This Privacy Policy explains how TPixel, Inc. (“Tripp,” “we,” “us,” or “our”),
operator of heytripp.com and the Tripp AI travel assistant (the “Service”), collects, uses,
and shares information about you. Tripp helps you plan and book flights and hotels conversationally and, when you
authorize it, can book and pay on your behalf within limits you set. By using the Service, you agree to this Policy.
This Policy applies to information we process when you visit heytripp.com, create an account, interact with the
Tripp assistant, or book travel through the Service. It does not cover the privacy practices of the airlines, hotels,
payment processors, or other third parties whose services you use through Tripp; those parties have their own privacy
policies.
2. Information we collect
Information you provide
Account information: your name and email address, and authentication credentials (including
passkeys — see “Security”). If you sign in with Google, we receive your name, email address, and Google
profile picture from your Google account, and use them to create and identify your account.
Traveler details: date of birth, gender (as airlines validate it), contact phone, home airport,
airline/hotel loyalty numbers, and travel preferences (cabin, hotel star rating, budget, and similar).
Passport information: we record whether a valid passport is on file, its issuing
country, and expiration date so we can complete eligible bookings. We do not store your passport
number. You enter the passport number directly at checkout, where it is transmitted to the relevant
airline/booking provider to issue your ticket.
Conversations: the messages, prompts, and instructions you send to the Tripp assistant,
including trip details you describe.
Spending mandates: when you authorize Tripp to book and pay on your behalf, we record the
authorization itself — the limits you set (e.g., per-trip and per-item spending ceilings), the guardrails you
choose, your typed electronic signature, and a cryptographic record that the authorization was signed with your
passkey.
Payment information
Payments are processed by our payment processor, Stripe. We do not store your full
card number, CVC, or full bank details on our systems. To enable autopay we retain a payment token and limited details
(such as the card brand and last four digits) provided by Stripe. See our Terms of Service for how
autopay charges work.
Information collected automatically
Device & usage data: IP address, browser/device type, pages viewed, features used, and
timestamps.
Log data: technical logs we keep to operate, secure, and debug the Service.
Cookies: we use cookies necessary for the Service to function (see “Cookies & tracking”).
Information from third parties
Travel suppliers and our booking aggregator (e.g., LiteAPI and the airlines/hotels) — booking
confirmations, itinerary status, prices, and cancellation/refund updates.
Stripe — payment status, authorization results, and refund records.
We treat your passport details and payment information as sensitive and apply
additional safeguards to them. Avoid including sensitive personal information in free-text chat messages unless it is
necessary for your trip.
3. How AI processing works
Tripp uses artificial intelligence to interpret your requests, suggest trips, and prepare bookings. Your prompts and
relevant trip data are processed by AI models, which may be operated by third-party AI providers acting as our service
providers (subprocessors). Tripp never finalizes a charge on your behalf without an authorization you have signed, and
the safeguards you set on a spending mandate (such as asking before charging or before a non-refundable booking) are
enforced by our systems, not left to the model’s discretion.
4. How we use information
Provide, operate, and personalize the Service, including planning trips and presenting options.
Search for, arrange, and complete flight and hotel bookings you request or authorize.
Execute authorized autopay charges within the limits and guardrails of your spending mandate.
Process payments and refunds through Stripe.
Communicate with you about bookings, account activity, price alerts, and support.
Detect, prevent, and investigate fraud, abuse, and security incidents.
Maintain records (including an action/decision log of what Tripp did on your behalf) for transparency,
reconciliation, and dispute resolution.
Comply with legal obligations and enforce our Terms.
Improve and develop the Service.
5. How we share information
We share personal information only as described below. We do not sell your personal information, and we do
not share it for cross-context behavioral advertising.
Travel suppliers and aggregator: airlines, hotels, and our booking aggregator (e.g., LiteAPI)
receive the traveler and trip details needed to make and manage your booking. These suppliers are the providers of
the travel services and act as the merchant of record for the travel itself.
Payment processor: Stripe processes payments and, for authorized autopay, the charges Tripp
initiates as merchant of record for those transactions.
Service providers (subprocessors): AI model providers, hosting, analytics, communications, and
similar vendors that process information on our behalf under contract.
Legal & safety: when required by law, legal process, or to protect the rights, safety, and
security of users, the public, or Tripp.
Business transfers: in connection with a merger, acquisition, financing, or sale of assets,
subject to this Policy.
6. Cookies & tracking
We use cookies and similar technologies that are necessary to operate the Service (for example, to keep you signed in
and to secure your session). We aim to default to the most privacy-preserving settings and do not use non-essential
advertising cookies. Where required, we will present cookie choices and honor applicable browser opt-out signals such as
Global Privacy Control (GPC).
7. Data retention
We keep personal information for as long as your account is active and as needed to provide the Service, then for
the period required to meet legal, accounting, tax, fraud-prevention, and dispute-resolution obligations. Booking and
payment records may be retained longer where law requires. When information is no longer needed, we delete or
de-identify it.
8. Security
We use technical and organizational measures designed to protect your information, including encryption in transit,
managed key encryption for sensitive records, tokenized payment handling through Stripe, and passkey-based
(WebAuthn) authentication so that authorizations are cryptographically bound to your device. No method of transmission
or storage is completely secure, and we cannot guarantee absolute security.
9. Your privacy rights
Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal
information, and to object to or restrict certain processing. To exercise any right, contact us at
[email protected]. We will verify your request and respond as required by applicable law.
You may also have the right to lodge a complaint with your local data protection authority.
For users in the EEA/UK: we process personal data to perform our contract with you (providing and
booking travel), to comply with legal obligations, for our legitimate interests (operating, securing, and improving the
Service), and based on your consent where required (such as for certain cookies). You may withdraw consent at any time.
10. California privacy rights (CCPA/CPRA)
If you are a California resident, you have the right to:
Know / access the categories and specific pieces of personal information we collect, use, and
disclose.
Delete personal information we collected from you, subject to legal exceptions.
Correct inaccurate personal information.
Opt out of sale or sharing — note that we do not sell or share personal information for
cross-context behavioral advertising.
Limit the use of sensitive personal information (such as passport details and payment
information) to what is necessary to provide the Service.
Non-discrimination for exercising your rights.
Categories of personal information we collect include identifiers (name, email, IP), customer records (phone,
traveler details), characteristics such as age/gender, commercial information (bookings), internet/usage activity,
geolocation (approximate, from IP), and sensitive personal information (passport details on file, payment information).
We collect these for the purposes described in “How we use information.” To submit a request, contact
[email protected]; you may use an authorized agent. We will not discriminate against you for
exercising these rights.
11. Children
The Service is intended for adults 18 and older and is not directed to children. We do not knowingly collect personal
information from anyone under 18. If you believe a child has provided us information, contact us and we will delete it.
You may provide details of minor travelers in your party; that information is used only to arrange their travel.
12. International data transfers
We are based in the United States and process information there and in other countries where our service providers
operate. Where required, we use appropriate safeguards (such as standard contractual clauses) for cross-border
transfers.
13. Changes to this Policy
We may update this Policy from time to time. We will post the updated version here and revise the “Last updated” date,
and will provide additional notice where required by law. Your continued use of the Service after changes take effect
constitutes acceptance.
14. Contact us
Questions or requests about this Policy or your information:
TPixel, Inc.
Attn: Privacy
1808 Wedemeyer St
San Francisco, CA 94129
Email: [email protected]