Privacy Policy

Who we are

Effective October 1, 2026. Levayro is operated by Nico Tyndale. This policy describes the current travel-planning service. Contact us through the Contact page for privacy questions or requests.

What we collect

When you create or complete a profile, we collect your name, contact email, international phone number and age (18 or older). We assign a unique six-digit account number for support lookup. Contact details are self-reported and are not verified recovery credentials. We do not send SMS or use phone numbers for marketing. The saved age is your age at the latest profile update; we do not collect your birth date. Profile demographics reports show aggregate age bands and complete/incomplete counts, excluding missing ages from age-group comparisons. These reports describe retained completed profiles rather than all website visitors. You can correct your details in My account. Sign-in passwords and recovery codes are handled by the sign-in provider, not Levayro.

The master administrator can assign limited access to authorized staff for reporting, user support and communications. Sensitive website, connection, finance, security and administrator settings are restricted to the owner’s Super Admin Vault. Staff only receive the sections assigned to them. Administrator records store the assigned sign-in email, name, permissions and enabled status until the master revokes access or updates the record. Account-support staff may look up registered six-digit account numbers, profile names, contact emails, phone numbers, supplied ages, profile completion status, join dates and retained trip counts. Only the owner with an unlocked vault can update these profile details. Changes do not modify sign-in credentials, verification status or support-case reply preferences. They cannot view your external sign-in password or reset it.

Authorized communications staff may prepare individual account-support emails to registered profile addresses. Service drafts and delivery records are retained for up to 90 days. Drafts send nothing until an administrator submits them and a verified sender is connected. Profile deletion removes saved drafts; undelivered emails are cancelled if the recipient profile is deleted or its address changes. These tools do not enable bulk marketing campaigns.

Browsing the planner does not create a Levayro profile. When you sign in with ChatGPT, the hosting platform forwards a site-specific user ID, your email and, when available, your display name. After you consent to create a profile, we store your ID, email, display name, registration time and the accepted terms version, acceptance time and your express arbitration acknowledgment. Feedback threads and replies store your signed-in user ID, account email, contact email, subject, reply preference, selected category, message, status, timestamps and authorized administrators’ replies. They are private to the submitting account and administrators assigned communications access and are retained for up to 90 days after the latest activity. Profile replies appear on the Feedback page and refresh while the page is open. If you choose email, the admin can reply separately through the support mailbox to the address you provide; that address is not automatically verified. When you select email replies and a verified email service is connected, an admin reply is also sent to your signed-in account email through Resend. Delivery attempts and provider acceptance IDs are stored for up to 90 days; provider acceptance does not guarantee inbox delivery. Messages remain in your profile if email is unavailable. Deleting your online profile also removes its feedback threads and contact submissions. Emailing support uses your own email provider and Google/Gmail as the support mailbox provider; do not send sensitive documents, passwords or payment information. Support emails are retained while needed to handle your request, ordinarily up to 90 days after resolution, except where longer retention is legally needed. Contact submissions store your signed-in ID, email, message and submission time for up to 90 days or as needed to resolve a legal request. The site owner can review these messages. We store trip inputs and calculated estimates only when you choose Save trip. Saved inputs can include a preferred destination, departure city, date, budget, traveler count, selected airport identifier, premium-travel preferences and optional spending target, entered quote amounts, itinerary stops and times, personal planning notes, provider names, booking status or payment totals you record, and price-watch target amounts, residence country, scheduled-check choices and optional email-alert consent. Enabled watches can send travel dates, airport codes, occupancy and cabin preference to connected suppliers during scheduled checks. They do not include your profile identity or planning notes. Latest category totals and check status are stored with the trip. If you opt in to target alerts, your account email and a trip link are sent to Resend for delivery; you can turn these off in the saved trip. No automatic coupon application is performed. Booking status is user-reported; we do not retrieve confirmations from providers. The installable app stores up to 50 offline trip copies locally on your device; these do not sync with your online profile. The web app also accesses your cloud-saved trips and itineraries through the same signed-in profile when online. Removing an online profile does not remove those device copies. Hosting and sign-in providers may process technical data such as IP address and request logs for service operation and security under their own policies.

How we use information

We use profile data to identify your account, display your saved trips, enforce ownership permissions and administer the service. The administrator can view aggregate profile and saved-trip counts, destination popularity by total trip budget range, median saved-trip budgets and aggregate user-reported booking-status counts. These reports use retained saved trips, do not expose profile identities or itinerary notes, and do not represent provider-confirmed bookings. A separate aggregate search-interest report counts valid submitted planner searches, including unsaved searches. We do not send promotional emails in this version, collect payment-card information, or receive your authentication password. Do not put passport numbers, payment information or other sensitive details in your display name or messages.

Cookies, tracking and sharing

The authentication and hosting providers may use cookies or similar technology needed for sign-in and security. Levayro does not add advertising pixels, cross-site behavioral tracking or analytics visitor identifiers. Public page loads and navigation contribute to daily aggregate totals without visitor identifiers. Visitors can separately enable optional first-party activity statistics. We do not sell your profile information or share it for targeted advertising. Data is processed by hosting, storage and authentication providers to deliver the service and may be disclosed where legally required or needed to protect the service. Sharing buttons hand the URL to a service you choose; clicking an external link subjects your activity there to that provider's policy.

Browser privacy signals & external searches

Levayro reads Global Privacy Control in Your privacy choices and treats it as an opt-out of sale, sharing for cross-site advertising and targeted advertising. Advertising and cross-site behavioral tracking remain off for everyone. Optional anonymous activity statistics are disabled by default and are also suppressed by Global Privacy Control or Do Not Track. Do Not Track suppresses the optional activity statistics as described below. Its current service does not add cross-site advertising trackers, sell personal data or share it for targeted advertising, regardless of those signals. This statement does not describe or override the separate practices of authentication, hosting or external search providers. If our processing changes, we must update this policy and implement applicable consent and opt-out requirements before starting that processing.

Opening a stay search can disclose your selected destination, traveler count, room count and travel dates to Booking.com; transport and map searches can disclose the search terms to Google. Premium searches can include your preferred cabin, trip type, destination, dates and traveler count, and can direct a Google search to specific travel providers. External services may collect technical information and track activity under their own policies. We do not send your budget, saved planning notes or profile details in these search links. Search-engine indexing may make public website pages discoverable; saved-trip pages require sign-in and ownership checks. Do not post sensitive information in planning notes or messages.

Live price comparisons & sponsorships

When you submit Compare prices, Levayro sends selected airport codes, travel dates, adult traveler and room counts, cabin and refund preferences, residence country and optional US state to configured Booking.com, Expedia Rapid and Duffel APIs as needed to obtain offers. Budget, reserve, daily spending allowances, profile identity and planning notes are not sent to these APIs. Search results are returned to your browser without a Levayro price cache or saved search history. Suppliers and hosting providers process requests and may retain service logs under their own policies. A temporary hash of the hosting-provided client IP and a 15-minute time window is stored for request throttling and removed during later searches after the next window. Sponsor advertisements are text and links served by Levayro without ad pixels; opening a sponsor or affiliate link subjects your activity to that external provider’s practices. No optional ad-network scripts are loaded. An owner-configured ads.txt publisher entry does not itself load advertising or trackers.

Aggregate public website traffic

Successful public page loads and refreshes are counted on the server. Navigation between public pages is counted using a first-party request from the browser, including when the router reuses a cached page. These totals are collected regardless of privacy-notice acknowledgment, optional analytics consent, Global Privacy Control or Do Not Track. They use no analytics cookies, browser storage, persistent visitor identifiers, profile identity or cross-site tracking. Only UTC date, public page route, page-load or navigation category, broad recognizable-bot category, hosting-supplied approximate country, region and city, and aggregate count are retained for up to 90 days. Location is estimated by the hosting network; VPNs, proxies and mobile networks can make it inaccurate or unavailable. We do not request GPS or precise device location. Query strings, IP addresses, full browser strings, names, emails and account details are not stored in these totals. Admin, private account and trip pages, APIs, assets, failed responses and recognizable prefetches are excluded. Totals measure page requests, not unique visitors; repeat visits count again and unrecognized bots can remain. Offline views and requests that never reach our counting system are unavailable. Necessary request-abuse controls and hosting logs remain subject to the separate security practices described here.

Aggregate planner search interest

Valid planner search submissions contribute to aggregate destination and budget reports regardless of optional activity-statistics choices, Global Privacy Control or Do Not Track. These use no analytics cookies, browser storage, persistent visitor identifiers, account identity or cross-site tracking. We retain UTC date, canonical destination city/country (or Any / multiple destinations), total trip budget rounded to whole USD, traveler count and aggregate count for up to 90 days. Raw typed search text, travel dates, departure origin, IP addresses, profile identity and planning notes are not stored in these reports. Repeated searches count again; these are not unique people, saved trips or confirmed bookings. Premium searches without an explicit budget target do not contribute a budget sample. Known bots and invalid submissions are excluded. Search-budget medians are approximate because budgets are rounded before aggregation. Old unsaved searches cannot be recovered. Browser request failures, offline searches or blocked reports may prevent counting.

Optional anonymous activity statistics

If you enable anonymous statistics in the notice checkbox or Privacy choices, Levayro counts views of public pages, broad traffic-source and device categories, network-supplied country when available, outbound link categories and planner interactions. The reports store daily aggregate counts for up to 90 days. They contain no names, emails, profile IDs, persistent analytics IDs, raw IP addresses, full referrer URLs, query strings, budgets or destination search text. Admin, account and private saved-trip pages are excluded. A sessionStorage flag records whether this tab has already contributed a browser-tab session count; it contains no identifier and disappears when the tab session ends. These counts approximate browser activity, not unique individuals. A temporary hash of the network-provided client IP and a 10-minute time window is used to limit submission abuse and removed during later submissions after the next window. Hosting security logs may separately process IP addresses under hosting policies. The owner may download aggregate reports for business or partnership discussions. You can disable future statistics in Privacy choices; aggregate records already counted cannot be attributed to you or removed individually. Global Privacy Control and Do Not Track suppress traffic collection. Accepting or dismissing the privacy notice alone does not enable statistics unless you actively select the checkbox.

Travel news

City or country searches and selected news topics are sent through our server to The GDELT Project to discover publisher headlines. The server also obtains a shared public RSS feed and sends city or country searches to Wikivoyage to find published destination guides. Profile information, budgets and saved-trip notes are not included. Headlines and normalized search terms are cached without a visitor identifier and removed during later successful checks after two days without use; destination-guide results are cached for up to one day and subject to the same cleanup. Hosting and external providers may process service logs under their own policies. Opening a news article sends you to the independent publisher and its privacy practices. News is requested when the page is opened or searched and periodically while visible; it is not a continuous emergency monitoring service.

Currency rates & your preferences

When updated exchange rates are enabled, currency screens contact ExchangeRate-API, which may receive your IP address and browser/network information under its own policy. Your budget, profile and trip details are not included in the rate request. You can disable future requests in Your privacy choices and use dated stored rates. We store your privacy selections and acknowledgment on this browser/device under levayro-privacy-v1; clearing browser storage removes that record. This preference does not sync across devices. Read Cookies & local storage for the current storage categories.

Storage, retention and security

Profiles and saved plans are stored on the site's hosted database until you delete them or removal is required for service operation. Necessary security controls limit requests using a temporary hash of your site-specific account ID or hosting-provided network address and a 15-minute window; raw addresses and account IDs are not stored in these counters. Old counters are removed during later requests after the next window. An owner-only action log stores administrator request times, routes and response status codes for up to 30 days, capped at 1,000 entries; it does not store request contents, passwords, tokens, IP addresses or visitor messages. Appropriate access controls are used, but no system can guarantee perfect security. Service providers may retain security logs, backups or records as required by their own practices or law. Data may be processed in countries other than yours; applicable rights depend on your jurisdiction.

Your choices and rights

You may browse without signing in, remove individual saved trips, or delete your Levayro profile and all its saved trips on My account. Deleting your Levayro profile does not delete your ChatGPT account or third-party bookings. To request access, correction or other rights available under applicable law, use Contact and identify your request and jurisdiction. Depending on applicable law, rights may include access, correction, deletion, a portable copy, limits on certain processing, an authorized-agent request and an appeal of a denied request. To request review of a denial, submit an appeal through Contact. We respond under the requirements and timelines that apply to the request. We do not promise rights or processing exemptions that do not apply. We may verify identity before fulfilling a request. Necessary provider records may remain after deletion as described above.

Age and policy changes

Profile creation is for adults 18 and older. We do not knowingly solicit profiles from minors; contact us if you believe a minor supplied information. We will update this policy when actual processing changes, and will seek any consent required by law. Material changes will be announced through the service, and the effective date identifies the current version.