Privacy Policy

Effective: July 5, 2026

Who we are

TripThatFits is a service operated by Qvan LLC (d/b/a TripThatFits). You can reach us about anything on this page at legal@tripthatfits.com. We operate the website at tripthatfits.com. This policy explains what information we handle and why.

Information we collect

TripThatFits has no user accounts and no logins. We collect only what is needed to run and secure the Service:

• IP address — collected at the edge (via Cloudflare) and used for security and abuse-prevention rate limiting. It is stored transiently in a rate-limit table keyed by IP and time window, and is automatically pruned.
• Coarse geolocation — an approximate city/region derived from your IP at the network edge, used only to pre-select a sensible default "From" city. It is not stored.
• Request and log metadata — standard technical information (such as request time, path, and user agent) generated when you use the Service.
• Session identifier — a random ID generated in your browser and sent with your chat requests so a conversation stays associated during your visit. It is functional, not linked to your real-world identity, and it is not persisted after you leave.
• Your inputs — the search parameters you provide (origin, dates, budget, party size, travel mode) and any chat messages you type. Chat messages are stored server-side in a sessions table.
• Affiliate click events — when you click an outbound booking link, we record which partner and line item you clicked, the associated saved-plan id, a timestamp, and the price (and any drift) at the moment of the click, for commission attribution.
• Saved plans — if you click "Save this plan", we store that plan's destination, number of nights, itemized budget, and verification snapshot.

We do not collect: no accounts or passwords; no payment card data (no payments occur on our site — bookings complete on partner sites under their own terms); and no name or contact details unless you choose to type them into a chat message.

How we use information

• to provide, operate, and improve the Service;
• to keep the Service secure and prevent abuse (rate limiting);
• to attribute affiliate commissions on outbound bookings;
• to understand usage in aggregate.

Chat processing

To generate responses, the chat messages you send are transmitted to third-party large-language-model (LLM) providers — namely DeepInfra, Groq, xAI (Grok), and Anthropic (whichever is used to serve your request). These providers process the messages on our behalf to produce a reply.

Legal bases (GDPR)

Where the EU/UK General Data Protection Regulation applies, we rely on:

• Legitimate interests — to run and secure the Service, prevent abuse, and attribute affiliate referrals;
• Consent — where consent is required, for example for any non-essential processing; you may withdraw it at any time.

Sharing & sub-processors

We do not sell your personal information. We share data only with service providers that help us run the Service:

• Cloudflare — hosting, CDN, edge geolocation, and security (Workers, static assets, HSTS/CSP);
• Neon — our PostgreSQL database (accessed via Cloudflare Hyperdrive);
• LLM providers — DeepInfra, Groq, xAI (Grok), and Anthropic, to process chat messages;
• Affiliate partners — Viator, DiscoverCars, and Travelpayouts (Aviasales / Hotellook), only when you click out to them.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

Cookies & local storage

We set no cookies and do not persist data in your browser between visits. A functional session identifier exists only for your current visit. For details, see our Cookies & Tracking page.

Data retention

Transient security data (IP-based rate-limit records) is automatically pruned shortly after its time window closes. Affiliate click logs are retained for as long as needed for commission attribution and reconciliation. Saved plans and chat sessions are retained to keep the Service functional. We keep information no longer than reasonably necessary for the purposes described here.

Your rights

EU / UK (GDPR)

Subject to applicable law, you have the right to: access your data; request rectification of inaccurate data; request erasure; request restriction of processing; data portability; and object to processing based on legitimate interests. You also have the right to lodge a complaint with your local data-protection supervisory authority.

California (CCPA / CPRA)

California residents have the right to know what personal information we collect, to request deletion, and to request correction. You also have the right to opt out of the "sale" or "sharing" of personal information — although we do not sell or share personal information as those terms are defined. We will not discriminate against you for exercising any of these rights.

To exercise any right, email legal@tripthatfits.com.

International transfers

The Service is operated from, and data is processed in, the United States. If you access it from outside the US, you understand that your information will be processed in the US, which may have different data-protection laws than your country.

Children

The Service is not directed to children. We do not knowingly collect personal information from children under 16 (or under 13 where that is the applicable threshold). If you believe a child has provided us information, contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. Material changes take effect when posted with a new effective date.

Contact

Questions or requests? Email legal@tripthatfits.com.