LEGAL
Privacy Policy
Last updated: June 12, 2026
Contents
1. Who We Are
Tripvey is a global travel, trip planning, and traveller community platform, operated from Thailand and accessible at tripvey.com. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the Platform. For any privacy-related questions, contact us at contact@tripvey.com.
2. Data We Collect
We collect the following categories of data:
Account data
Email address, username, password (stored as a hash — we cannot read your plain-text password), and country.
Profile data
Avatar, bio, list of countries visited, and experience points.
Content data
Reviews, posts, trip plans, and photos you upload to the Platform.
Usage data
Pages visited, features used, search queries, and click events.
Device data
IP address, browser type, and operating system.
Cookies
Session tokens and user preference settings.
Data we do NOT collect
Government-issued ID documents, payment card numbers (booking payments are handled directly by booking providers and never pass through our systems).
3. How We Use Your Data
We use your data for the following purposes:
- Provide the Platform and continuously improve its features and user experience
- Personalize recommendations based on your travel history and preferences
- Send account-related emails (e.g. password resets, account notifications) — we do not send marketing emails without your explicit opt-in
- Detect fraud and enforce our Terms of Service
- Generate anonymized, aggregate analytics to improve the Platform
4. Legal Basis (GDPR & PDPA)
For EU users, we process your data on the following GDPR legal bases:
- Contract performance (Art. 6(1)(b)): Necessary to provide account services, process your content and trip plans.
- Legitimate interests (Art. 6(1)(f)): Security monitoring, fraud detection, and anonymous analytics.
- Consent (Art. 6(1)(a)): Marketing emails and other optional features.
For Thai users, data processing is carried out on the lawful bases set out in Section 24 of Thailand's Personal Data Protection Act (PDPA), including contract performance, legitimate interests, and your consent where applicable.
5. Third-Party Services
We use the following third-party service providers. Below is what data each receives:
Supabase (database & authentication)
Receives all user account data, content, and usage data. Data is stored in EU-region servers.
Vercel (hosting)
Receives server request logs and IP addresses.
Mapbox (maps)
Receives map tile requests; approximate location if you grant location permission.
TravelPayouts (affiliate)
Receives click tracking data and booking referral data. No personally identifiable information is shared.
None of these third-party providers may use your data for their own marketing purposes under our agreements with them.
6. Cookies & Tracking
We use the following types of cookies:
- Essential cookies: Session authentication and user preferences. These are necessary for the Platform to function and cannot be disabled.
- Analytics cookies: Anonymous usage statistics with no individual fingerprinting.
We do not use advertising cookies or tracking pixels from any ad networks. You can disable non-essential cookies via your browser settings, though this may affect some Platform features.
7. Data Retention
- Active account data: Retained while your account is active.
- Deleted account: Core profile data is deleted within 30 days of account deletion. Aggregate anonymized data may be retained for analytics purposes.
- Community posts: Deleted upon account deletion, unless you explicitly choose to retain your posts in anonymized form before deleting your account.
- Legal holds: Data may be retained for longer periods if required by law, such as to comply with legal proceedings or government investigations.
8. Your Rights (GDPR & PDPA)
Under GDPR (for EU users) and PDPA (for Thai users), you have the following rights:
- Access: Request a copy of the personal data we hold about you.
- Correction: Request that inaccurate or incomplete data be updated.
- Deletion ("right to be forgotten"): Request deletion of your personal data.
- Portability: Receive your data in a machine-readable format.
- Objection: Object to processing based on legitimate interests.
- Withdrawal of consent: Withdraw consent you have previously given at any time (without affecting processing carried out before withdrawal).
To exercise any of these rights, contact us at contact@tripvey.com. We will respond to your request within 30 days.
9. International Data Transfers
Your data is processed in Thailand by Tripvey and by EU-based Supabase. For EU users, transfers of data outside the EU are covered by Standard Contractual Clauses (SCCs), ensuring an adequate level of protection for your personal data.
10. Children's Privacy
The Platform is intended for users 18 years of age and older. We do not knowingly collect personal data from anyone under the age of 18.
If you believe that a minor has created an account or provided personal data, please contact us immediately at contact@tripvey.com. We will promptly delete the account and associated data.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be notified to you via the Platform at least 7 days before they take effect. We encourage you to review this page periodically to stay informed. Your continued use of the Platform after that period constitutes acceptance of the updated policy. This policy was last updated: June 12, 2026.
12. Contact & Complaints
For any privacy-related questions or requests, contact us at: contact@tripvey.com
EU users: If you believe we have not handled your data in accordance with applicable law, you have the right to lodge a complaint with your national Data Protection Authority (DPA).
You may also review our Terms & Conditions for more information.