Your journey is your private narrative.

Data collection

We collect information you provide: account credentials (via Supabase Auth), profile details, trip itineraries, City Pulse saves, collaboration invites, comments, concierge messages, and billing identifiers linked to Stripe.

We also collect technical data: device/browser type, approximate region from IP, product events (when analytics consent is granted), and security logs for abuse prevention.

Guest and anonymous users may store trips locally in the browser until they create an account; migrating a local trip sends that payload to our servers when you check out or sign up.

Usage & analytics

We use data to operate the workspace, authenticate users, process subscriptions, deliver exports, run collaboration features, and improve reliability.

Analytics (conversion funnels, error rates) runs only after you opt in via the cookie banner. We use pseudonymous identifiers—not your email—for product metrics.

External partners

Maps, place photos, and routing may use Google APIs. Affiliate booking links send you to partner sites that set their own cookies when you click through.

We do not sell your personal data. Partners process purchases under their own privacy policies.

Transfers & subprocessors

We process data primarily in the European Economic Area. Some subprocessors are located in the United States or other countries. Where required, we rely on appropriate safeguards such as EU Standard Contractual Clauses or adequacy decisions.

Subprocessors at launch (categories): authentication and database (Supabase), payments (Stripe), maps and places (Google), AI inference (OpenAI), transactional email (Resend), and rate limiting/cache (Upstash).

We maintain a list of subprocessors for counsel review and will update this section when vendors change materially.

AI & automation

Copilot, itinerary generation, and City Pulse enrichment may send trip context to AI providers to produce drafts. We minimize what is sent and do not use your trips to train public models unless we explicitly say otherwise in product UI.

You can edit or delete AI-assisted content in your workspace. Automated outputs may be logged briefly for abuse prevention and quality monitoring.

Cookies

The table below lists cookies and similar storage we use or that may be set when you use TravelNestHub. Analytics storage is off by default until you consent in the cookie banner.

What we don't do

We do not sell personal information. We do not use your trip content for third-party advertising profiles.

Affiliate links may attribute a referral to us when you complete a partner purchase; that is separate from selling your data.

Retention

We retain personal data while your account is active and as needed to provide the service, meet legal obligations, resolve disputes, and enforce our agreements.

After an approved account deletion, we remove app-owned data listed under “Your choices”. Some records must or may be retained:

• Stripe payment and invoicing records (tax and commercial law; retained by Stripe as processor).
• Minimized erasure and security audit logs (pseudonymized identifiers, limited retention for abuse prevention).
• Completed erasure request metadata anonymized (reason redacted; subject IDs replaced with tombstones).