirm against the current Anthropic Commercial Terms / Data Processing Addendum and whether zero-data-retention is enabled on our API account.]
8.How long we keep your data
| Data | Retention (proposed — [confirm]) | Why |
|---|---|---|
| DataAccount data | Retention (proposed — [confirm])Until you delete your account, then [30 days] in a soft-deleted state, then permanently erased | WhyAllows accidental-deletion recovery; then no further need |
| DataPassword hash | Retention (proposed — [confirm])While your account exists; deleted with the account (same [30-day] tail); replaced when you change your password | WhyLogging you in |
| DataTrip data and itineraries | Retention (proposed — [confirm])While your account exists; deleted with the account (same [30-day] tail) | WhyCore Service data |
| DataServer, access and security logs | Retention (proposed — [confirm])[90 days] | WhySecurity investigation and debugging |
| DataError reports (Sentry) | Retention (proposed — [confirm])[90 days] | WhyDebugging |
| DataProduct analytics (PostHog) | Retention (proposed — [confirm])[12 months], then deleted or fully anonymised | WhyTrend analysis across product versions |
| DataMagic-link tokens | Retention (proposed — [confirm])Expire after [15 minutes]; metadata kept [90 days] with logs | WhySecurity |
| DataSupport emails | Retention (proposed — [confirm])[24 months] after the case closes | WhyFollow-up and dispute handling |
| DataEncrypted backups | Retention (proposed — [confirm])Rolling [35 days]; deleted data drops out of backups within that period | WhyDisaster recovery |
| DataInactive accounts | Retention (proposed — [confirm])[DECISION: delete after 24 months of inactivity, after a warning email] | WhyData minimisation |
We may keep data for longer where the law requires it (for example tax records) or to establish, exercise or defend legal claims, in which case we restrict its use to that purpose.
9.Your rights
9.1Under UK GDPR you have the right to: access the personal data we hold about you and receive a copy; rectify inaccurate data; erase your data ("right to be forgotten"); restrict processing; data portability (receive the data you gave us in a machine-readable format — the Service lets you export your trips as [JSON/PDF]); object to processing based on legitimate interests, and to direct marketing at any time; and withdraw consent at any time where we rely on consent, without affecting processing before withdrawal.
9.2To exercise a right, email privacy@travelsync.cloud from the email address on your account, or use the in-app account settings (delete account, export data). We respond within one month, extendable by two further months for complex requests (we will tell you if so). There is normally no fee. We may ask you to confirm your identity — usually by sending a link to your registered email.
9.3You have the right to complain to the ICO: ico.org.uk/make-a-complaint, or 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would appreciate the chance to address your concern first, but you can go to the ICO at any time. [If the Data (Use and Access) Act 2025 complaints-procedure duty is in force: we will acknowledge your complaint within 30 days and respond without undue delay.]
9.4If you live in the EEA, you may also have rights under the EU GDPR and may complain to your local supervisory authority.
10.Security
10.1We use HTTPS/TLS for all traffic, encryption at rest for databases and backups, passwords stored only as salted bcrypt hashes (never in plain text), short-lived single-use login links, access controls and logging, and least-privilege access for the small team. No system is perfectly secure; if we discover a breach that is likely to put your rights at risk we will inform you and the ICO as the law requires (within 72 hours to the ICO where the breach is notifiable).
10.2Your password and your email inbox are the keys to your account. Choose a password you do not use elsewhere, keep both secure, and tell us at once at privacy@travelsync.cloud if you think your password or a login link has been misused.
11.International transfers
11.1Your data is stored in Ireland (EU), which the UK Government has found to provide adequate protection. Some processors (section 7) process data in the United States. For those transfers we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (or the UK IDTA) and, where the processor is certified, the UK Extension to the EU–US Data Privacy Framework ("UK–US Data Bridge"). Copies of the relevant clauses are available on request.
13.Changes to this notice
13.1We will update this notice as the Service develops — in particular before launching paid subscriptions, marketing emails or affiliate links. We will post the new version with a new effective date and, for material changes, email account holders at least [14 days] in advance. Continued use after the effective date means the new version applies, but it never reduces your statutory rights.