Privacy Policy

The data controller is Velantro Travel Ltd, registered in England & Wales, trading as Velantro Travel. For any privacy question or to exercise your rights, email privacy@velantro.co.uk.

• Account data — email address, name (if you give one), and your password in hashed form, handled by our authentication provider.
• Trip data — the searches and journey briefs you enter, the itineraries we generate for you, and your saved trips.
• Preferences — language, currency and cookie choices, stored in your browser.
• Analytics — only with your consent: an event name (for example "itinerary created"), the page path and a small non-identifying property bag. We do not store IP addresses, visitor IDs or device fingerprints.
• Subscription data — if you buy Velantro Pro, payment is processed by Stripe. We never see or store your card details.

• Contract (Art. 6(1)(b)) — creating your account, generating and storing your itineraries, and providing Velantro Pro.
• Legitimate interests (Art. 6(1)(f)) — keeping the service secure, preventing abuse, and maintaining aggregate service-quality records. We balance this against your rights and keep the data minimal.
• Consent (Art. 6(1)(a), plus PECR reg. 6) — analytics and affiliate tracking, and any marketing email. You can withdraw consent at any time via "Cookie preferences" in the footer, with no effect on the lawfulness of processing before withdrawal.
• Legal obligation (Art. 6(1)(c)) — tax and accounting records for subscription payments.

We use a small number of processors to run the service: our cloud database and authentication provider (Supabase), our AI provider (Anthropic) for itinerary generation, travel data providers (such as Duffel and GetYourGuide) for live availability, Google Maps for route display, and Stripe for Pro subscriptions. When you click an outbound partner link, that partner becomes an independent controller under its own privacy policy. We do not sell your personal data.

Some processors operate outside the UK. Where they do, transfers rely on UK adequacy regulations or the International Data Transfer Addendum to the EU Standard Contractual Clauses.

• Account and profile — for as long as your account exists, then deleted within 30 days of you closing it.
• Trips and itineraries — 24 months after they were created, or sooner if you delete them.
• Analytics events — 14 months, then deleted.
• Payment and tax records — 6 years, as UK law requires.
• Cookie preferences — 12 months, then we ask again.

Under UK GDPR you have the right to:

• be informed about how your data is used (this policy);
• access a copy of your data;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to processing, including profiling;
• data portability in a machine-readable format;
• withdraw consent at any time.

Email privacy@velantro.co.uk and we will respond within one month.

If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office: ico.org.uk/make-a-complaint, helpline 0303 123 1113, or Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Data is encrypted in transit, access to production data is restricted, and passwords are stored hashed. Velantro is not intended for children under 16, and we do not knowingly collect their data.