Privacy Policy

Naverix Travel LLC is the data controller for the personal information described here — we decide what is collected and why. Our registered office is the United Arab Emirates. For anything about your data, including the requests described in section 9, write to privacy@naverix.travel.

We collect only what the Platform needs in order to work:

• Account details — your name, email address, a hashed version of your password, your language and your avatar if you add one.
• Travel Profile — your interests, pace, budget, dietary needs, the purpose of your journeys, and optionally your nationality or passport country, country of residence and first language.
• Itineraries and saved content — the journeys you generate, places you save, trip logs, reviews and any photos you upload.
• Purchases — what you bought from us and when. Card numbers never reach us: Stripe and PayPal collect those on their own pages.
• Messages — concierge conversations, messages to other members, voice notes and your emails to support.
• Documents you choose to upload — passport pages for traveller manifests, booking confirmations and corporate documents.
• Device and usage data — IP address, browser and device type, pages viewed, and your approximate location if you allow it in your browser.
• Cookies and local storage — listed individually in our Cookie Policy.

Some of what you may tell us is sensitive: faith-related travel, health, dietary and accessibility needs, and the passport details you upload for a traveller manifest. These answers are always optional. We ask for your explicit consent before we use them, we use them only to plan the journey you asked for, and you can remove them at any time from your Travel Profile — or ask us to, at privacy@naverix.travel. Passport images uploaded for a manifest are read to extract the traveller's details and are not stored afterwards.

We use your information for the following purposes, each on the legal basis given:

• To provide the Platform — create and run your account, generate itineraries, deliver what you buy and answer your support messages. Basis: performance of our contract with you.
• To keep the Platform secure — authenticate sign-ins, apply rate limits, detect abuse and prevent fraud. Basis: our legitimate interest in protecting the service and its members.
• To improve the Platform — understand which features are used and fix what breaks. Basis: your consent for analytics cookies, and our legitimate interest in aggregate, non-identifying measurement.
• To personalise what we recommend — see section 5. Basis: performance of our contract, and your explicit consent for any sensitive answers.
• To send marketing emails — see section 12. Basis: your consent.
• To meet legal obligations — tax and accounting records, and responding to lawful requests from authorities. Basis: compliance with a legal obligation.

Your Travel Profile holds what you tell us about how you like to travel — your interests, pace, budget, dietary needs and the purpose of your journeys. We use it only to personalise your itineraries and recommendations on Naverix. We do not sell it. We do not share it with Providers unless you book with them and the booking needs it. Some answers, such as faith-related travel or dietary and health needs, are optional and sensitive; we ask for your permission before using them, and you can remove them at any time in your Travel Profile. To generate itineraries and to run the concierge assistant we send the relevant parts of your request to AI providers acting for us. Depending on the feature, that can include your first name, your Travel Profile answers, the trip you are planning, documents you upload and, in the concierge, your approximate location and the conversation itself. You can limit this by leaving optional fields blank, by not using the concierge, and by declining location access in your browser.

We do not sell your personal information. We share it only with the following, and only as far as each needs:

• Hosting and infrastructure — Railway (our application servers and database), Vercel (the website) and Cloudflare R2 (files you upload).
• Payments — Stripe and PayPal. Each receives your name and email address to create a customer record and take payment.
• Email delivery — Resend, which sends our transactional and notification emails and therefore sees the recipient address and message.
• AI providers — Anthropic and Google, and ElevenLabs when you record a voice note. They process the content described in section 5 on our instructions.
• Maps and places — Mapbox and Google Maps, Places and Directions. Map and autocomplete requests go directly from your browser, so those providers see your IP address.
• Analytics — Google Analytics, and only if you accept analytics cookies.
• Travel search partners — when you search flights, hotels, cars or events we send the search criteria only (dates, destination, number of travellers). We do not send your name, email or account identifier.
• Providers and Booking Partners — only when you book, and only what the booking needs. Where we sell to you directly, our eSIM supplier receives the plan ordered and no personal data about you at all.
• Authorities — when we are legally required to disclose, or need to establish or defend a legal claim.

We are based in the United Arab Emirates, and the providers listed in section 6 operate in the European Union, the United Kingdom and the United States. That means your information is transferred across borders. Where we transfer personal data out of the EEA or the UK we rely on the European Commission's Standard Contractual Clauses, or the UK Addendum, together with the data processing terms each provider offers, and we only use providers that offer them. You can ask us for details of the safeguards that apply to a particular transfer at privacy@naverix.travel.

We keep your account and the content in it for as long as your account is open. When you delete your account from Settings, we immediately deactivate it and scrub your email address so it can be re-registered. Be aware that, today, this does not yet erase everything: itineraries, posts, messages and other content you created are retained after deletion so that support can restore an account closed by mistake. If you want that content erased as well, ask us at privacy@naverix.travel and we will do it. We keep records we are legally required to retain — payment and tax records in particular — for as long as the law requires, regardless of account deletion.

Depending on where you live, you have some or all of the following rights. Write to privacy@naverix.travel to use any of them, and we will respond within one month.

• Access — ask for a copy of the personal information we hold about you.
• Correction — have inaccurate or incomplete information corrected. Most of it you can edit yourself in your profile.
• Deletion — ask us to erase your personal information, subject to records we must keep by law.
• Objection — object to processing we carry out on the basis of legitimate interests.
• Portability — receive the information you gave us in a machine-readable form, or have it sent to another provider.
• Withdraw consent — at any time, for analytics cookies, marketing emails or any sensitive Travel Profile answers. Withdrawing consent does not undo processing already carried out.
• Complain — to the data protection authority where you live or where you believe the problem occurred. We would rather you came to us first.

Naverix is not for people under 18. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us their information, write to privacy@naverix.travel and we will delete it. Where you add a travel companion who is a child, you are responsible for having the right to share their details with us.

Passwords are stored only as salted hashes, never in a form we can read. Traffic between your browser and our servers is encrypted in transit, sessions use short-lived access tokens with separate refresh tokens you can revoke individually from Settings, and access to production data is limited to the people who need it. No system is perfectly secure, so please use a password you do not use anywhere else, and tell us at support@naverix.travel if you think your account has been accessed without permission.

Transactional emails — receipts, password resets, itinerary updates and replies from support — are part of the service and are not marketing; we send them while you have an account. Marketing emails, including our newsletter, are only sent if you asked for them, and every one carries a one-click unsubscribe link. Unsubscribing from marketing never affects the transactional emails you need.

We may update this policy as the Platform changes. If a change materially affects how we use your information, we will tell you by email and in your Naverix Workspace before it takes effect. The date at the top of this page always shows when it was last revised. This policy is published in several languages; the English version is the operative one if a translation differs from it.