Privacy Policy

1. Information We Collect

A. Information You Provide Directly

• Account Information: Name, email address, password, phone number, and profile details when you register.
• Booking & Payment Information: Travel preferences, dates, passenger names, billing address, and payment card details when you make a reservation. Payment data is processed by PCI-compliant processors — we do not store full card numbers.
• Identity Verification: Government-issued ID or other documents required to activate your Goody Wallet for payouts.
• Communications: Messages you send to our customer support team, reviews, or survey responses.
• Corporate Accounts: Company name, tax identification, and designated billing contacts if you register as a corporate account.

B. Information Collected Automatically

• Usage Data: Pages visited, features used, search queries, clicks, and browsing behavior on our Platform.
• Device & Log Data: IP address, browser type, operating system, device identifiers, crash reports, and referring URLs.
• Location Data: General location inferred from IP address; precise location only if you grant permission in our mobile app.
• Cookies & Tracking Technologies: See Section 4 for full details.

C. Information from Third Parties

• Travel Suppliers: Confirmation data, booking status, and itinerary details from hotels, airlines, and car rental providers.
• Referral Partners & Affiliates: Information about how you arrived at our Platform from partner or affiliate sites.
• Social Login: If you connect via Google or another social provider, we receive basic profile data as permitted by that provider.
• Fraud Detection Services: Risk scores and signals to protect against unauthorized transactions.

2. How We Use Your Information

• Processing and managing your bookings and reservations
• Processing payments and managing financial transactions
• Operating the Goody Points rewards program, including points accrual, maturation, nonprofit donation, and payout
• Providing customer service and responding to inquiries
• Sending booking confirmations, receipts, cancellation notices, and travel itineraries
• Personalizing your experience and recommending travel options
• Sending promotional emails, SMS updates, and push notifications (with your consent where required)
• Running our referral and affiliate programs
• Improving our Platform through analytics, A/B testing, and user research
• Detecting, investigating, and preventing fraud, abuse, and illegal activities
• Complying with legal obligations and enforcing our Terms of Service
• Fulfilling corporate account reporting and billing requirements

3. How We Share Your Information

• Travel Suppliers: Hotels, airlines, car rental companies, and other travel providers receive the information necessary to fulfill your booking (e.g., guest name, dates, special requests).
• Payment Processors: Stripe and other PCI-compliant processors receive payment data solely to process your transactions.
• Service Providers: We share data with vendors who assist in email delivery (Mailgun), cloud hosting, analytics, push notifications (Firebase), and fraud prevention — all under strict data processing agreements.
• Nonprofit Partners: When you donate Goody Points to a nonprofit, we share your donation amount and contact information with that organization so they can acknowledge your contribution.
• Affiliates & Referral Partners: We share limited data (e.g., conversion events) with partners to track referrals and calculate commissions.
• Legal Compliance: We may disclose information when required by law, court order, subpoena, or government request, or to protect the rights, safety, or property of LetsGoSave or others.
• Business Transfers: If LetsGoSave is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on our Platform.

We do not sell your personal information to third parties for their marketing purposes.

4. Cookies & Tracking Technologies

We use cookies, web beacons, pixels, and similar technologies to operate and improve our Platform. Types of cookies we use:

• Strictly Necessary: Required for the Platform to function (e.g., session management, authentication, shopping cart). Cannot be disabled.
• Performance/Analytics: Aggregate data on how users navigate our Platform to improve design and functionality (e.g., Google Analytics).
• Functional: Remember your preferences such as language, currency, and saved searches.
• Advertising/Targeting: Track your browsing habits to deliver relevant ads on our Platform and partner sites. These may be set by our advertising partners.

You can manage cookie preferences through your browser settings or our Cookie Preferences tool. Note that disabling certain cookies may affect Platform functionality.

See our Cookie Policy for full details.

5. Your Privacy Choices

• Email Communications: Opt out of promotional emails by clicking "Unsubscribe" in any marketing email or managing preferences in your account settings. Transactional emails (booking confirmations, receipts) cannot be opted out of.
• SMS & Push Notifications: Manage in your account settings, or reply STOP to any SMS message.
• Access & Correction: Log in to your account to view and update your personal information. Contact us for additional assistance.
• Data Deletion: Request deletion of your account and associated data by emailing privacy@letsgosave.com. Note that some data may be retained as required by law or to resolve disputes.
• Cookie Preferences: Control via your browser settings or our Cookie Preferences tool. See Cookie Policy.
• Do Not Sell / Do Not Share: To opt out of data sharing for advertising purposes, visit our Your Privacy Choices page.

6. Data Security

We implement industry-standard security measures to protect your personal information, including:

• TLS/SSL encryption for data in transit
• Encryption of sensitive data at rest
• PCI DSS-compliant payment processing via Stripe
• Regular security assessments and vulnerability testing
• Role-based access controls limiting employee access to personal data

No method of transmission over the Internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. If we learn of a security breach affecting your data, we will notify you as required by applicable law.

7. Data Retention

We retain your personal information for as long as necessary to:

• Maintain your account and provide ongoing services
• Comply with legal, tax, and accounting obligations (typically 7 years for financial records)
• Resolve disputes and enforce our agreements

After you delete your account, we may retain certain data in anonymized or aggregated form for analytics purposes. You can request full deletion by contacting privacy@letsgosave.com.

