Privacy Policy

1. Introduction

Voyagr Travel Inc. (“Voyagr,” “we,” “our,” or “us”) values your privacy and is committed to handling personal data with the highest standards of transparency, accountability, and compliance. This Privacy Policy provides a detailed explanation of how we collect, use, disclose, and safeguard personal data when you access or use our website and services at https://voyagr.travel (the “Platform”). It also outlines your rights under international data protection frameworks, including the General Data Protection Regulation (GDPR), the California Consumer Privacy Act and California Privacy Rights Act (CCPA/CPRA), Brazil's LGPD, Canada's PIPEDA, Singapore's PDPA, and other applicable global privacy laws.

1.1. Definitions

1.2. Scope of This Policy

This Privacy Policy governs the collection, use, disclosure, and protection of personal information across all interactions with Voyagr and our Platform. It applies to:

• Travel Agents/Advisors — individuals who register for an account, undergo verification, and utilize the Platform's tools and services.
• Travelers (End Customers) — personal and booking-related information entered into the Platform by verified agents/advisors.
• Website Visitors — individuals who browse, interact with, or otherwise access voyagr.travel, whether or not they register for an account.

1.3. Global Reach

The Platform is designed to serve users worldwide, subject to applicable laws and regulations in each jurisdiction. Access is restricted to verified travel agents or advisors who successfully complete our verification process, which may include identity and professional credentials checks.

1.4. Third-Party Integration and Data Handling

Because Voyagr operates as a multi-supplier booking engine, interactions may involve third-party suppliers, payment processors, and service providers. This Privacy Policy applies to information collected and processed directly by Voyagr; the terms and conditions of suppliers or partners may govern certain aspects of cancellations, refunds, or use of traveler data. Users are encouraged to review the privacy policies of relevant third-party providers when booking or integrating services through the Platform.

1.5. Limitations

This Policy does not extend to websites, applications, or services operated by third parties that may be linked to or from the Platform. We disclaim responsibility for the data practices of such external services.

1.6. Acknowledgement

By accessing or using the Platform, all users acknowledge the applicability of this Privacy Policy and consent to the practices described herein, subject to rights granted under global privacy laws such as the GDPR, CCPA, and other applicable regulations.

2. Information Collection

We collect and process different categories of personal and non-personal information depending on the nature of the interaction with our Platform.

2.1. Information Collected from Travel Agents

When registering and using the Platform:

2.2. Information Entered About Travelers (by Verified Agents/Advisors)

Travel agents/advisors may input traveler details necessary to facilitate bookings. This may include:

2.3. Automatically Collected Technical and Usage Information

When users interact with the Platform, we automatically collect data through cookies, logs, and analytics tools.

2.4. Sensitive Data

Voyagr does not intentionally collect sensitive personal data such as health-related information, racial or ethnic origin, political opinions, religious beliefs, genetic or biometric identifiers, sexual orientation, or legal/medical records. Traveler data is strictly limited to the categories necessary for the processing of travel bookings, in accordance with relevant privacy laws.

2.5. Third-Party Sources

In limited circumstances, we may obtain additional information from third-party sources, such as fraud prevention databases, payment processors, or identity verification services, to protect the integrity of the Platform and comply with regulatory obligations.

2.6. Calendar and Scheduling Data

If you choose to connect a calendar account to use our Scheduling features, we access a limited set of calendar data from that account. Section 8 sets out exactly what we access, how we use it, and how to disconnect.

3. Reasons for Data Collection and Processing

We collect and process personal information for the following purposes, in line with applicable privacy and data protection laws:

4. Cookies, Tracking Technologies, and Similar Tools

We use cookies, pixels, scripts, and other tracking technologies to enhance user experience, ensure platform functionality, and support lawful business purposes. These technologies may be deployed directly by Voyagr (first-party) or by trusted partners (third-party).

