Draft
Privacy Policy
Last updated: 10 November 2026
1. Who we are
Travel Spins is a voice travel assistant that helps you find and book flights, hotels and rental cars at travelspins.com. The service is run by Voltron Robotics, org. no. 559344-3756, Drivhjulsvägen 20, 126 30 Hägersten, Sweden ("Travel Spins", "we", "us"). We are the controller of the personal data described in this policy.
Contact us about privacy at privacy@travelspins.com.
2. What this policy covers
This policy explains what personal data we collect when you use our website and app, why we use it, who we share it with, and the rights you have. It applies to you as an account holder and to the people you add as travellers, such as family members.
When you book, the airline, hotel or rental company also receives your data and handles it under its own privacy policy. We recommend reading theirs too.
3. The personal data we collect
Data you give us
- Account: email address, name, the name you want the assistant to use, phone number, home address, profile photo, home airport, language and travel preferences (for example breakfast or Wi-Fi).
- Traveller details: title, full name as in the passport, gender, date of birth, nationality, passport number, issuing country and expiry date, Known Traveller Number and redress number, frequent flyer numbers, and seat preferences. This applies to you and to anyone you add as a traveller.
- Connections: the email addresses of people you invite, the relationship you give them, and the booking permissions you set.
- Saved places: places you save on your map, with your own notes and photos, and places you choose to share.
Data created when you use Travel Spins
- Voice conversations: when you talk to the assistant, your voice is streamed in real time so it can be turned into text, understood and answered. We do not keep audio recordings or full transcripts.
- Conversation memory: a short summary of your latest conversation (routes, dates, travellers, options you liked), so you can carry on later. It is deleted after 72 hours, or straight away if you ask the assistant to forget it or tap Clear now in Settings.
- Searches and bookings: what you searched for, the options shown, and the bookings you make, including booking references, prices and status.
- Security and device data: sign-in codes, passkeys and authenticator settings, active sessions (browser and device type), and records of security actions such as an email change.
- Usage data: minutes of voice used per day, emails we sent you, and technical logs needed to run and protect the service.
Data from others
- From the person who booked for you: if someone books a trip for you, we receive your traveller details from them.
- From travel suppliers: booking confirmations and changes, such as a new flight time, through our booking partner.
We do not ask for special categories of data, such as health information. Please don't share it with the assistant.
4. How we use your data, and our legal basis
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Create and secure your account, sign you in | Account, security and device data | Contract; legitimate interest in keeping accounts safe |
| Understand your voice requests and show options | Voice stream, searches, preferences, conversation memory | Contract |
| Make the bookings you confirm with a tap | Traveller details, booking data | Contract |
| Send confirmations, reminders and flight-change alerts | Account and booking data | Contract |
| Let you book for family and connected people, with their permission | Traveller details, connections | Contract; legitimate interest of the person booking |
| Remember your latest conversation for 72 hours | Conversation memory | Legitimate interest in letting you carry on where you left off |
| Calendar invites and the calendar feed (optional) | Booking data | Consent (you can turn it off at any time) |
| Saving and sharing places on your map | Saved places | Contract |
| Limit voice use during the beta, prevent abuse, fix errors | Usage data, technical logs | Legitimate interest |
| Keep bookkeeping records and meet legal requests | Booking data | Legal obligation |
Travel Spins is ad-free. We don't show ads, we don't sell your personal data, and we don't use it for advertising.
How the AI assistant uses your data. The assistant uses AI models to understand what you say and to suggest options. It sees your travellers' names, age group and which details are missing, but never passport numbers, dates of birth or loyalty numbers. It can never book for you: every booking needs your own tap. Our AI providers process conversation data only to give us the service and, under our agreements, do not use it to train their models.
5. Who we share your data with
Travel suppliers. When you confirm a booking, we send the necessary traveller and booking details to our booking partner, which passes them to the airline, hotel or rental company. Each supplier is responsible for the data it receives. Airlines may also have to share passenger data with border and security authorities.
People you travel with. Travellers you book for, and the people who manage their profiles, get confirmations and change alerts for those bookings. People in your circle see only names, adult or child, and whether a profile is ready, never passport details.
Service providers that work for us (processors), only to run Travel Spins. They handle data on our instructions and under data processing agreements. They help us with:
- Searching and booking flights, hotels and rental cars
- The real-time voice connection
- Turning speech into text
- The AI model that understands your requests
- Turning the assistant's replies into speech
- Website hosting
- Database and assistant hosting (EU)
- Sending emails (EU)
- Maps and place search
Others, when required. Authorities or courts when the law requires it, advisers such as lawyers and auditors, and a buyer or investor if the business is sold or merged, under the same protections.
6. Transfers outside the EU/EEA
Our database and assistant run in the EU. Some service providers are based in, or can access data from, the United States. When data leaves the EU/EEA, we rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses, plus extra safeguards where needed. Booking a trip abroad means the supplier in that country receives your details, because that is needed to make the booking. You can ask us for a copy of the safeguards we use.
7. How long we keep your data
| Data | How long |
|---|---|
| Account and traveller profiles | Until you delete them or close your account |
| Conversation memory | 72 hours, or until you clear it |
| Audio and full transcripts | Not stored |
| Bookings and booking records | As long as bookkeeping law requires (currently 7 years) |
| Sign-in sessions | Up to 30 days, or until you sign out |
| Email-change undo record | 7 days |
| Sign-in history | 12 months |
| Staff access log | 24 months |
| Support tickets, their attachments and emails | 24 months after the ticket is closed |
| Technical logs | Up to 30 days |
When the period ends, we delete the data or make it anonymous.
8. How we protect your data
Passport numbers, dates of birth, Known Traveller and redress numbers, and conversation memory are encrypted in our database. All connections use encryption (HTTPS). You can protect your account with passkeys or an authenticator app, and sensitive actions ask you to confirm it's you. Only the people who need access to run the service have it. No system is completely secure, so tell us right away at support@travelspins.com if you suspect misuse.
9. Staff access to your account
A small number of authorised Travel Spins staff can view your account and bookings when this is needed to help you, for example to answer a support request or fix a booking problem. Staff must sign in with two-step verification. Passport numbers stay hidden unless a staff member actively chooses to show them. Every view and action is logged with who did it and when.
10. Children
You must be 18 or older to create an account. Parents and guardians can add children as travellers and book for them; they are responsible for the child's details. We never email children.
11. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you and get a copy.
- Correct data that is wrong or incomplete; most of it you can edit yourself in Settings.
- Delete your data, unless we must keep it by law (for example booking records).
- Restrict or object to processing based on our legitimate interests.
- Data portability: receive data you gave us in a common, machine-readable format.
- Withdraw consent at any time, for example by turning off calendar invites.
To use your rights, email privacy@travelspins.com. We reply within one month. If you're unhappy with how we handle your data, you can complain to the Swedish Authority for Privacy Protection (IMY), imy.se, or the authority where you live.
12. Changes to this policy
We may update this policy, for example when we launch card payments or new features. We'll show the new date at the top and tell you by email or in the app if the change is significant.
13. Contact
Voltron Robotics, org. no. 559344-3756, Drivhjulsvägen 20, 126 30 Hägersten, Sweden · privacy@travelspins.com