Privacy Policy

Journosa (the “Service”) is a multi-vendor travel planning and booking platform that uses artificial intelligence to help you research, plan, and book trips — including flights, hotels, activities and tours, dining, events, car rentals, ground transportation, travel insurance, and parking — through a single checkout. This Privacy Policy explains what personal information we collect, how we use and share it, and the choices and rights available to you.

This Policy applies to the Journosa website, application, and related services (collectively, the “Service”). It does not apply to the privacy practices of third-party vendors, booking partners, or payment processors, which are governed by their own privacy policies as described in Section 5.

2.1 Information You Provide to Us

• Account information: name, email address, and password or social sign-on credentials, collected and managed through our authentication provider.
• Profile and preference information: accessibility needs, travel interests, persona/preference tags, and other details you provide to help us tailor trip recommendations.
• Trip and booking information: destinations, travel dates, itinerary details, trip inputs (including free-text or conversational descriptions of the trip you want), budget information, and details of bookings made through the Service.
• Collaborator information: if you invite others to plan or view a trip with you, we collect their email address and role/invite status, and their activity on the shared trip.
• Payment information: we do not directly collect or store full payment card numbers. Card and payment details are entered directly into fields hosted by our payment processor and are transmitted to and stored by that processor, not by us. See Section 5.2.
• Communications and support requests: messages you send us through contact forms, support tickets, or reviews and feedback you submit about vendors or your trip.
• Content you create: reviews, ratings, itinerary notes, and shared itinerary links.

2.2 Information Collected Automatically

• Usage data: pages and features you interact with, search and curation queries, session duration, and similar analytics collected through our analytics providers.
• Device and log data: IP address, browser type, operating system, device identifiers, and referring URLs.
• Cookies and similar technologies: used for authentication, preference storage, analytics, and measuring performance of the Service. See Section 8.
• Approximate location: derived from your IP address or, with your permission, device location services, used to localize search results and recommendations.

2.3 Information from Third Parties

• Travel vendors and booking partners (for example, our flight, hotel, activity, dining, event, car rental, ground transportation, travel insurance, and parking partners) may share booking confirmations, status updates, and related transaction details with us so we can display and manage your itinerary.
• Our payment processor shares limited transaction data with us (such as payment status, amount, and a transaction identifier) but not full card details.
• Authentication providers (if you sign in using a social account) share the profile information you authorize them to share.

We use the information described above to:

• Create and maintain your account, and authenticate your access to the Service;
• Generate AI-curated trip recommendations and itineraries based on your inputs and preferences;
• Process, facilitate, and manage bookings with third-party travel vendors on your behalf;
• Process payments and subscription billing through our payment processor;
• Provide customer support and respond to your requests;
• Send transactional communications (booking confirmations, price alerts, schedule changes, weather advisories) and, where you have opted in, marketing communications;
• Personalize the Service, including accessibility accommodations you provide;
• Enable collaborative trip planning and shared itinerary features you choose to use;
• Detect, investigate, and prevent fraud, abuse, and security incidents;
• Analyze and improve the Service, including through aggregated or de-identified analytics;
• Comply with legal obligations and enforce our Terms of Service.

We use Google Vertex AI (Gemini models) to process trip inputs and generate itinerary recommendations. Trip-related inputs you provide (destinations, dates, preferences, and free-text descriptions of your trip) are sent to this AI service in order to generate your recommendations. We do not knowingly send full payment card numbers or government identification numbers to the AI curation service.

We collect and use personal information to perform our contract with you (providing the Service you sign up for), based on your consent (for optional communications and certain cookies), for our legitimate business interests (such as fraud prevention, service improvement, and security), and to comply with legal obligations.

Accessibility and health-adjacent information. If you choose to provide accessibility needs (for example, limited mobility or pacing requirements) to help us tailor recommendations, that information is used solely for that purpose and is not sold or used for advertising targeting. You may add, edit, or delete this information at any time in your profile settings.