4.1. Types of Cookies We Use

4.2. Purposes of Using Cookies and Trackers

• Maintain secure authentication and user sessions
• Enable efficient operation of booking features and CRM tools
• Monitor system health, detect errors, and improve navigation
• Conduct statistical research and performance analytics
• Deliver personalized, relevant content and advertisements
• Safeguard against misuse, fraud, or unauthorized activity

4.3. User Choices and Control

• Users may manage or disable cookies at any time via browser settings (e.g., Chrome, Safari, Firefox, Edge).
• Some cookies are essential; disabling them may restrict Platform access.
• Where legally required (e.g., EU/EEA, UK), users will see a cookie consent banner allowing them to accept, reject, or customize cookie preferences.
• Users may exercise opt-out rights for marketing trackers by contacting us at [email protected].

5. Children's Data and Age Restrictions

Voyagr's Platform and services are intended solely for licensed and verified travel professionals. We do not knowingly solicit, collect, or store personal data from children under the age of 16 years (or the minimum age required by applicable law in certain jurisdictions, such as 13 in the United States under COPPA).

5.1. Platform Restrictions

Registration requires verification as a travel agent or advisor; minors are not eligible to create accounts or access services. The Platform is business-oriented, not consumer-facing, and contains no features designed to target children.

5.2. Safeguards

If we become aware that data from a child has been provided (directly or indirectly), we will take immediate steps to delete such information from our systems. Where applicable, we will notify the travel agent or advisor who input the information and remind them of their responsibility to secure lawful consent when entering traveler data.

5.3. Responsibilities of Travel Agents and Advisors

• Agents are prohibited from submitting children's personal data unless strictly necessary for a travel booking (e.g., flights for minors).
• In such cases, agents must obtain lawful parental/guardian consent and remain the data controller for such information. Voyagr will act solely as a processor.
• Any misuse, such as entering children's data without proper authority, may lead to account suspension or termination.

6. Legal Basis for Processing

Voyagr processes personal data strictly in accordance with applicable laws. Under the GDPR (EU/UK), CCPA/CPRA (USA), Brazil's LGPD, and Canada's PIPEDA, we rely on the following lawful bases:

7. Disclosure of Data to Third Parties

We disclose personal data only under controlled and limited circumstances, always ensuring compliance with applicable data protection laws.

7.1. Travel Suppliers

We share traveler information with third-party suppliers who are essential to fulfilling travel services — including airlines, hotels, tour operators, and ground transportation providers. The information disclosed is limited to what is necessary for the supplier to complete the requested booking or service.

7.2. Technology and Service Providers

We rely on trusted third-party vendors to support the technical and operational infrastructure of the platform. These include:

Each provider is contractually bound to process personal data only as necessary to perform services on our behalf and in compliance with applicable privacy standards.

7.3. Regulatory and Legal Authorities

We may disclose personal data when required to do so by law or legal process. This includes responding to lawful requests from courts, regulators, tax authorities, law enforcement agencies, or other government entities. We may also disclose data when necessary to protect our legal rights, investigate fraud, ensure compliance with contractual obligations, or respond to urgent security or safety concerns.

7.4. Restrictions on Data Sharing

We do not sell, rent, or trade personal information under any circumstances.

Any disclosure to third parties is strictly limited to the purposes outlined in this Privacy Policy and is subject to appropriate safeguards, such as contractual obligations and data protection measures.

8. Calendar Connections & Google User Data

Voyagr's Scheduling features let a verified Agent connect a calendar account (Google, Microsoft, or Apple iCloud) so that availability, appointments, and bookings stay in sync. Connecting a calendar is optional, Scheduling is the only part of the Platform that uses it, and every other part of the Platform works without one. We use Nylas as our calendar and scheduling connectivity provider. This section sets out precisely what a connection gives us access to, and it applies in full to information obtained from Google accounts.

8.1. How a Connection Is Established

For Google and Microsoft accounts, connecting a calendar sends you to your provider's own sign-in and consent screen, where you review the access being requested and grant it there. Apple iCloud works differently: you generate an app-specific password in your Apple account and enter it on a form hosted by Nylas, our calendar connectivity provider. In either case Voyagr never sees or stores your provider password.

Voyagr does not hold your provider access tokens. Those are held by Nylas, our calendar connectivity provider, which refreshes them and makes calendar requests on our behalf. What Voyagr stores is a connection record: an identifier for the connection, the email address and provider of the connected account, and whether the connection is still active.

