Your plan stays yours.

Who operates Trip Planner

Trip Planner is operated by Karel Busta. This notice describes the v1 English-language product and its External Account Surface.

Before accepting orders in a new market, the operator must confirm the applicable legal, tax, and consumer-information details for that market.

What we receive

WorkOS provides the verified account identity and session information needed to sign in. You provide Trip Plan facts such as Travelers, Places, Stays, Travel Legs, Itinerary Items, Bookings, budgets, Constraints, Preferences, and Planning Sources.

Stripe provides payment and subscription events. The app keeps only the billing identifiers and entitlement information needed to provide access and meet legal or accounting obligations. Support messages contain what you choose to send.

Why we use it

• To save, validate, export, and display the Trip Plans you ask us to keep (contract performance).
• To authenticate accounts, prevent unauthorized access, recover failures, and protect the service (contract performance and legitimate interests).
• To reconcile payments, provide billing management, and retain required financial evidence (contract performance and legal obligations).
• To respond to support and security reports (legitimate interests and, where applicable, contract performance).
• Trip Planner's automated guidance derives consistency, readiness, freshness, and one recommended next action from the facts you choose to keep; it is not independent travel research or a behavioral advertising profile.
• Optional accessibility and dietary preferences are never required. Before either category is saved, Trip Planner requires a separate versioned opt-in in the preference change request; the opt-in receipt is stored with that preference, used only for planning, and can be withdrawn by deleting the preference.

What we do not keep

• Trip Planner rejects restricted data and does not persist original passports, tickets, booking documents, payment-card details, or other source documents.
• Operational records and error reports use opaque IDs and bounded outcome data. They are not a copy of your prompt, Trip Plan, vendor payload, email, token, or cookie.
• There are no advertising cookies, marketing profiles, session replay, or analytics trackers in v1.

Providers and transfers

Convex hosts application data and functions; WorkOS provides authentication; Stripe processes checkout and billing; Vercel serves the External Account Surface; and Sentry receives bounded diagnostic events. These providers process data under their own agreements and may process it outside your country. The operator maintains the provider-role and transfer record before public launch.

ChatGPT is the surface where you research and ask Trip Planner to act. Trip Planner receives only the tool inputs and facts needed for the requested operation, not the entire conversation transcript.

Retention and deletion

Trip Plan data remains until you delete it or delete the account. Account deletion blocks access immediately, removes product data through the resumable deletion workflow, and leaves only a detached completion receipt or legally required billing and tax evidence. Security and workflow records follow the category-specific retention schedule in the release evidence; they are not kept indefinitely.

You can export account and Trip Plan data from the External Account Surface before requesting irreversible deletion. A deletion request cannot be undone or transferred to another account.

Your choices and rights

Depending on where you live, you may have rights to access, correct, export, delete, restrict, or object to processing, and to withdraw consent for optional preferences. Contact support with enough information for us to locate your account; never send passwords, tokens, payment-card numbers, passports, or booking documents.

We respond asynchronously and target an initial response within three business days. That is an operating target, not a service-level agreement.