Privacy Policy

Myra Solutions LLC, Texas, United States, is the data controller for information collected through DraftTrip. For anything in this policy, write to privacy@drafttrip.com.

• Your WhatsApp number. This is your account identity. We need it to sign you in and to let the assistant reach you.
• Your trips. Destinations, dates, notes and anything else you add.
• Who you share with. The numbers you invite, and the role you give them.
• Messages to the assistant. Your questions and instructions, so it can answer and make the changes you ask for.
• Usage records. For each AI request we keep the time, the token totals, and the text you typed — your question, instruction or trip description — up to the first 500 characters. We use these to apply fair-use limits, to investigate abuse, and to see where the assistant is getting things wrong. Requests our own system makes in the background, such as the check that runs after a trip is drafted, are recorded without any text, because nobody typed them.
• Payment records. Amount, date and status. Card details go directly to our payment processor and never reach our servers.

We do not collect location data, contacts, or advertising identifiers, and we do not track you across other websites.

We do not sell your personal information. We do not share it with advertisers. We do not use your trips to train AI models.

We use a small number of processors, each for one job:

• Anthropic — processes your trip brief and assistant messages to generate itineraries and answers.
• Meta (WhatsApp Business Platform) — delivers sign-in codes and assistant replies to your number.
• Our payment processor — takes payment and handles card data.
• Our hosting and database providers — store and serve the service.

We may also disclose information where the law requires it, or to protect the rights and safety of people using the service.

Data is stored on servers in the United States. If you are in the UK, EEA or Switzerland, transfers rely on Standard Contractual Clauses or an equivalent safeguard.

• Trips and account data: until you delete them, or your account is deleted.
• Sign-in codes: ten minutes, then they expire and are unusable.
• The text of your AI requests: 90 days, then it is erased from the usage record.
• AI usage records (times and token counts, without the text): 12 months, for fair-use limits and abuse prevention.
• Payment records: 7 years, as tax law requires.

When you delete your account, your trips and personal data are deleted within 30 days.

Depending on where you live, you may have the right to access, correct, delete, export or restrict the use of your personal information, and to object to processing. UK and EEA residents may complain to their supervisory authority. California residents have rights under the CCPA, including the right to know and to delete; we do not sell personal information, so there is nothing to opt out of.

To exercise any right, write to privacy@drafttrip.com. We respond within 30 days.

Connections are encrypted in transit. Sign-in codes are stored hashed, never in plain text, and are limited in both attempts and frequency. Access to a trip is granted only through an explicit membership record, checked on every read and write.

A small number of our staff can read the text of AI requests through an internal admin tool, to answer support questions, investigate abuse and fix the assistant when it gets something wrong. They cannot read the contents of your trips through it, and the text is erased after 90 days.

No system is perfectly secure. If a breach affects your data, we will notify you and the relevant authority as the law requires.

DraftTrip is not intended for children under 16. We do not knowingly collect their data. If you believe a child has given us information, contact privacy@drafttrip.com and we will delete it.

We will post any changes here and update the date above. Material changes will be notified in the service.