One calendar account may be connected at a time. Connecting a different account replaces the connection record we hold. It does not by itself withdraw the access you granted at the previous provider, and booking links you published before the change may continue to reference the previous account. So if you are switching accounts and want the old access ended, revoke it at that provider as described in 8.6, and review your published booking links. You may disconnect at any time.

8.2. Data We Access from a Connected Account

Access is limited to what Scheduling needs in order to function:

• Calendar list: the names and identifiers of the calendars on the connected account, so that Scheduling can identify the calendar to use.
• Event details: the times, titles, descriptions, locations, and participants of events on that calendar, so that appointments can be displayed, created, updated, and canceled from within Voyagr.
• Free/busy availability: the busy time ranges on those calendars, used to determine which slots to offer the people booking with you.
• Scheduling configuration: the booking pages, event types, availability rules, and notification settings you create in Voyagr's scheduler. These are created by you in Voyagr and held by Nylas; they are not read from your calendar account, and are listed here so that the full set of scheduling data is in one place.
• Basic account identity: the email address and provider of the connected account, so that the connection can be labeled and matched to your Voyagr profile.

We read the calendar list, event details, and free/busy availability. We write only calendar events, meaning the creation, updating, and cancellation of appointments booked through Voyagr, together with your scheduling configuration. We do not create, rename, or delete calendars themselves.

8.3. Data We Do Not Access

We do not access the contents of your mailbox.

Voyagr does not read, send, or store your email messages, drafts, or conversation threads, and we do not access your provider contacts or address book. Scheduling requests only calendar, event, free/busy, and scheduling data from a connected account. For Google and Microsoft accounts, the access granted is limited to the calendar permissions shown to you on your provider's consent screen when you connect.

8.4. How We Use Calendar Data

We use it solely to provide and improve the Scheduling features that are visible to you in the Platform: displaying your availability, accepting and confirming bookings, writing appointments to your calendar, preventing double-booking, and sending the related service notifications. We do not use calendar data for advertising, we do not sell or rent it, we do not use it to build advertising profiles, and we do not use it to develop, train, or improve generalized artificial intelligence or machine learning models.

8.5. Google API Services Limited Use Disclosure

In practice, information obtained through Google APIs is used only to provide and improve the user-facing Scheduling features described in 8.4; is not transferred to others except as necessary to provide those features, for security purposes, or to comply with applicable law; is not used for advertising purposes; and is not read by humans unless we have your explicit consent, it is necessary for security purposes or to comply with applicable law, or the data has been aggregated and anonymized for internal operations.

8.6. Storage, Retention, and Disconnecting

• What we store: a connection record holding an identifier for the connection, the email address and provider of the connected account, and its status. We do not store your provider access tokens, and we do not copy your calendar into Voyagr in bulk. Calendar contents are retrieved through Nylas from your provider as they are needed to display Scheduling. The scheduling records you create in Voyagr, meaning bookings and scheduler configuration, are retained as part of your account data and are protected by the safeguards described in Section 11.
• Disconnecting: disconnecting a calendar in Voyagr asks Nylas to revoke the connection with your provider and deletes the stored connection record. If that revocation request does not succeed, the connection record is removed from Voyagr regardless, so if you want certainty that access has ended, also revoke it at your provider as described below.
• Revoking at your provider: revoking Voyagr's access from your provider is the authoritative way to end it, and you may do so at any time. For Google accounts this is done from your Google Account security settings, under your third-party connections.
• If access is revoked elsewhere: if you or your provider end the connection outside Voyagr, we mark it inactive and stop making calendar requests. The connection record, including the connected account's email address, is kept until you delete the connection in Voyagr or ask us to remove it under Section 12.
• Account deletion: account closure is handled by contacting us rather than from a self-service control. If your Voyagr account is deleted, the stored connection record is deleted with it. Because the provider-side connection is held by Nylas rather than by Voyagr, we recommend also revoking access at your provider when you close your account. Appointments already written to your calendar remain on your calendar, and can be removed from your own calendar application.

