Who is responsible
Myra Solutions LLC, Texas, United States, is the data controller for information collected through DraftTrip. For anything in this policy, write to privacy@drafttrip.com.
What we collect
- Your WhatsApp number. This is your account identity. We need it to sign you in and to let the assistant reach you.
- Your trips. Destinations, dates, notes and anything else you add.
- Who you share with. The numbers you invite, the role you give them, and the name of anyone you pick from your contacts.
- Messages to the assistant. Your questions and instructions, so it can answer and make the changes you ask for.
- Photos and PDFs you send to the assistant. A ticket, a booking confirmation, a menu or a sign you want read. We keep a copy so it stays in your chat. Photos are resized and re-saved before they are stored, which removes the location and camera details a phone attaches to them. Only you can see them: not the other people on the trip, and not our staff through our admin tools.
- Voice notes. When you use the microphone to describe a trip or talk to the assistant, we keep the recording, its length and the text it was turned into. The text is what the app uses; the recording is never shown to other users, and a small number of our staff can listen to it through an internal admin tool, to answer support questions and improve transcription.
- Usage records. For each AI request we keep the time, the token totals, and the text you typed — your question, instruction or trip description — up to the first 500 characters. We use these to apply fair-use limits, to investigate abuse, and to see where the assistant is getting things wrong. Requests our own system makes in the background, such as the check that runs after a trip is drafted, are recorded without any text, because nobody typed them.
- Payment records. Amount, date and status. Card details go directly to our payment processor and never reach our servers.
We do not collect location data or advertising identifiers, and we do not track you across other websites. Location data inside the photos you send is removed before we store them.
The app never reads or uploads your address book. When you pick someone from your contacts to invite, only that person’s name and number are sent to us, to invite them. We keep the name with the invitation so we can show it back to you when you add people later; it is never shown to anyone else and never becomes their name on DraftTrip.
What we do not do
We do not sell your personal information. We do not share it with advertisers. We do not use your trips to train AI models.
Who we share it with
We use a small number of processors, each for one job:
- Anthropic — processes your trip brief and assistant messages, including any photos and PDFs you send, to generate itineraries and answers.
- OpenAI — turns your voice notes into text. While you speak, your browser may also show a live preview using its own speech recognition, which is your browser maker’s service rather than ours.
- Meta (WhatsApp Business Platform) — delivers sign-in codes and assistant replies to your number.
- Our payment processor — takes payment and handles card data.
- Our hosting and database providers — store and serve the service.
We may also disclose information where the law requires it, or to protect the rights and safety of people using the service.
Where your data is held
Data is stored on servers in the United States. If you are in the UK, EEA or Switzerland, transfers rely on Standard Contractual Clauses or an equivalent safeguard.
How long we keep it
- Trips and account data: until you delete them, or your account is deleted.
- Sign-in codes: ten minutes, then they expire and are unusable.
- The text of your AI requests: 90 days, then it is erased from the usage record.
- Photos and PDFs you send to the assistant: 90 days, or sooner if your account is deleted. Your chat keeps a note that you sent them.
- Voice notes: until your account is deleted.
- AI usage records (times and token counts, without the text): 12 months, for fair-use limits and abuse prevention.
- Payment records: 7 years, as tax law requires.
When you delete your account, your account is closed straight away, and your trips and personal data are permanently deleted within 90 days.
Your rights
Depending on where you live, you may have the right to access, correct, delete, export or restrict the use of your personal information, and to object to processing. UK and EEA residents may complain to their supervisory authority. California residents have rights under the CCPA, including the right to know and to delete; we do not sell personal information, so there is nothing to opt out of.
To exercise any right, write to privacy@drafttrip.com. We respond within 30 days.
Security
Connections are encrypted in transit. Sign-in codes are stored hashed, never in plain text, and are limited in both attempts and frequency. Access to a trip is granted only through an explicit membership record, checked on every read and write.
A small number of our staff can read the text of AI requests through an internal admin tool, to answer support questions, investigate abuse and fix the assistant when it gets something wrong. They cannot read the contents of your trips through it, and the text is erased after 90 days.
No system is perfectly secure. If a breach affects your data, we will notify you and the relevant authority as the law requires.
Children
DraftTrip is not intended for children under 16. We do not knowingly collect their data. If you believe a child has given us information, contact privacy@drafttrip.com and we will delete it.
Changes
We will post any changes here and update the date above. Material changes will be notified in the service.