Your client data, on your instructions.

Who is who

You are the controller of the personal data you enter about your clients and their travelling party: names, email addresses, ages of children, trip dates, destinations, documents you upload, messages, invoices. Endless Travel Plans LLC is your processor: we use that data only to run your workspace and the pages you share, on your instructions, which are the things you do in the product.

For your own account details (your name, email, business profile, billing) we are a controller, and our Privacy Policy applies.

What we do with it, and what we never do

We store it, display it to you and to the people you share a link with, send the transactional emails your work triggers, generate itineraries, budgets and packing lists from the trip details, take invoice payments, and produce your exports.

When a client approves a proposal, we keep the name they type and a one way keyed code of their IP address and browser with the approval, as evidence of who said yes; never the address itself. That evidence stays with the proposal while your account is open and is erased when you close it.

We do not sell it, do not use it for advertising, do not add your clients to our marketing lists, and do not contact your clients except through something you sent. Pages you share with clients carry no analytics or advertising trackers. The rules on this are on the client ownership page.

Companies that process it for us

We use these sub-processors for advisor workspaces. Each receives only what its job needs.

• • DigitalOcean (United States): servers, the database and the nightly backups.
• • Stripe: card payments on your invoices and your payouts. We send Stripe the amount, the invoice number and the item descriptions you write; the payer types their own name, email and card details on Stripe's payment page.
• • Postmark: delivery of transactional email. Receives the recipient address and the message.
• • Anthropic, with OpenAI as a fallback: drafting itineraries, packing lists and research briefs. Receives trip details such as destination, dates, party size and children's ages, not client names or contact details. One exception, and only when you choose it: if you ask us to read a booking confirmation with AI in Bookings, the file or text you give us goes to Anthropic, and a confirmation usually names the travellers. The screen says so before you send it, and card numbers are removed from pasted text first. By default neither provider uses data sent through its API to train its models, and we have not opted in.
• • Google Maps Platform: places and map coordinates. Receives place and activity names and the destination.
• • SerpApi: live flight and hotel prices. Receives destinations, dates and party size.
• • Geoapify: a fallback that turns place and activity names into map coordinates. Receives place and activity names only.
• • Mapbox (United States): the map tiles on the maps in your workspace and on the trip pages you share. The viewer's browser loads the tiles from Mapbox, so Mapbox sees that person's IP address and the area the map shows. It receives no names.
• • Pexels: the destination photo at the top of a trip page you share, which you can switch off for any trip. The viewer's browser loads the photo from Pexels, so Pexels sees that person's IP address and which photo is shown.
• • FlightAware (United States): flight status for the flights on your bookings, once we switch flight alerts on. Receives the flight number and the travel dates, nothing about the travellers.
• • Google Drive: a second, off-site copy of the nightly backup: the database (encrypted) and uploaded files such as documents, each kept for 30 days.
• • Sentry, PostHog and Microsoft Clarity: error reports, product analytics and usability recordings of how you use the workspace. On workspace pages the page text is masked in your browser before anything is sent, so PostHog and Clarity do not record your clients' names or details. Neither PostHog nor Clarity runs on the trip, proposal, invoice, intake form, group sign-up and enquiry confirmation pages your clients open. A client who accepts your invitation to connect their account signs up on our ordinary registration page, which runs our usual analytics and usability recordings. If a page fails, including one a client opened, Sentry receives an error report with no form contents, and on the pages you share the access code is removed from the address.

Geoapify and the Google Drive backup copy were already in use when we added them to this list on 23 October 2026, and Mapbox, Pexels and Microsoft Clarity were already in use when we added them on 26 October 2026. We will list a new sub-processor here at least 14 days before it starts handling workspace data. If you object, you can export your data and close your workspace, and we refund any unused prepaid period.

Security

Traffic is encrypted in transit. The database is reachable only from the application server, behind a firewall. The database and uploaded files are backed up every night, and an off-site copy is kept in Google Drive for 30 days. Access to production is limited to the people who operate the service and protected by key-based login. Advisor accounts support two-factor sign-in. Share links are long random tokens that you can revoke, and uploaded client documents are stored outside the public web root and served only through a permission check.

If we learn of a breach affecting your client data we tell you without undue delay, and no later than 72 hours after we confirm it, with what happened, what data, and what we have done, so that you can meet your own notification duties.

International transfers

The service is hosted in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, the European Commission's Standard Contractual Clauses (Module Two, controller to processor), with the UK International Data Transfer Addendum where UK law applies, are incorporated into this addendum by reference and govern the transfer of your client data to us. Ask us for a countersigned copy at any time.

Helping you with your clients' rights

You can correct, export and delete a client's data yourself at any time from your workspace. If a client writes to us directly about data you control, we pass the request to you and do not answer it for you. We will help, on request, with a data protection impact assessment or a regulator's question about our part of the processing.

Deletion and return

Your workspace exports on demand as a ZIP in open formats. The export holds your clients and their travelling parties, trips (dates, destination and status), proposals (a PDF of each, with title and version), budgets, invoices (a PDF of each, with the amount paid), credit notes (including cancellations), tasks, commissions, messages, documents, group rosters, intake answers, bookings, suppliers and supplier payments, payment records, proposal choices and approvals, consent history, activity log, itinerary days and packing lists. When you remove a client, their record leaves your workspace immediately, and 30 days later we erase it for good. Invoices with a payment are kept under the rule below, and your supplier payment records stay in your books without the client's name. Closing your workspace erases it at once: clients, trips, documents and exports. Invoices and payout records are kept for as long as tax law requires. On a kept invoice the client's name is replaced and their email, phone and notes are removed; the billing address printed on the invoice stays, as part of the tax record. Backups age out within 90 days.

Audits and questions

Once a year, on reasonable notice, we will answer a written security questionnaire about the processing described here. We are a small company and do not yet hold an independent certification such as SOC 2 or ISO 27001; we would rather say so than imply otherwise.