Privacy Policy

1. Introduction

Welcome to Otrip, operated by Otrip Limited ("we," "our," or "us"), a company registered in England and Wales. We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, including our website and mobile applications (collectively, the "Service"). It is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information We Collect

2.1 Information You Provide

• Account information: name, email address, username, password
• Profile information: bio, profile photo, country, gender, languages spoken
• Travel preferences: interests, traveler type
• Content you create: trips, itineraries, checklists, reviews, messages, photos, and videos
• Transaction data: expense records within trips (not processed or held by Otrip)
• Communications: messages sent through our chat feature
• Verification documents: identity documents submitted for agency verification
• Subscription information: tier and billing status (payment card data is held exclusively by our payment processor; we never receive or store it)
• Mobile device push notification token (when you grant notification permission)
• Referral code used when registering, if any
• AI input: destinations, dates, member count, and preferences you submit to the AI trip planning feature

2.2 Information Collected Automatically

• Device information: device type, operating system, browser type, mobile app version
• Usage data: pages visited, features used, search queries
• Usage data: interactions with content (views, likes, bookmarks) used to personalise your experience
• IP address and approximate location (country/city level only) — precise or background GPS is never collected
• Approximate location when you use the Nearby Travelers feature (country/city level only; you can disable this in-app)
• App and device diagnostics (not linked to your identity)

3. How We Use Your Information

• Provide, maintain, and improve the Service
• Create and manage your account
• Personalise your experience and surface relevant travel content and recommendations
• Enable social features (following, messaging, travel mate matching, nearby travelers)
• Process and manage trip-related data (itineraries, expenses, checklists, polls)
• Deliver AI-generated trip itinerary suggestions
• Manage subscription billing and enforce tier-based feature limits
• Send in-app and push notifications about activity relevant to you
• Detect and prevent fraud, abuse, and security incidents
• Comply with our legal obligations under UK law

4. Information Sharing

We do not sell your personal information. We may share information in the following circumstances:

• Public profile: Your username, bio, profile photo, and travel stats are visible to other users as part of the platform's social features
• Trip members: Trip details, itineraries, checklists, and shared content are visible to other members of your trip
• Service providers: Trusted third-party infrastructure providers that help us operate the platform, including cloud media storage, subscription payment processing, and personalised recommendation services. These providers access only the data necessary to perform their specific function and are contractually prohibited from using it for any other purpose
• Legal requirements: When required by law, court order, or to protect the rights and safety of our users or the public
• Business transfers: In connection with a merger, acquisition, or sale of assets, where the acquiring party will be bound by this Privacy Policy

5. Data Security

We implement appropriate technical and organisational security measures to protect your personal information, including encryption of data in transit (TLS), hashed passwords, and secure token-based authentication. However, no method of transmission over the Internet is 100% secure.

While we take reasonable steps to protect your data, Otrip Limited is not liable for data loss, corruption, or breach resulting from infrastructure failure, third-party service outages, or accidental deletion by the user. Users are encouraged to maintain their own copies of important content.

6. Data Retention

• Account data is retained for as long as your account is active or as needed to provide the Service
• On account deletion, a reactivation window exists before your personal data is permanently deleted
• Uploaded media: retained per subscription tier — 15 days after account deletion or inactivity (Free), or indefinitely while a paid subscription is active (Pro/Max)
• Deleted media: held in the recycle bin for 7 days (Free) or 30 days (Pro/Max) before permanent removal
• Subscription billing history: retained for 7 years to satisfy legal and tax obligations
• Identity verification documents: retained only as long as necessary for verification purposes, then deleted

7. Your Rights (UK GDPR)

Under the UK GDPR and Data Protection Act 2018, you have the following rights:

• Right to be informed — this Privacy Policy fulfils this right
• Right of access — you may submit a Subject Access Request to receive a copy of your personal data
• Right to rectification — you may correct inaccurate personal data through your account settings or by contacting us
• Right to erasure ("right to be forgotten") — you may delete your account and associated data at any time through your account settings
• Right to restrict processing — you may request that we limit how we use your data
• Right to data portability — you may request a copy of your data in a structured, machine-readable format
• Right to object — you may object to processing based on legitimate interests, including use of your data for personalisation
• Rights related to automated decision-making — you may request human review of decisions made solely by automated means
• Right to complain — you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk

To exercise any of these rights, contact us at hello@otrip.io. We will respond within one month as required by UK GDPR.

8. Cookies & Local Storage

We use essential cookies for authentication and session management. Authentication tokens and user preferences are stored locally on your device using secure browser and mobile storage mechanisms. We do not use third-party advertising cookies or serve targeted advertising.

9. Push Notifications

• The mobile app requests your permission to send push notifications
• Your device push notification token is stored solely to deliver notifications from Otrip to your device
• We do not share push tokens with advertising networks or third parties
• You may withdraw notification permission at any time in your device Settings, or manage notification types in the app under Settings → Notifications

10. International Data Transfers

Otrip Limited is registered in England and Wales. Some of our third-party service providers are based outside the UK. Data transfers to these providers are governed by UK GDPR Standard Contractual Clauses or equivalent adequacy mechanisms.

We do not transfer personal data to countries that do not provide an adequate level of data protection without appropriate safeguards in place.

11. Children's Privacy

The Service is not intended for users under the age of 13. We do not knowingly collect personal information from children under 13. If we learn we have collected such information, we will take immediate steps to delete it.

12. App Store & Platform Data Declarations

This section summarises our data practices in the format required by Apple App Store Privacy Nutrition Labels and Google Play Data Safety.

Data linked to your identity

• Contact info: name, email address, username
• User content: photos, videos, trip data, messages, reviews
• Identifiers: account ID, device push notification token
• Usage data: app interactions, search queries, features used
• Purchases: subscription tier and status (payment card data is held by our payment processor only; we never receive or store it)
• Location: approximate location (city/country level) when using Nearby Travelers

Data NOT linked to your identity

• App and device diagnostics
• Anonymised usage signals used for personalisation

Data we do NOT collect

• Precise or background GPS location
• Device contacts or address book
• Health or fitness data
• Browsing history from other apps or websites
• Advertising identifiers

Advertising & cross-app tracking

We do not use advertising identifiers, track users across third-party apps or websites, or serve targeted advertising of any kind.

Data deletion

You can delete your account and all associated personal data at any time through your account settings.

13. California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

• Right to know what personal information we collect, use, and share
• Right to request deletion of your personal information
• Right to opt out of the sale of personal information — we do not sell personal information
• Right to non-discrimination for exercising your CCPA rights

Submit California privacy requests to hello@otrip.io.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

15. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights, or want to submit a Subject Access Request, please contact us at hello@otrip.io.

You also have the right to lodge a complaint with the UK Information Commissioner's Office: ico.org.uk