Privacy policy

Yalaa is a trip-planning service run by [Company legal name] ([Registered address, City, Country]) — “we” in this policy. It is available at https://yalaa.app and as an app for iOS and Android. This policy explains what we collect, why, who we share it with, how long we keep it, and the choices you have. Questions and requests: privacy@yalaa.app.

1. What we collect

Account

Your email address, a display name and profile picture (when you sign in with Google), how you signed in, when you last opened Yalaa, and the settings you choose. Sign-in is handled by Firebase Authentication (Google); we never see your password.

Travel profile

What you tell Concierge or enter in Settings so suggestions fit you: home city and airport, who usually travels with you (adults, children and their ages), budget, cabin and seat preferences, favourite airlines and hotel brands, loyalty programmes, interests, passport countries, pace, notes and an always-pack list.

Dietary needs and accessibility needs are kept only after you switch on “Remember dietary and accessibility needs” in your travel profile. Concierge won’t save them from a conversation before then. Switching it off deletes them.

Trips

Everything in a trip: its name, dates, party size, destinations, planned stops, votes, to-do lists, and your conversation with Concierge (your messages and its replies).

Bookings and documents

Booking confirmations you upload, paste or forward by email — the extracted details (flights, hotels, tickets, cars, trains: providers, confirmation numbers, times, places, traveller names and seats) and the original files (screenshots, PDFs, boarding passes). Forwarded emails are kept as an audit line (sender, subject, what happened) and, when a vendor template could not read them, their text is kept for up to 90 days as a sample used to improve the templates (see “Improving parsing” below).

Device and usage

Your time zone (so dates are right), and product analytics events: an app open, a trip created, a booking added, a chat message sent, a share, an AI call — each with small labels (which feature, which provider), never message text, email bodies or booking details. If you turn on flight alerts, the push subscription of that device. On the website, Vercel Web Analytics counts page views and page speed: the page, your country, browser and device type, with no cookies, no identifier that follows you between visits, and no IP address kept.

What we don’t collect

We don’t use advertising or tracking SDKs, or cookies other than the sign-in session and your time zone; the only analytics are our own events above and Vercel’s cookieless page counts. We don’t collect your precise location. When you ask Concierge for something “near me”, the device’s position is rounded to about a kilometre before it is sent, used for that one answer, and not stored; maps in the app show your planned places, not you.

2. Why we use it

• To run the service: sign you in, store your trips, show them on your devices, and share them with people you invite.
• To plan with you: your trip, profile and bookings are sent to an AI model (Anthropic’s Claude) to answer you, propose places, organise days and read confirmations.
• To find real places and photos (Google Places, Unsplash, Wikipedia), check flight status (AeroDataBox or AviationStack) and prices (Amadeus), when those features are enabled.
• To route forwarded emails to the right account and trip.
• To keep the service safe and working, and to understand which features are used (aggregate analytics).

Where the GDPR or UK GDPR applies, our legal bases are performance of our contract with you (the service itself), our legitimate interests (security, product analytics, improving parsing) and your consent (flight alerts, optional integrations you switch on, and your dietary and accessibility needs, which are special-category data). You can withdraw consent at any time in Settings; withdrawing it for dietary and accessibility needs deletes them.

3. Who we share it with

These providers process data on our behalf, only to provide their part of the service:

People you invite to a trip see that trip — its stops, bookings (including traveller names and confirmation numbers), chat and to-do list. A trip you share with a public link is readable by anyone with the link, without confirmation numbers, seats or documents; you can turn the link off at any time.

We don’t sell personal data and don’t share it with advertisers. We disclose data if the law requires it.

4. Improving parsing

When a forwarded confirmation can’t be read by one of our deterministic vendor templates, the AI reads it and the email’s text is kept as a sample for up to 90 days so a template can be written and checked against real documents. Samples are visible only to our administrators and are deleted with your account.

5. How long we keep it

• Account, profile, trips, bookings and documents: until you delete them or your account.
• Forwarded-email audit lines: until you delete the trip or your account. Parsing samples: 90 days.
• Analytics events: deleted with your account.
• Sessions: 30 days, or until you sign out (“Sign out other devices” ends them everywhere).
• Server logs at our hosting provider: their standard short retention.

6. Your choices and rights

• Download your data: Settings → Your data → Download my data gives you everything as one file.
• Delete your account: Settings → Your data → Delete account removes trips you own (with documents and chats), your bookings, forwarded emails and samples, analytics events, your profile and your sign-in. Trips you were invited to stay with their owners; you are removed from them.
• Edit your travel profile, forwarding addresses and always-pack list in Settings; delete individual bookings, documents and trips from the trip itself.
• Flight alerts and the public share link can be turned off where you turned them on.

Depending on where you live you may also have rights to access, correct, restrict or object to processing, to data portability, and to complain to a supervisory authority. Write to privacy@yalaa.app — we answer within 30 days.

7. Security

Data is encrypted in transit (TLS) and at rest by our providers. The database and file storage are never reachable from your browser or the app directly: every request goes through our server, which checks that you are signed in and a member of the trip involved. Sessions are signed tokens; sign-in secrets are held by Firebase.

8. International transfers

Our providers operate in the United States and the European Union. Where data leaves the EEA or UK, we rely on the providers’ standard contractual clauses and, for US providers, the EU–US Data Privacy Framework where they are certified.

9. Children

Yalaa is for adults planning travel. You may note children’s ages in your travel profile so Concierge can plan for them; we don’t knowingly create accounts for anyone under 16.

10. Changes

We’ll post changes here with a new date, and tell you in the app when they matter.

11. Contact

[Company legal name], [Registered address, City, Country]. Privacy: privacy@yalaa.app. Support: support@yalaa.app.