Privacy Policy

1. Who We Are

Solavoy ("we", "us", "our") is an AI-powered travel planning platform operated by Beynelmilel, a digital product agency registered in Bursa, Turkey.

Data Controller: Beynelmilel, Bursa, Turkey
Contact: privacy@solavoy.com
Website: https://solavoy.com

2. Data We Collect

We collect the following categories of data:

We do NOT collect: name, email, phone number, payment information, passport or ID details, or any sensitive personal data (health, religion, ethnicity, etc.) unless you voluntarily provide them in the "notes" field.

3. Legal Basis for Processing (GDPR)

Under GDPR Article 6, we process your data based on the following legal grounds:

• Legitimate Interest (Art. 6(1)(f)): Providing travel planning services, security, fraud prevention, rate limiting
• Consent (Art. 6(1)(a)): Analytics cookies, location access, marketing communications
• Contract Performance (Art. 6(1)(b)): Generating the travel plan you requested
• Legal Obligation (Art. 6(1)(c)): Complying with applicable laws

4. How We Use Your Data

• To generate personalized AI-powered travel itineraries based on your inputs
• To suggest nearest departure airports based on your location
• To prevent abuse of our free service (rate limiting by hashed IP)
• To improve our AI models and service quality using anonymized feedback
• To track affiliate referrals for commission purposes
• To analyze usage patterns and fix technical issues
• To comply with legal obligations

We do not use your data for automated profiling that produces legal effects, targeted advertising based on sensitive attributes, or selling your data to third parties.

5. Third-Party Services & Data Sharing

We share data with the following third-party processors:

We do not sell, rent, or trade your personal data to any third party for marketing purposes.

6. Cookies & Tracking

We use the following types of cookies:

You can manage cookie preferences at any time using our Cookie Settings button (bottom of the page) or through your browser settings. Withdrawing consent does not affect the lawfulness of prior processing.

7. Location Data

When you click "Create My Plan", we request access to your device's geolocation solely to identify your nearest departure airport. This data:

• Is processed exclusively in your browser
• Is never stored on our servers
• Is converted to a city name via OpenStreetMap's Nominatim service
• Is discarded immediately after the airport is identified

You can deny location access at any time. If denied, we default to Istanbul as the departure city.

8. Affiliate Disclosure

Solavoy participates in affiliate programs. When you click partner links (Booking.com, Skyscanner, GetYourGuide, KKday, Searadar, KiwiTaxi, GetRentacar, etc.) and complete a booking, we may receive a commission.

9. Data Retention

• Travel preferences: Not stored on servers — only in your browser session
• Feedback data (ratings/comments): Retained for 24 months, then anonymized
• Hashed IP addresses (rate limiting): 24 hours
• Server logs: 30 days
• Pro membership keys: Until expiry or deletion request

10. Your Rights

Depending on your location, you have the following rights:

To exercise any of these rights, email privacy@solavoy.com. We will respond within 30 days (GDPR/KVKK) or 45 days (CCPA).

11. Children's Privacy

Solavoy is not directed to children under the age of 16 (or 13 in the US). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately at privacy@solavoy.com and we will delete it promptly.

12. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including the United States (Anthropic, Vercel) and Ireland (Supabase). Where we transfer data outside the EEA, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable
• Data Processing Agreements (DPAs) with all processors

13. Security

We implement industry-standard security measures including:

• HTTPS/TLS encryption for all data in transit
• IP hashing instead of storing raw IP addresses
• Row-level security (RLS) on our database
• API key encryption via environment variables (never in source code)
• Regular security reviews

No system is 100% secure. In the event of a data breach that affects your rights, we will notify you and relevant supervisory authorities within 72 hours as required by GDPR Article 33.

14. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes by posting a notice on our website and updating the "Last updated" date at the top of this page. Your continued use of Solavoy after changes constitutes acceptance of the updated policy.

15. Contact & Data Protection Officer

For privacy-related inquiries, data subject requests, or complaints:

• Email: privacy@solavoy.com
• General: info@solavoy.com
• Company: Beynelmilel, Bursa, Turkey

If you are located in the EU/EEA and are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority. A list of EU DPAs is available at edpb.europa.eu.