Privacy Policy

1. Introduction

WayPal ("we," "our," "us," or the "Company") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application ("App") and related services (collectively, the "Services").

By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with this Privacy Policy, please do not access or use our Services.

This Privacy Policy applies to all users of our Services, including users who access the Services via mobile devices, tablets, or any other electronic devices.

2. Information We Collect

2.1 Information You Provide Directly

• Account Registration Information: When you create an account, we collect your email address, display name, and any profile information you choose to provide.
• Trip and Travel Data: Information about your trips including destinations, travel dates, itineraries, activities, accommodations, transportation details, and travel preferences.
• Financial Information: Budget amounts, expense records, currency preferences, and expense splitting data. We do not store complete payment card information; all payment processing is handled by Apple through the App Store.
• User-Generated Content: Photos, notes, documents, reviews, and any other content you create, upload, or store within the App.
• Communications: Messages you send through our AI chat feature, customer support inquiries, and any other communications with us.
• Travel Documents: If you choose to store travel documents (passports, visas, tickets, reservations), we encrypt and store this information securely.
• Contacts: If you choose to invite travel companions, we may access contact information you provide for invitation purposes only.

2.2 Information Collected Automatically

• Location Data: With your explicit permission, we collect precise and approximate location data to provide nearby recommendations, location-based features, and to enhance your travel experience. You can disable location services at any time through your device settings.
• Device Information: Device type, model, operating system version, unique device identifiers (such as IDFA or IDFV), app version, language settings, and time zone.
• Usage Data: Information about how you interact with the App, including features used, pages viewed, actions taken, time spent on features, crash reports, and performance data.
• Log Data: IP address, access times, referring URLs, and other standard log information.
• Analytics Data: Aggregated and anonymized data about app usage patterns to improve our Services.

2.3 Information from Third Parties

• Authentication Providers: If you sign in using Apple Sign-In or other third-party authentication, we receive basic profile information as permitted by your privacy settings.
• AI Service Providers: Our AI features are powered by third-party AI services that may process your queries to generate responses.

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Providing and Improving Services

• Create and manage your account
• Provide AI-powered trip planning and personalized recommendations
• Track and manage your travel expenses and budgets
• Enable expense splitting with travel companions
• Store and organize your travel documents
• Provide location-based recommendations and features
• Provide translation and language assistance features
• Process and fulfill subscription purchases
• Improve, personalize, and optimize our Services
• Develop new features and services

3.2 Communication

• Send service-related notifications and updates
• Respond to your inquiries and provide customer support
• Send promotional communications (with your consent, where required)

3.3 Safety and Security

• Detect, prevent, and address fraud, abuse, and security issues
• Verify user identity and prevent unauthorized access
• Enforce our Terms of Service and other policies
• Comply with legal obligations

3.4 Analytics and Research

• Analyze usage patterns and trends
• Conduct research and analysis to improve our Services
• Generate aggregated, anonymized insights

4. Legal Bases for Processing (EEA/UK Users)

If you are located in the European Economic Area (EEA) or United Kingdom (UK), we process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to provide our Services to you.
• Legitimate Interests: Processing necessary for our legitimate business interests, such as improving our Services, preventing fraud, and ensuring security.
• Consent: Processing based on your explicit consent, which you may withdraw at any time.
• Legal Obligation: Processing necessary to comply with applicable laws and regulations.

5. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

We may share your information in the following circumstances:

5.1 Service Providers

We share data with third-party service providers who perform services on our behalf, including:

• Cloud Infrastructure: Supabase and other cloud hosting providers for data storage and processing.
• AI Services: Anthropic (Claude AI) and other AI providers to power our AI features. Your chat messages and relevant context are processed by these services.
• Analytics: Analytics providers to help us understand app usage (data is anonymized where possible).
• Payment Processing: Apple handles all payment processing for subscriptions.

Our service providers are contractually obligated to protect your data and use it only for the purposes we specify.

5.2 Travel Companions

When you invite others to join your trip or share expenses, relevant trip information is shared with those individuals as necessary for the shared features to function.

5.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid legal requests, including:

• Complying with court orders, subpoenas, or legal processes
• Responding to requests from government authorities
• Protecting our rights, privacy, safety, or property
• Enforcing our Terms of Service
• Protecting against legal liability

5.4 Business Transfers

If we are involved in a merger, acquisition, bankruptcy, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have.

5.5 With Your Consent

We may share your information with third parties when you explicitly consent to such sharing.

