Skip to content

    Privacy Policy

    Last updated: March 30, 2026

    1. Who We Are

    OlaTravel ("we", "us", "our") is an AI-powered travel discovery and creator marketplace platform. We are the data controller responsible for processing your personal data. Full provider identification (legal name, address, and registration details) is published in our Impressum. For privacy-related inquiries, contact us at privacy@olatravel.com.

    2. Data We Collect

    We collect and process the following categories of personal data:

    • Account data: Email address, display name, password (hashed), account type (traveler/creator).
    • Chat conversations: Messages you send to our AI travel assistant and the AI's responses.
    • Itineraries: Travel plans generated from your conversations.
    • Creator profile data: Name, bio, specialties, website URL, social media links (for creator accounts).
    • Usage data: Pages visited, features used, credits consumed.
    • Technical data: IP address, browser type, device information, collected via essential cookies for security and functionality.

    3. How We Use Your Data

    PurposeLawful Basis (GDPR Art. 6)
    Provide your account and servicesContract (Art. 6(1)(b))
    Process chat queries via AI (core service)Contract (Art. 6(1)(b))
    Store conversation historyLegitimate interest (Art. 6(1)(f))
    Display creator profilesContract (creators) / Legitimate interest (users)
    Essential cookies (login, security)Legitimate interest (Art. 6(1)(f))
    Analytics (if enabled)Consent (Art. 6(1)(a))

    4. AI Processing Disclosure

    Our travel assistant is powered by artificial intelligence (AI). When you use the chat feature, your messages are sent to our AI provider (Google Generative AI) for processing — this is required to answer your question and is part of the service you request. Your chat data is not used to train AI models. We maintain a Data Processing Agreement with our AI provider that includes Standard Contractual Clauses for data protection. If you prefer your messages not to be processed by AI, simply don't use the chat feature; you can delete stored conversations at any time, and you can contact privacy@olatravel.com with any request about your data.

    5. Data Sharing & Recipients

    We share your data with the following categories of recipients, all under appropriate data processing agreements:

    • Supabase Inc. — Database hosting and authentication (data stored in EU region).
    • Google (Generative AI) — AI processing of chat conversations.
    • Vercel Inc. — Website hosting and edge function execution.

    Where data is transferred outside the EU/EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission as the appropriate safeguard.

    6. Data Retention

    • Account data: Retained while your account is active. Deleted within 30 days of account deletion.
    • Chat conversations: Retained for 12 months, then automatically deleted. You may delete conversations at any time.
    • Itineraries: Retained while your account is active. You may delete individual itineraries at any time.
    • Creator profiles: Retained while the creator account is active and publicly visible.

    7. Your Rights

    Under the GDPR, you have the following rights regarding your personal data:

    • Access — Request a copy of all personal data we hold about you.
    • Rectification — Correct inaccurate data via your account settings or by contacting us.
    • Erasure — Request deletion of your account and all associated data.
    • Restrict processing — Request that we limit how we use your data.
    • Data portability — Receive your data in a machine-readable format (JSON).
    • Object — Object to processing based on legitimate interest.
    • Withdraw consent — Withdraw any consent you have given, at any time.

    To exercise any of these rights, contact privacy@olatravel.com. We will respond within 30 days.

    8. Cookies

    We use strictly necessary cookies for authentication and security. We do not currently use analytics or marketing cookies. If we introduce non-essential cookies in the future, we will obtain your prior consent via a cookie banner. For details, see our cookie preferences accessible from the website footer.

    9. Automated Decision-Making

    Our AI assistant provides travel recommendations based on your queries. These recommendations are informational only and do not constitute automated decision-making that produces legal or similarly significant effects. The AI does not make decisions about pricing, access, or eligibility that affect you.

    10. Complaints

    If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local supervisory authority. A list of EU/EEA data protection authorities is available at edpb.europa.eu.

    11. Changes to This Policy

    We may update this privacy policy from time to time. We will notify you of significant changes via email or a prominent notice on our website.