Privacy Policy

1 Who We Are

Data Controller: William Oakeley
Bromley, United Kingdom
Email: contact@travatu.com

As a UK-based sole trader operating Travatu, William Oakeley is responsible for your personal data under UK GDPR.

2 Information We Collect

2.1 Information You Provide

• Name or username
• Email address
• Profile information and avatar
• Saved trips, TripBoards, and destination preferences
• Messages or content you submit in the app or on the website
• Support requests sent to us

2.2 Automatically Collected Data

• Device type, operating system version, and browser type
• IP address and approximate location (country / region level)
• App usage analytics (screens visited, features used) — see Section 7 for how cookies are used on the website
• Crash logs and performance diagnostics
• Cookies and similar technologies (see Section 7)
• iOS device identifiers (where permitted by your privacy settings)

2.3 Third-Party & Affiliate Data

If you interact with affiliate links (e.g. Trip.com), we or our affiliate partners may receive:

• Click tracking data
• Booking attribution data
• Commission reporting information

We do not receive your payment card details or full booking details from affiliates.

3 How We Use Your Data

• Provide, operate, and improve the Travatu iOS app and web platform
• Personalise your travel planning experience and TripBoards
• Save and sync your trips across devices
• Send service updates, security alerts, and support responses
• Analyse usage patterns to improve features and fix bugs
• Track and attribute affiliate link performance
• Comply with legal obligations including UK GDPR
• Detect and prevent fraud or abuse

We do not sell your personal data.

4 Legal Basis for Processing (UK & EU GDPR)

• Contractual necessity — to provide you with the Travatu service
• Legitimate interests — analytics, security, product improvement, affiliate attribution
• Consent — non-essential cookies, marketing communications, affiliate tracking
• Legal obligation — compliance with UK law, fraud prevention, tax records

Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.

5 Sharing Your Information

We only share the minimum data required and never sell your data. We may share information with:

• Affiliate partners — e.g. Trip.com, directly or via affiliate networks (such as Travelpayouts), for link attribution
• Analytics providers — if and when enabled, to understand how the app and website are used
• Cloud hosting & infrastructure providers — to store and serve the service
• Customer support tools — to respond to your queries
• Apple — in connection with the iOS App Store distribution and TestFlight
• Payment processors — if premium features are introduced in future (we will update this policy)

6 Affiliate Disclosure

Travatu participates (or intends to participate) in affiliate programmes including the Trip.com affiliate programme, directly or via affiliate networks such as Travelpayouts.

• When you click an affiliate link, our partner (e.g. Trip.com) may set a tracking cookie on their own website to attribute any booking you go on to make. This cookie is set by the partner on their site, not by Travatu on travatu.com.
• If you complete a booking through that link, Travatu may earn a commission
• This does not affect the price you pay — all prices are the same as booking directly

Affiliate links are clearly labelled within the app and on the website wherever they appear.

7 Cookies & Tracking Technologies

We use only essential cookies and local storage on our website (travatu.com). The Travatu iOS app uses equivalent local storage and device identifiers where applicable.

7.1 Types of Cookies

• Essential cookies and local storage — required for the website and app to function (for example, to keep you signed in and remember your preferences).
• Affiliate tracking cookies — set by our partners (e.g. Trip.com) on their own websites after you click an affiliate link. These are controlled by the partner and governed by the partner’s own cookie and privacy policy, not by Travatu.

We do not currently place analytics or advertising cookies on travatu.com.

7.2 Consent (UK/EU)

Because Travatu does not currently place non-essential cookies on travatu.com, no cookie consent banner is shown. If we introduce analytics or advertising cookies in future, we will ask for your consent (via a cookie banner) before placing them and will update this policy. You can manage or block cookies at any time through your browser and iOS device settings.

7.3 iOS App Tracking

On iOS 14.5 and above, we request App Tracking Transparency (ATT) permission before tracking your device across other apps or websites. You can change this permission at any time in your iPhone's Settings → Privacy & Security → Tracking.

8 Data Retention

We retain your personal data only as long as necessary to:

• Provide the Travatu service while your account is active
• Meet UK legal and tax obligations (typically up to 6 years)
• Resolve disputes and enforce our terms

You can request deletion of your account and data at any time (see Section 9). Following deletion, we may retain anonymised, aggregated data that cannot identify you.

9 Your Rights under UK & EU GDPR

You have the following rights in relation to your personal data:

To exercise any of these rights, contact us at contact@travatu.com. We will respond within 30 days.

You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint

10 Children's Privacy

Travatu is not directed at or intended for users under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us at contact@travatu.com and we will delete it promptly.

11 International Data Transfers

Your data may be processed or stored outside of the UK and EEA (for example, by US-based cloud or analytics providers). Where this occurs, we ensure appropriate safeguards are in place, including:

• UK International Data Transfer Agreements (IDTAs)
• EU Standard Contractual Clauses (SCCs) where applicable
• Transfers only to countries or organisations that provide an adequate level of data protection

12 Security

We use industry-standard security measures to protect your data, including:

• Encryption in transit (HTTPS / TLS) for the website and API
• Encrypted data storage
• Access controls limiting who can access personal data
• Regular review of third-party providers' security practices

No system is 100% secure. In the unlikely event of a data breach that affects your rights, we will notify you and the ICO as required by UK GDPR.

13 Apple App Store & iOS-Specific Disclosures

Because Travatu is distributed via the Apple App Store, the following additional points apply:

• Apple is not responsible for this Privacy Policy or our data practices — Apple is a third-party beneficiary of our Terms of Use only
• We comply with Apple's App Store Review Guidelines on privacy and data collection
• Data collected within the app may be used to provide and improve features, as described in our App Store privacy nutrition label
• Push notifications require your permission and can be disabled at any time in Settings → Notifications → Travatu
• Location data (if used in future) will only be collected with your explicit iOS permission

14 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the law, or our services. When we do:

• We will post the updated policy at travatu.com/privacy with a new "Last updated" date
• For material changes, we will notify you via email or an in-app notice

Continued use of Travatu after changes are posted constitutes acceptance of the updated policy.

15 Contact Us