6. Data Security

We implement comprehensive security measures to protect your personal information, including:

• Encryption: Data is encrypted in transit using TLS/SSL and at rest using industry-standard encryption.
• Access Controls: Strict access controls limit who can access your data.
• Security Monitoring: Continuous monitoring for security threats and vulnerabilities.
• Secure Infrastructure: Our services are hosted on secure, reputable cloud infrastructure.
• Regular Audits: Periodic security assessments and updates.

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security. You are responsible for maintaining the confidentiality of your account credentials.

7. Data Retention

We retain your personal information for as long as necessary to:

• Provide our Services to you
• Comply with legal obligations
• Resolve disputes and enforce our agreements
• Fulfill the purposes described in this Privacy Policy

When you delete your account:

• Your personal data will be deleted within 30 days
• Some information may be retained in anonymized form for analytics
• Certain data may be retained longer if required by law or for legitimate business purposes (such as fraud prevention)
• Backup copies may persist for a limited additional period as part of our disaster recovery processes

8. Your Rights and Choices

8.1 General Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data.
• Portability: Request a copy of your data in a portable format.
• Objection: Object to certain processing of your data.
• Restriction: Request restriction of processing in certain circumstances.
• Withdraw Consent: Withdraw consent where processing is based on consent.

8.2 How to Exercise Your Rights

You can exercise many of these rights directly through the App settings. For other requests, contact us at privacy@waypalai.com. We will respond to your request within 30 days (or sooner if required by applicable law).

8.3 Device Permissions

You can control the following permissions through your device settings:

• Location: Enable or disable location services
• Camera: Enable or disable camera access for photos
• Photos: Enable or disable access to your photo library
• Notifications: Enable or disable push notifications

8.4 Marketing Communications

You can opt out of marketing communications at any time by following the unsubscribe link in our emails or adjusting your notification preferences in the App.

9. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: You can request information about the categories and specific pieces of personal information we have collected, the sources of that information, our business purposes for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: You can request deletion of your personal information, subject to certain exceptions.
• Right to Correct: You can request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do not sell your personal information or share it for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Information: You can limit the use of sensitive personal information to what is necessary to provide the Services.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise these rights, contact us at privacy@waypalai.com or use the in-app settings. We may need to verify your identity before processing your request.

Categories of Personal Information Collected: Identifiers, commercial information, internet activity, geolocation data, and inferences drawn from the above.

10. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, you have rights under the General Data Protection Regulation (GDPR) and similar laws:

• All rights listed in Section 8.1 above
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority.
• International Data Transfers: When we transfer your data outside the EEA/UK, we use appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.

Data Controller: WayPal is the data controller for your personal information.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States. These countries may have data protection laws that differ from your country.

When we transfer data internationally, we implement appropriate safeguards including:

• Standard Contractual Clauses approved by relevant authorities
• Data processing agreements with service providers
• Compliance with applicable data protection frameworks

12. Children's Privacy

Our Services are not intended for children under the age of 13 (or 16 in certain jurisdictions). We do not knowingly collect personal information from children under these ages.

If we learn that we have collected personal information from a child under the applicable age, we will take steps to delete that information as quickly as possible. If you believe we have collected information from a child, please contact us at privacy@waypalai.com.

13. Third-Party Links and Services

Our Services may contain links to third-party websites, services, or applications. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you access.

We are not responsible for the privacy practices or content of third-party services, including but not limited to:

• Booking and reservation platforms
• Map and navigation services
• Social media platforms
• External websites linked from the App

14. Do Not Track Signals

Some browsers include a "Do Not Track" (DNT) feature. Because there is no industry-standard interpretation of DNT signals, we do not currently respond to DNT signals. You can control tracking through your device settings and the choices described in this Privacy Policy.

15. AI-Specific Privacy Considerations

Our AI features have specific privacy implications you should understand:

• AI Processing: Your conversations with our AI assistant are processed by third-party AI providers (such as Anthropic) to generate responses.
• Data Usage: AI providers may use anonymized data to improve their services, subject to their privacy policies.
• No Sensitive Information: We recommend not sharing highly sensitive personal information (such as passport numbers or financial account details) in AI conversations.
• AI Limitations: AI-generated responses are for informational purposes only and should be independently verified.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

When we make material changes, we will:

• Update the "Last updated" date at the top of this policy
• Notify you through the App or via email (for significant changes)
• Obtain your consent where required by applicable law

Your continued use of our Services after any changes indicates your acceptance of the updated Privacy Policy.

17. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

Email: privacy@waypalai.com

General Support: support@waypalai.com

We will respond to your inquiry as soon as reasonably possible, and no later than as required by applicable law.