How EzTravel handles personal information.

1. Operator and scope

EzBuyCo operates EzTravel and controls the account, site, and support information described here. Airlines, accommodations, Stripe, Duffel, OpenAI, and company-account administrators may separately control information for their services.

2. Information collected

We collect account and contact details; search destinations, dates, routes, preferences, and text voluntarily submitted to the AI travel manager; browser coordinates when you grant location permission; saved trips and carts; traveler or guest names, dates of birth, phone numbers, and booking details; business identity, team, role, policy, allowance, and spend data; support messages; and technical information such as IP address, user agent, security events, and session identifiers.

When a supplier requires identity documents, checkout may collect passport number, issuing country, and expiration date for that booking. Card numbers and security codes are entered into Stripe-hosted fields and are not received or stored by EzTravel.

3. How information is used

We use information to understand an AI travel-manager request; search and price travel; save selections; create and secure accounts; prevent abuse; request payment authorization; make and support bookings; send operational messages; enforce company travel controls; maintain records; troubleshoot; comply with law; and protect customers, EzTravel, and providers.

4. Sharing and service providers

When you submit the AI travel-manager search, EzTravel sends the search text, local date, timezone, and—when needed for a flight search—the approximate city or airport found from your authorized location to OpenAI so it can convert the request into structured trip-search fields. OpenAI does not receive your browser coordinates and is not used to supply availability or prices. EzTravel does not send account, payment, passport, checkout, or supplier records with that request.

When you grant browser location access, EzTravel sends the coordinates to OpenStreetMap's Nominatim service to identify an approximate city, then uses Duffel to select a nearby airport. EzTravel stores the resolved airport in browser session storage so you are not repeatedly asked during that session; the browser coordinates are not added to your account profile. Booking details are shared with Duffel and the relevant airline, accommodation, or other supplier. Stripe processes payment information. The configured email provider delivers account and booking messages. Hosting, database, monitoring, security, and support vendors may process the minimum information needed to provide their services. Business owners and administrators can see company membership, policy, allowance, and company-attributed booking activity. We may also disclose information when legally required or necessary to protect rights and safety.

EzTravel does not sell personal information for money. If advertising or cross-context behavioral tracking is introduced, this policy and the consent controls must be updated before use.

5. Legal bases and choices

Depending on where you live, processing may be necessary to perform a contract, take requested pre-contract steps, comply with law, protect legitimate interests such as security and fraud prevention, or act with consent. You can choose not to provide optional information, but information required by a supplier may be necessary to complete a booking.

6. Retention

We retain account records while the account is active and as reasonably needed for security, disputes, legal obligations, and support. Checkout contact data is scheduled for deletion after 18 months. Completed webhook and email-delivery records are scheduled for deletion after 90 days. Sensitive traveler, device, and free-text booking payloads are minimized after the supplier attempt. Actual periods may be longer where law, fraud prevention, a dispute, or supplier obligations require it.

7. Security

Controls include encrypted transport in production, restricted cookies, signed and revocable sessions, strong password hashing, rate limits, single-use hashed recovery and invitation tokens, origin checks, security headers, and least-necessary payment data. No system is risk-free. Protect confirmation and recovery links and notify us promptly about suspected unauthorized access.

8. International processing

Travel and technology providers may process information outside your state, province, or country. Those locations can have different privacy laws. Applicable contractual, provider, and legal safeguards should be documented before markets requiring them are enabled.

9. Your privacy requests

Subject to applicable law, you may request access, correction, deletion, portability, restriction, or objection, and may withdraw consent where consent is the basis. Email support@ezbuyco.com. We may verify your identity and may retain information that law permits or requires. You may also complain to your local privacy regulator.

10. Children and changes

EzTravel accounts are for adults age 18 or older. Adults may provide a minor traveler’s details when authorized to do so and when required for a booking. We may update this policy prospectively and will post a new version and effective date. Material changes should be communicated or presented for renewed acceptance where required.