Privacy Policy

Effective Date: March 30, 2026 · Last Updated: March 30, 2026

Getaway Travel LLC (“Getaway,” “we,” “us,” or “our”) operates the Getaway.expert platform and its white-label deployments (collectively, the “Service”). This Privacy Policy explains how we collect, use, share, and protect your personal information when you use the Service.

1. Information We Collect

Account Information. When you create an account, we collect your name, email address, and password (stored in hashed form). If you sign up through a third-party provider (e.g., Google), we receive your name and email from that provider.

Trip and Preference Data. When you create an itinerary, we collect the information you provide: destination, travel dates, number of travelers, budget range, and interest preferences. This data is used to generate personalized recommendations.

Usage Data. We automatically collect information about how you interact with the Service, including pages viewed, features used, session duration, clicks, device type, browser type, IP address, and referring URL.

Cookies and Similar Technologies. We use strictly necessary cookies for authentication and session management. We use analytics cookies only with your consent. See Section 8 for details.

2. How We Use Your Information

We use your information to: provide and personalize the Service, including generating AI-powered travel itineraries; communicate with you about your account, trips, and service updates; improve and develop new features; ensure security and prevent fraud; comply with legal obligations; and, with your consent, send promotional communications.

3. AI-Powered Recommendations

How it works. When you request a travel itinerary, your trip preferences (destination, dates, traveler count, budget, interests) are sent to Anthropic, PBC (“Anthropic”), the provider of the Claude AI model, via their API. Anthropic processes this data to generate your personalized recommendations.

What Anthropic receives. Anthropic receives only the trip preference data you submit for that specific request. It does not receive your name, email address, or account credentials.

Anthropic’s data practices. Anthropic’s API does not use customer inputs to train its models. For details on how Anthropic handles data, see Anthropic’s Privacy Policy.

Your choice. By using the itinerary generation feature, you consent to this processing. If you do not want your preferences processed by AI, you may browse the Service without generating an itinerary.

4. How We Share Your Information

We do not sell your personal information. We share your data only in the following circumstances:

Service Providers. We share data with third-party providers who help us operate the Service:

Provider	Purpose	Data Shared
Anthropic, PBC	AI itinerary generation	Trip preferences only
Railway	Cloud hosting and infrastructure	All Service data (encrypted at rest and in transit)
Unsplash	Destination imagery	Image search queries (destination names)

White-Label Partners. If you use a white-label deployment operated by a destination marketing organization (DMO) or tourism board, that partner is a separate data controller for the data collected through their deployment. Their use of your data is subject to their own privacy policy.

Legal Requirements. We may disclose your information if required by law, subpoena, court order, or government request, or to protect the rights, safety, or property of Getaway, our users, or the public.

Business Transfers. In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.

5. Data Retention

We retain your data for the following periods:

Data Category	Retention Period
Account data (name, email, credentials)	While your account is active, plus 30 days after deletion request
Trip and itinerary data	While your account is active; deleted when account is deleted
Server and application logs	90 days, then automatically purged
Analytics and usage data	24 months, then anonymized
Payment and billing records	7 years (required by tax and accounting law)

6. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

Access and Portability. You can request a copy of the personal data we hold about you in a machine-readable format.

Correction. You can update your account information at any time through the Service. For other corrections, contact us.

Deletion. You can delete your account through the account settings page. Upon deletion, we will remove your personal data within 30 days, except for data we are legally required to retain. Trip data and preferences are permanently deleted with your account.

Objection and Restriction. You may object to or request restriction of certain processing activities. We will honor such requests unless we have a compelling legitimate interest.

Withdraw Consent. Where processing is based on consent (e.g., analytics cookies, promotional emails), you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise these rights, contact us at privacy@getaway.expert. We will respond within 30 days.

7. Security

We implement industry-standard security measures including: encrypted data transmission (TLS/HTTPS), hashed and salted password storage, rate limiting on authentication and API endpoints, role-based access controls, security headers (Content Security Policy, HSTS, X-Frame-Options), and regular security reviews. No system is 100% secure, and we cannot guarantee absolute security, but we are committed to protecting your data.

8. Cookie Policy

Strictly Necessary Cookies. These cookies are required for the Service to function (authentication, session management). They cannot be disabled.

Analytics Cookies. We use analytics cookies to understand how the Service is used and to improve it. These cookies are only set after you provide consent through our cookie banner. You can change your preference at any time through the cookie settings link in the footer.

We do not use advertising or third-party tracking cookies.

9. International Data Transfers

The Service is hosted in the United States. If you access the Service from outside the United States, your data will be transferred to and processed in the United States. We rely on Standard Contractual Clauses or other approved transfer mechanisms where required by applicable law.

10. Children’s Privacy

The Service is not directed to children under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will delete it promptly. If you believe a child has provided us with personal data, please contact us.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Service with a new effective date. If the changes are significant, we will also notify you by email. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

12. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to: know what personal information we collect, disclose, and sell (we do not sell personal information); request deletion of your personal information; opt out of the sale of personal information (not applicable — we do not sell data); and not be discriminated against for exercising your rights. To submit a request, email privacy@getaway.expert with the subject line “California Privacy Request.”