8. Children's Privacy

Our Platform is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If we become aware that we have inadvertently collected information from a child, we will take immediate steps to delete such information. If you believe a child has provided us with personal information, please contact privacy@letsgosave.com.

9. International Data Transfers

LetsGoSave operates in the United States. If you are accessing our Platform from outside the U.S., your information may be transferred to, stored in, and processed in the United States or other countries where our service providers operate. These countries may have data protection laws that differ from those in your home country.

For transfers from the European Economic Area (EEA), UK, or Switzerland, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.

10. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected, used, disclosed, and sold about you.
• Right to Delete: Request deletion of your personal information, subject to certain exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out: Opt out of the "sale" or "sharing" of your personal information for cross-context behavioral advertising. Visit Your Privacy Choices.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
• Right to Limit Use of Sensitive Information: Limit our use of certain sensitive personal information.

To exercise your California rights, contact us at privacy@letsgosave.com or call +1 (844) 797-7283. We will respond within 45 days. You may designate an authorized agent to submit requests on your behalf.

In the past 12 months, we have collected the following categories of personal information: identifiers, commercial information, internet activity, geolocation data, and inferences. We have shared identifiers and commercial information with travel suppliers and payment processors for business purposes. We do not sell personal information as defined under CCPA.

11. Nevada Privacy Rights

Nevada residents may opt out of the sale of covered information by contacting us at privacy@letsgosave.com with "Nevada Privacy Request" in the subject line. We do not currently sell covered information as defined under Nevada law.

12. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR) or applicable national laws:

• Right of Access: Obtain a copy of your personal data.
• Right to Rectification: Correct inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your data under certain circumstances.
• Right to Restrict Processing: Limit how we use your data in certain situations.
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests or for direct marketing.
• Rights Related to Automated Decision-Making: Request human review of automated decisions that significantly affect you.

Our legal bases for processing include: performance of a contract (fulfilling your bookings), legal obligation (tax and compliance), legitimate interests (fraud prevention, analytics), and consent (marketing communications).

To exercise these rights, contact privacy@letsgosave.com. You may also lodge a complaint with your local data protection authority.

13. Use Through AI Assistants & Plugin Marketplaces

LetsGoSave may be available as a plugin, MCP server, or skill inside AI assistants and their marketplaces or directories, including ChatGPT and the OpenAI plugin directory, Claude and the Anthropic skills directory, Google Gemini and Google's extension marketplace, Microsoft Copilot and its plugin store, Perplexity, and other AI assistant platforms (each an "AI Assistant" and, collectively, "AI Assistants"). This section explains how your data is handled when you interact with LetsGoSave through one of those AI Assistants. The rest of this Privacy Policy applies to plugin-originated data the same way it applies to data you provide directly on the Platform.

A. What Data Is Shared Through the Plugin

• Travel Request Data: Destination, dates, number of travelers, preferences, and other search or planning parameters you enter into the AI Assistant.
• Account Identity: Your LetsGoSave email when you link your account to the AI Assistant, so we can attach searches, saved adventures, and bookings to your profile.
• Booking Details: Guest names, room or experience selections, and contact details required to reserve or confirm a booking.
• Conversation Content: The prompts you send and the responses the plugin returns as part of the AI Assistant conversation.

B. Recipients of Plugin-Originated Data

• AI Assistant Providers: When you use LetsGoSave through an AI Assistant, that provider (for example, OpenAI, Anthropic, Google, Microsoft, or Perplexity) receives and processes your prompts and our plugin's responses as part of operating the Assistant. How that provider handles conversation data is governed by its own privacy policy and terms.
• LetsGoSave: We receive the request data you submit through the plugin to fulfill your search, planning, and booking requests.
• Travel Suppliers & Processors: Booking and payment data is shared with the suppliers and processors identified in Section 3, on the same terms as data you provide directly.

C. Data Minimization & Restricted Data

The plugin collects only the minimum data needed to search for, plan, and book travel. Through the plugin we do not collect, solicit, or process payment card numbers or other data subject to PCI DSS, protected health information, government identifiers such as Social Security numbers, or authentication credentials or secrets. Payment for any booking is completed on LetsGoSave's secure checkout or directly with the travel supplier, never inside the AI Assistant.

D. No Plugin-Side Tracking or Profiling

The plugin does not track you across AI Assistant sessions, build behavioral or advertising profiles, or collect metadata such as IP addresses, timestamps, or query patterns beyond what is necessary to fulfill your request. We do not use the plugin to conduct surveillance or behavioral profiling of AI Assistant users.

E. Retention of Plugin Data

Conversation data held by the AI Assistant provider is retained according to that provider's policies. LetsGoSave retains account, booking, and itinerary data created through the plugin under the timelines in Section 7, and we keep only the request fields needed to provide and improve the service.

F. Your Controls

• Disconnect: You can unlink or remove the LetsGoSave plugin from any AI Assistant at any time through that Assistant's settings.
• Account Data: Your access, correction, and deletion rights in Sections 5, 10, and 12 apply to data created through the plugin, including requests submitted to privacy@letsgosave.com.
• Consent to Sensitive Data: Where any feature requires regulated sensitive data, we obtain your consent and disclose the use at the point of collection.

14. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by:

• Posting the updated policy on our website with a revised "Last Updated" date
• Sending an email notification to your registered address for significant changes

Your continued use of our Platform after the effective date of the revised policy constitutes your acceptance of the changes.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: