Privacy Policy

This policy covers pavilia.ai and the Pavilia web app. Pavilia is operated by Pavilia, LLC, 57 South Drive, Plandome, NY 11030, USA.

Pavilia is at pre-launch stage. If anything here is unclear, or you want a question answered before you sign up, email info@pavilia.ai.

For tickets, rooms, transport and rides, every planning step ends with a link out to a partner. You pay them, directly, under their terms and their privacy policy, and Pavilia never sees a card number, bank detail or billing address for that purchase.

For local tours booked through Pavilia, payment is taken on Stripe’s hosted checkout page. Stripe receives your card details, billing name and the amount; Pavilia receives a payment reference, the amount, the card brand and its last four digits, and the outcome. Pavilia never receives or stores your full card number.

Some fields are encrypted at rest rather than stored in plain text: your legal name, date of birth and any identity-document reference.

Pavilia is free. It earns an affiliate commission when you click through to a partner and book something. So when you tap a partner link, we record that it happened: which plan item, which partner, which step, and a one-way hash of the destination URL. We do not store the URL itself.

To stop that record being abused we also keep a keyed one-way hash of your IP address — never the address itself — purely as an abuse counter. It cannot be reversed into an IP.

You can browse published itineraries and click through without an account. Those clicks are recorded with no user attached.

Pavilia does not sell personal data. We use the following service providers, and each receives only what its job requires:

Analytics and session replay: PostHog records how screens are used only if you accept analytics, and never on chats, the trip planner, bookings and checkout, sign-in, or your account screens. What you type is masked and IP addresses are not stored. If your browser sends a Global Privacy Control signal we treat it as a refusal. Change your choice at any time on Your privacy choices; the cookies involved are listed in the Cookie policy.

Partner sites are separate. When you click through to Ticketmaster, Booking.com, Hostelworld, Yelp, Uber, Google Flights, Omio, GetYourGuide, you leave Pavilia. We attach an affiliate identifier to that link so the partner can credit us, and we deliberately suppress the referrer so the partner does not receive the Pavilia page address you came from. Once you arrive, that partner’s own privacy policy governs — not this one.

Tour operators are separate too. When you book a tour, the operator receives the details it needs to run it and handles them under its own privacy policy as well as ours. Operators are based in the EU.

Google Maps is separate too. Google Maps Platform shows the maps on destination pages. Google acts as an independent controller under its own terms and privacy policy (https://policies.google.com/privacy) and sets its own cookies while a map is on screen.

Data is processed in the United States. The application runs in Vercel’s iad1 region (US East) and every processor listed above, except the tour operators, stores data in the United States.

Pavilia is based in the United States, and your information is processed there. When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to a provider in the United States, we rely on the EU-U.S. Data Privacy Framework (and its UK Extension and the Swiss-U.S. Data Privacy Framework) where that provider is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses (with the UK International Data Transfer Addendum or Agreement, and the Swiss amendments, where relevant) in our data processing agreement or data protection terms with that provider.

If you verify your mobile number and opt in, we send you one-time verification codes and Pavilia Trip Alerts — text messages about your trips and tour bookings (for example, a reminder before a trip you planned, or a booking confirmation). We use Twilio, Inc. as our messaging provider to deliver these messages; Twilio processes your phone number and message content on our behalf. We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third parties, except with our messaging provider solely to deliver your messages, or as required by law. Message frequency varies, up to 10 messages per month. Message and data rates may apply. You can opt out at any time by replying STOP to any message or by turning off SMS in Settings; reply HELP or email info@pavilia.ai for help. We keep a record of your opt-in (date, time, a one-way hash of your IP address and the consent text shown) and of any opt-out for as long as needed to demonstrate compliance. See our SMS Terms.

How long we keep each kind of data:

• Account and profile data (including trips, saved places and posts): while your account is open, then deleted within 30 days of your deletion request.
• Legal name and date of birth given for a booking: deleted 90 days after your last booking.
• Session replays: 30 days.
• Error logs (Sentry): 90 days.
• Affiliate click records: de-identified, kept 13 months.
• Booking, payment and refund records: 7 years (tax and accounting law).
• SMS consent and opt-out records: for the life of your account plus 4 years.
• Database backups: deleted data can remain in encrypted backups until they roll off, within 7 days.

If you join a waiting list or subscribe to email updates without creating an account, we keep your email address for 24 months from your last engagement — an open, a click, or a visit — and delete it after that. Unsubscribing deletes it sooner, except for the suppression record described below.

When you unsubscribe we keep a minimal suppression record indefinitely. This is deliberate: it is the only way to guarantee we never email you again, and deleting it would defeat your own request.

Two things are kept in de-identified form on purpose: outbound click records (they are financial records reconciled against partner statements, and they carry no identity once your account is erased), and abuse counters, which are hashes and short-lived.

Tour-booking and payment records are financial records and are kept for as long as accounting and tax law requires, in de-identified form after your account is erased.

You can ask for a copy of your data, ask us to correct it, or ask us to delete it. Email info@pavilia.ai from the address on your account.

Erasure is implemented, not aspirational: it removes your identifying fields, disconnects your content from you, and writes an audit record that the erasure happened. Some things survive in de-identified form — a forum thread is not deleted out from under the people replying to it, and the click records described above are financial records.

If you are in the EU or UK you also have the right to complain to your local data protection authority. The supervisory authority for Pavilia is your own national authority. Pavilia has no establishment in the EU and has not yet appointed a representative under Article 27; if that changes this page will name them.

Pavilia is built for university students. You must be 18 or older to hold an account, and Pavilia is not intended for anyone under 18. We do not knowingly collect data from children.

We ask for your date of birth during onboarding so that traveller details are complete for bookings. Being straight with you about the limit of that: it is a profile field, not an enforced gate at sign-up. If we learn that an account belongs to someone under 18 we close it and delete the data.

If this policy changes materially we will update the date at the top and, where the change affects you, tell you directly. See also our Terms of Service.