Privacy Policy

travelzPro is operated by K.K. Rhymers, a company incorporated in Japan (Tokyo). We build software for inbound travel agencies to create, brand, and export client itineraries using AI-assisted generation.

Contact: desk@travelz.jp

travelzPro is a business-to-business (B2B) service. Our customers are travel agencies ("Customers"). Those agencies may upload or process personal data belonging to their own end clients ("End Users") inside the platform.

This policy covers two distinct categories of data:

• Account Data — information about you as a Customer account holder (name, work email, billing details).
• Customer Content — itinerary text, notes, briefings, and any personal data of End Users that Customers upload or generate inside the platform.

Account Data (you provide directly)

• Name, work email, agency name, job role.
• Password — hashed with bcrypt, never stored in plaintext.
• Billing information — processed entirely by Stripe. We store only a Stripe customer ID; card numbers never touch our servers.

Customer Content (you upload or generate)

• Trip notes, client briefings, and files you upload.
• AI-generated and manually edited itinerary text.
• Any personal data about End Users (traveler names, contact details, preferences) included in that content.

Usage Data (collected automatically)

• Pages visited, features used, and error events via server logs.
• Browser type, device type, and anonymized IP address.

We process data only where we have a lawful basis to do so:

• Contract — to provide, maintain, and support the travelzPro service you subscribed to (account management, AI generation, PDF export, billing).
• Legitimate interest — to diagnose bugs, monitor service health, improve features, and prevent fraud. We weigh this against your privacy interests and limit data used for these purposes to what is necessary.
• Consent — for any optional communications (product updates, feature announcements). You may withdraw consent at any time.
• Legal obligation — to comply with applicable laws, including tax record requirements (via Stripe).

We do not send marketing emails without your explicit opt-in. Transactional emails (account activation, password reset, invoice receipts) are sent under the contract basis.

Under applicable data protection laws (including GDPR and Japan's APPI):

• For Account Data, K.K. Rhymers acts as the data controller — we determine the purposes and means of processing.
• For Customer Content (including any End User personal data uploaded by Customers), K.K. Rhymers acts as a data processor on behalf of the Customer, who is the data controller responsible for that content.

Enterprise customers who require a formal Data Processing Agreement (DPA) may request one at desk@travelz.jp.

No training on your data. Customer Content sent for AI generation is transmitted to Anthropic (Claude API) solely to produce itinerary output. Under our agreement with Anthropic, your content is not used to train or improve their models. We do not permit our AI providers to retain or use your content beyond what is necessary to provide the service.

Important caveats:

• AI-generated output may contain inaccuracies. Always review itineraries before sharing with clients.
• Do not upload highly sensitive personal data (passport numbers, financial records, medical information) unless strictly necessary for the itinerary. travelzPro is not designed as a secure vault for sensitive personal records.
• Customers are responsible for ensuring they have the necessary rights and consents to upload any personal data belonging to End Users, including traveler information, contact details, or travel preferences.

We use the following processors to deliver the service:

• Anthropic (US) — AI generation. Content processed transiently; not retained for training.
• Stripe (US) — Payments and invoicing.
• Postmark / SendGrid (US) — Transactional email delivery.
• Hetzner / Render (EU / Japan) — Cloud infrastructure and hosting.

We do not sell your data to any third party. We may update our subprocessors from time to time. Material changes to this list will be communicated by email at least 14 days before taking effect.

K.K. Rhymers is based in Japan. Some of our subprocessors (including Anthropic and Stripe) are based in the United States. Your data may therefore be transferred to and processed in countries outside your country of residence.

Where such transfers involve personal data of EU residents, we rely on appropriate safeguards including Standard Contractual Clauses (SCCs) as approved by the European Commission. For transfers from Japan, we comply with the requirements of Japan's APPI.

Where available on your plan, you may select a preferred data hosting region. Contact us to confirm regional availability.

We retain data as follows:

• Account Data and Customer Content — retained while your account is active. Upon account deletion, data is queued for permanent deletion within 30 days.
• Server logs and usage data — retained for up to 90 days for debugging and security purposes, then deleted.
• Encrypted backups — may persist for up to 30 days after deletion to allow recovery from infrastructure failures, after which they are purged.
• Billing records — Stripe retains payment records as required by applicable tax and financial regulations.

To request deletion before account cancellation, email desk@travelz.jp. Requests are processed within 30 days.

We take reasonable technical and organizational measures to protect your data:

• All data in transit is encrypted via HTTPS/TLS.
• Passwords are hashed with bcrypt.
• Database backups are encrypted at rest.
• Access to production systems is restricted to authorized personnel.
• We conduct regular security reviews.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users without undue delay and in accordance with applicable law.

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your account and associated data.
• Portability — export your itinerary data in a portable format.
• Restriction — ask us to restrict processing in certain circumstances.
• Objection — object to processing based on legitimate interests.
• Withdrawal of consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email desk@travelz.jp. We will respond within 30 days.

If you are in the EU or EEA, you also have the right to lodge a complaint with your local data protection authority (e.g. your national DPA). In Japan, you may contact the Personal Information Protection Commission (PPC).

We use only strictly necessary cookies:

• A session authentication cookie, required to keep you logged in.

We do not use advertising cookies, third-party tracking pixels, or behavioral analytics that require consent under GDPR. No analytics or tracking tools that set persistent cookies are active on this site. If this changes, we will update this section and seek consent where required.

travelzPro is a B2B service for travel industry professionals. We do not knowingly collect data from individuals under 18 (or under 16 where applicable under local law). If you believe a minor has provided us with personal data, contact us and we will delete it promptly.

We may update this policy as the service evolves or regulations change. Material changes will be communicated by email to registered account holders at least 14 days before taking effect. Continued use after the effective date constitutes acceptance of the updated policy.

Privacy questions, DPA requests, or data subject rights requests: desk@travelz.jp