5.1 Travel Vendors and Booking Partners

Journosa operates a multi-vendor marketplace. When you book a flight, hotel, activity or tour, dining reservation, event ticket, car rental, ground transportation, travel insurance policy, or parking reservation through the Service, we share the information necessary to complete that booking (such as your name, contact details, travel dates, and relevant preferences) with the applicable vendor. Our current vendor partners include (without limitation) Duffel (flights), Expedia (hotels), Viator (activities and tours), OpenTable (dining), Ticketmaster (events), Rentalcars.com (car rentals), Welcome Pickups (ground transportation), Squaremouth (travel insurance), and SpotHero (parking). Once a booking is made, the vendor’s own privacy policy and terms govern its handling of your information for that booking.

5.2 Payment Processing

Payments are processed by our third-party payment processor (currently Braintree, a PayPal service, operating as a marketplace payment processor; we plan to transition to Adyen for Platforms in a future year). Card data is entered directly into fields hosted by the processor and does not pass through or get stored on our servers. We receive limited transaction metadata (such as payment status and amount) needed to confirm and reconcile your bookings and subscription.

5.3 Service Providers

We share information with vendors who perform services on our behalf, including:

• Authentication and account security services;
• Cloud hosting and infrastructure providers;
• Analytics providers, to help us understand how the Service is used;
• Email and notification delivery providers, to send transactional and, where opted in, marketing messages;
• Customer support ticketing providers;
• The AI/machine learning provider used for itinerary curation.

These providers are contractually restricted from using your information for any purpose other than providing services to us.

5.4 Collaborative and Shared Features

If you invite a collaborator to a trip, that person can see the trip details, budget, and bookings you choose to share on that trip. If you generate a shareable itinerary link, anyone with that link can view a read-only version of the itinerary; shared links do not expose payment information or your account credentials.

5.5 Legal and Safety

We may disclose information if required by law, legal process, or governmental request, or where we believe disclosure is necessary to protect the rights, property, or safety of the Company, our users, vendors, or the public.

5.6 Business Transfers

If we are involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to standard confidentiality protections.

5.7 No Sale of Personal Information

We do not sell your personal information for money. We do not share personal information with third parties for their own cross-context behavioral advertising, except as may occur through standard analytics/advertising cookies described in Section 8, which you can control through your cookie preferences.

We retain personal information for as long as your account is active and as needed to provide the Service, comply with our legal and tax obligations, resolve disputes, and enforce our agreements. Booking-related records may be retained longer where required by financial recordkeeping or vendor-partner obligations. When information is no longer needed, we delete or de-identify it in accordance with our internal data retention practices.

7.1 Access, Correction, and Deletion

You may access and update most of your account and profile information directly within the Service. You may request access to, correction of, or deletion of your personal information by contacting us. We will verify your identity before fulfilling requests involving sensitive account information.

7.2 California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and disclose about you;
• Request deletion of your personal information, subject to certain exceptions;
• Correct inaccurate personal information;
• Opt out of the sale or sharing of personal information (we do not currently sell personal information, as described in Section 5.7);
• Limit the use of sensitive personal information;
• Not receive discriminatory treatment for exercising these rights.

To exercise these rights, contact us. We will respond within the timeframes required by California law.

7.3 Communication Preferences

You can opt out of marketing emails using the unsubscribe link in those messages, and you can manage notification channel and frequency preferences (email, SMS, push) in your account settings. You cannot opt out of transactional messages necessary to operate your account and bookings (such as booking confirmations).

7.4 Do Not Track

Our Service does not currently respond to browser “Do Not Track” signals.

We and our service providers use cookies, local storage, and similar technologies to:

• Keep you signed in and remember your preferences;
• Understand how the Service is used, through analytics tools;
• Measure the effectiveness of marketing and improve the Service.

You can control cookies through your browser settings; disabling certain cookies may limit functionality of the Service.

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and hosting our infrastructure on a major cloud provider’s secured environment. Payment card data is handled through a PCI DSS–compliant hosted payment interface so that card numbers do not pass through our own servers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Journosa is currently designed and offered for users located in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States.

The Service is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If we learn we have collected personal information from a child under 16 without appropriate consent, we will delete it.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated Policy on the Service and updating the “Effective Date” above, and, where required by law, by additional notice (such as email).

If you have questions or requests regarding this Privacy Policy or our data practices, contact us.

Journosa LLC (operating Journosa)

Governing law for this Policy’s interpretation: State of Utah, United States (see Terms of Service for full governing law and dispute resolution terms).