Privacy Policy

Last updated: October 2026

GoTravels is a service operated by Integradox LLC, a Florida limited liability company, United States (“GoTravels”, “we”), which is responsible for the data described here. GoTravels is a trade name (fictitious name) of Integradox LLC, registered in Florida. For any question about this policy or your data, write to us through the contact form.

1. Data we collect

• Account: name, email, language and password (stored as a secure hash; never in plain text). If you sign in with Google, Google gives us your name, your email and an identifier of your Google account; we never receive your Google password or any other data from that account. If you sign in with Apple (iPhone app), Apple gives us an identifier of your account, your email (or, if you choose “Hide My Email”, an Apple relay address that forwards to your real email) and your name if you choose to share it; we never receive your Apple password.
• Content you create: the trips you save (and whether you make them public), the messages you write to the AI assistant to adjust a trip, and the experiences you publish on the blog, with their photo.
• Service usage: itinerary searches (destination, dates, preferences), daily usage counters, IP address and technical data from your browser or phone.
• Mobile app: a random installation identifier (not your phone's advertising ID), the app version and language.
• Website statistics: pages visited, with the IP address stored hashed and the approximate country derived from it.
• Payments: if you buy a paid plan, Stripe processes the payment. We keep the payment record (amount, date, status), never your card details.
• Invitations: if you invite someone or join with an invitation code, we keep who invited whom, the date and an encrypted identifier of the installation or browser, to grant the “Invite friends” rewards and prevent abuse. It is deleted when the account is deleted.
• Messages: what you send us through the contact form.

2. How we use it

• To provide the service: generate and adjust itineraries, save your trips and preferences, and show the content you choose to publish.
• To enforce per-plan usage limits and prevent abuse or fraud.
• To process payments and manage subscriptions.
• To reply to you and send transactional email (account verification, password reset).
• To improve the service with aggregate metrics.

3. Who we share it with

We do not sell your data. We share the minimum necessary with providers that power the service:

• AI providers: receive your search text (destination, dates, preferences) and, if you adjust a trip with the assistant, your messages and the itinerary being adjusted. Never your name or email.
• Map, photo and geolocation providers: receive the necessary search terms (for example, the city name).
• Google: if you use “Continue with Google”, to verify your identity.
• Apple: if you use “Sign in with Apple” in the iPhone app, to verify your identity and, if you hide your email, to forward our emails to you. When you delete your account we ask Apple to revoke GoTravels’ access.
• Stripe: if you buy a paid plan, to process the payment.
• Hosting and email: the infrastructure the service runs on and sends email from.

Some of these providers are located outside your country (for example, in the United States) and process data under their own security safeguards.

Maps. When you open a map on the website, your browser loads the map images directly from the OpenStreetMap Foundation (United Kingdom), which receives your IP address and basic browser data, like any site you visit (their policy). The same happens in the app when an itinerary shows a map: the phone loads the images directly from the OpenStreetMap Foundation, which receives the phone's IP address and basic app data.

Photos, places and exchange rates. Our server requests photos (Pexels, Pixabay, Wikimedia Commons), place suggestions (Geoapify, LocationIQ) and exchange rates; those services receive the place name, not your IP or personal details.

Public content: trips you mark as public and experiences published on the blog can be seen by anyone, with your name as the author.

4. Cookies

We use our own cookies: the session cookie (sign-in, security and language) and a quota cookie for visitors without an account (180 days). If you arrive through an invitation link, we keep the code in a cookie (gt_ref, 30 days) to apply it when you create your account, together with a random identifier of your browser (gt_refdev, 30 days) that prevents invitation abuse. In the app, the blog view keeps the authors you hid in a cookie (gt_hidden). The theme you choose is saved in your browser's storage. We count visits without cookies: we combine your IP address and browser with a value that changes every day, so no one can be followed from one day to the next. No advertising cookies. On sign-in screens, the “Continue with Google” button loads a Google service, which may use its own cookies under Google's privacy policy.

5. Mobile app

• It uses the same account and data as the website.
• Your session, preferences (theme, language, search style) and recent destinations are stored encrypted in the phone's secure storage and are removed when you uninstall the app (on iPhone, the system keeps them encrypted until you reinstall it, and the app deletes them when it opens).
• So you can see your trips offline, the app keeps a copy of your saved trips on the phone, in its private storage. It is refreshed when you are online and removed when you sign out, delete your account or uninstall the app.
• It shows no ads and uses no third-party analytics or tracking. It does not access your location, contacts or photos.
• Before your first search, the app tells you which AI providers receive what you write and asks for your permission. Your answer stays on the phone.
• In the United States and wherever the law requires it, the app asks the store (Google Play or Apple) for your age range only to keep people under 18 from using it. Only the result (whether you are under 18 or not) stays on the phone, and it is not sent to our servers.
• If you report content or hide a community author, we keep the report (with the reported text) and the list of hidden authors, linked to your account or, without one, to the installation identifier.

6. Retention

We keep account data while your account is active. Daily usage counters are deleted after 7 days and in-progress app searches after 48 hours. If you delete your account, it is erased immediately together with your trips, your posts and their content, except payment records, which are kept without personal data for accounting obligations. Server backups may hold deleted data for a limited time until they are rotated.

7. Your rights

You can view and correct your data in My account, and delete your account at any time on the website (My account → Delete my account) or in the app (Account → Delete my account). For any other request, write to us through the contact form; we will handle it within a reasonable time.

8. Security

We apply reasonable measures: password hashing, restricted access and secure connections (the app only communicates over HTTPS). No system is 100% secure; we recommend using a unique password.

9. Minors

The service is not directed at children under 18 and we do not knowingly collect data from minors.

10. Changes

Any changes to this policy will be posted here. Material changes will be announced by reasonable means.

11. Users in the EEA, the UK and Switzerland

If you live in the European Economic Area, the United Kingdom or Switzerland, the following also applies:

• Legal bases. We process your data to perform our contract with you (your account, your trips, generating itineraries with AI, signing in with Google or Apple, and service emails); for our legitimate interests (usage limits and abuse prevention, security and technical logs, cookieless visit statistics, handling content reports and preventing invitation fraud); to meet legal obligations (payment records and requests from authorities); and with your consent when the app asks before using AI, which you can withdraw at any time by writing to us.
• Your rights. Besides viewing, correcting and deleting your data, you can ask for a copy in a commonly used format (portability), restrict its use, object to it and withdraw your consent. We reply within one month at most, which can be extended by two more months if the request is complex (we will tell you). You can complain to the data protection authority of your country: in the UK, the ICO; in Switzerland, the FDPIC. In the UK you can also complain to us first.
• International transfers. GoTravels operates from the United States, so your data is processed there and, depending on the provider, in other countries. To transfer it out of the EEA, the UK or Switzerland we rely on the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) when the provider is certified or, otherwise, on the European Commission's standard contractual clauses. We require our providers to protect your data at least as this policy does. You can ask us for a copy of these safeguards.
• AI providers. For people in the EEA, the UK and Switzerland we only use AI providers that do not train on the text they receive.
• Automated decisions. We make no decisions with legal or similarly significant effects based solely on automated processing.

12. AI providers and training

To build itineraries and answer in the chat we use external AI providers, which may be located in the United States, the European Union or other countries. Which ones we use changes with your country, your plan and each provider's availability, so we don't list them here: the app shows you the ones that apply to you before your first search and asks you again if a new one is added. Some of them, on their free plans, may use the text they receive to improve their models, and a person might review it. That is why the app asks for your permission first, and we recommend not including personal details in your searches or in the chat.

13. Retention periods

• Website visit statistics: 180 days.
• Technical logs and AI call logs: 90 days.
• Contact messages and content reports: 2 years, or until you delete your account.
• Invitations: as long as your account exists.
• Authors you hid in the app: until you show them again or delete your account; a mute ends after 30 days.

14. Privacy contact

Controller: Integradox LLC (Florida, United States). Postal address: see address. For any request about your data, write to us through the contact form; a person handles it, in English or Spanish.