9. International Data Transfers

Personal data may be processed in multiple jurisdictions where we or our service providers operate, including regions outside your country of residence. To safeguard such transfers, we implement Standard Contractual Clauses (SCCs), rely on adequacy decisions, or apply other legally recognized safeguards to ensure that data is handled in accordance with GDPR and comparable international data protection frameworks. By using the Platform, you acknowledge and agree that your personal information may be transferred to countries with different data protection laws; however, we take all necessary measures to provide adequate protection, maintain security, and uphold your privacy rights in line with applicable regulations.

10. Data Retention Practices

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected and to meet applicable legal, regulatory, and operational requirements.

• Traveler Information: Generally retained until the completion of bookings, after which it may be stored for additional periods required for accounting, auditing, or legal compliance.
• Agent Account Data: Preserved until the account is deactivated or terminated, unless longer retention is required by law or to resolve disputes.
• Calendar Connections: The connection record is kept while a connection is active, and after it is ended outside Voyagr, until you disconnect it in Voyagr or ask us to remove it. Disconnecting in Voyagr deletes the record (see Section 8.6).
• Legal and Regulatory Requirements: Extended retention periods may apply to comply with tax obligations, financial reporting rules, or regulatory inquiries.

Once data is no longer required for active use, it is either securely deleted, anonymized for statistical purposes, or archived with restricted access to protect confidentiality.

11. Data Security Safeguards

We take the protection of personal data seriously and employ a combination of administrative, technical, and physical safeguards designed to maintain the confidentiality, integrity, and availability of information. These measures are continuously reviewed and updated in line with evolving security standards and regulatory requirements.

12. Individual Rights

We respect the privacy rights of individuals across jurisdictions and provide mechanisms to ensure that users can exercise control over their personal data. The specific rights available depend on applicable laws and regulatory frameworks, but we strive to extend a consistent level of protection globally.

12.1. Rights Under GDPR (EU/UK)

Individuals within the European Union and the United Kingdom are entitled to:

• The right to access personal data we hold about you
• The right to rectify or update inaccurate or incomplete data
• The right to request erasure of personal data (“right to be forgotten”)
• The right to restrict or object to processing under certain circumstances
• The right to data portability, allowing you to obtain and reuse your data
• The right to withdraw consent where processing is based on consent
• The right to lodge a complaint with a relevant supervisory authority

12.2. Rights Under CCPA/CPRA (California, USA)

California residents are entitled to:

• The right to know what categories and specific pieces of personal data we collect, use, or disclose
• The right to request deletion of personal information, subject to legal or contractual obligations
• The right to opt out of the “sale” or “sharing” of personal data (note: we do not sell personal data)
• The right to correct inaccurate information
• The right to non-discrimination for exercising any privacy rights granted by law

12.3. Rights Under Other Frameworks (LGPD, PIPEDA, PDPA, etc.)

Where applicable, we also recognize equivalent rights under other data protection frameworks, such as Brazil's LGPD, Canada's PIPEDA, and Singapore's PDPA. This includes the right to transparency, correction, deletion, and objection, tailored to the local requirements of each framework.

12.4. Exercising Your Rights

To exercise your rights under any of the above frameworks, please contact us at [email protected].

13. Responsibilities for End-Customer Data

Travel agents are responsible for obtaining explicit consent from travelers before submitting personal data. Voyagr acts as a data processor with respect to traveler data, handling it only as instructed by travel agents. For GDPR purposes, travel agents are controllers of traveler data; Voyagr is the processor.

14. Account Termination & Data Deletion

Agents may close their account at any time; associated personal data will be deleted, anonymized, or retained only where legally required. End-customer bookings remain governed by supplier policies, including cancellations and refunds.

15. Policy Updates

This Privacy Policy may be updated periodically to reflect changes in law, business operations, or technology. Updates will be communicated via email or in-app notification with a revised “last updated” date. Continued use of the Platform after updates indicates acceptance.

16. Contact & Data Protection Queries

For inquiries, complaints, or to exercise your privacy rights, please contact us: