Privacy Policy

SriLankaTravel.ai (“we”, “us”) is an AI-assisted trip planning service for travel in Sri Lanka. This policy explains what information we collect when you use the site, why we collect it, how long we keep it, and the choices you have.

The short version: you can plan a full itinerary without creating an account. We store the trip you generate so you can return to it, we measure aggregate site usage, and we do not sell your personal information to anyone.

Trip planning inputs. When you use the planner we process the travel preferences you provide — travel dates or month, trip length, group composition, budget band, interests, pace, and any free-text notes you write. This is the information the itinerary is generated from.

Generated itineraries. We save the itinerary produced for you, together with a unique trip identifier, so that the link to your plan continues to work when you come back to it or share it.

Contact details, when you give them. If you email us, submit the contact form, request an expert review, subscribe to travel updates, or purchase a downloadable guide, we collect the email address and any other details you supply in that request.

Purchase information. Payments for paid guides are handled by PayPal. We receive confirmation of the transaction and the associated order reference. We never receive or store your full card details.

Technical and usage data. Standard server and analytics data — IP address, browser and device type, referring page, pages viewed, and approximate region. This is used in aggregate to understand which parts of the site are useful and to protect the service against abuse.

• To generate, save, and re-serve your itinerary.
• To respond to enquiries, expert review requests, and support messages.
• To deliver and provide support for guides you have purchased.
• To send travel updates if — and only if — you subscribed. Every message includes an unsubscribe link.
• To improve routing logic, seasonal recommendations, and content, using aggregated and de-identified patterns rather than individual trips.
• To detect, prevent, and investigate abuse, fraud, and technical faults.

If you are in the United Kingdom, the European Economic Area, or another region with comparable data protection law, we rely on the following legal bases:

• Contract — to generate and store the itinerary you asked for, and to fulfil guide purchases.
• Consent — for marketing emails and any non-essential analytics or cookies. You can withdraw consent at any time.
• Legitimate interests — to keep the service secure, to understand aggregate usage, and to improve the product, balanced against your rights.
• Legal obligation — where we are required to retain records, for example for tax purposes relating to purchases.

Itineraries are generated with the assistance of third-party large language model providers. Your planning inputs are transmitted to that provider for the purpose of producing your plan.

We use these providers under their API terms, which do not permit your inputs to be used to train their general-purpose models. Please avoid entering sensitive personal information — health details, identification numbers, or financial data — into free-text planner fields. The planner does not need it.

AI-generated itineraries are suggestions, not verified bookings or safety advice. See our Terms of Use for the limits of what the plan represents.

We do not sell your personal information. We share it only with the processors needed to run the service:

• Hosting and delivery — Vercel, which hosts the site and provides aggregate traffic analytics.
• Database and storage — Supabase, where saved trips, leads, and order records are stored.
• AI generation — OpenAI, for itinerary generation.
• Email delivery — Resend, for transactional email and travel updates.
• Payments — PayPal, for guide purchases.
• Content management and media — Sanity for editorial content, and Unsplash for destination imagery.

These providers may process data outside your country, including in the United States. Such transfers are covered by the providers’ standard contractual clauses or equivalent safeguards.

We may also disclose information where required by law, or to establish, exercise, or defend legal claims.

We use a small number of essential cookies and browser local storage entries to keep the planner working across a session — for example remembering your language preference and the identifier for the trip you are building.

Analytics is privacy-oriented and aggregate. We do not use advertising cookies or cross-site tracking pixels. You can clear cookies and local storage at any time through your browser settings; doing so may mean an in-progress trip is no longer linked to your browser.

• Saved itineraries — retained for 24 months from the last time the trip was opened, then deleted or anonymised.
• Enquiries and support email — retained for 24 months from the last message.
• Purchase and order records — retained for as long as required by applicable tax and accounting rules.
• Marketing subscriptions — retained until you unsubscribe, plus a suppression record so we do not email you again.
• Aggregate analytics — retained indefinitely in a form that does not identify individuals.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Have inaccurate information corrected.
• Have your information deleted.
• Object to or restrict certain processing.
• Receive your information in a portable format.
• Withdraw consent for marketing at any time.
• Lodge a complaint with your local data protection authority.

To exercise any of these, email hello@srilankatravel.ai or use the contact form. If you are asking about a specific saved trip, including the trip link helps us find it quickly. We respond within 30 days.

The service is intended for adults planning travel. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

We use HTTPS across the site, access controls on our database, and reputable infrastructure providers. No online service can guarantee absolute security, but we take reasonable technical and organisational measures appropriate to the sensitivity of the data we hold — which, by design, is minimal.

We may update this policy as the service evolves. The “last updated” date at the top reflects the most recent revision. Material changes affecting how we use your information will be highlighted on the site.

Questions about this policy or how we handle data: hello@srilankatravel.ai, or via the contact page.