Privacy Policy

Savvy Jetsetter ("we," "our," or "us") operates the website located at https://savvyjetsetter.ca (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our Service. It also describes your rights under applicable privacy and data protection laws, including the EU General Data Protection Regulation ("GDPR"), the UK GDPR, the California Consumer Privacy Act ("CCPA"/"CPRA"), Canada’s Personal Information Protection and Electronic Documents Act ("PIPEDA"), Canada’s Anti-Spam Legislation ("CASL"), and other applicable global privacy frameworks.

By accessing or using our Service, you acknowledge that you have read this Privacy Policy and agree to its terms. If you do not agree, please discontinue use of the Service.

1. Who We Are

Savvy Jetsetter is operated by Savvy Jetsetter, a certified travel advisor affiliated with Fora Travel, based in Ontario, Canada. For purposes of applicable data protection law, Savvy Jetsetter / Savvy Jetsetter is the data controller of your personal information.

• Controller: Savvy Jetsetter operating as Savvy Jetsetter
• Email: info@savvyjetsetter.ca
• Phone:
• Jurisdiction: Ontario, Canada, Canada

2. Data We Collect

2.1 Information You Provide

• Account data: Name, email address, and password when you register.
• Trip planning inputs: Destination, travel dates, group size, budget, and interests you enter into the trip planner.
• Payment data: Billing details processed by Stripe (we do not store card numbers on our servers).
• Inquiry / consultation data: Information you voluntarily submit via our booking or contact forms.
• Communications: Emails or messages you send us.

2.2 Information Collected Automatically

• Usage data: Pages visited, features used, time on site, clickstream data, and error logs.
• Device data: IP address, browser type, operating system, referral URL.
• Cookies and similar technologies: See Section 5.

2.3 Information from Third Parties

• Payment confirmation and transaction metadata from Stripe.
• Email delivery and open/click analytics from Brevo.

3. How We Use Your Data

• To create and manage your account and provide the Service.
• To generate AI-powered travel itineraries and digital travel guides using the inputs you provide.
• To process payments and fulfil purchases (credits, upgrades, digital guides).
• To send transactional emails (receipts, itinerary delivery, account verification).
• To send marketing communications only with your explicit consent (CASL / GDPR compliant opt-in).
• To improve the Service through anonymised analytics.
• To prevent fraud, enforce our Terms of Service, and comply with legal obligations.
• To respond to inquiries and provide customer support.

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

4. Legal Basis for Processing (GDPR / UK GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, we rely on the following lawful bases under Article 6 GDPR:

• Contract (Art. 6(1)(b)): Processing necessary to perform the service you requested (account, itinerary generation, payment fulfilment).
• Legitimate interests (Art. 6(1)(f)): Analytics and fraud prevention, where our interests are not overridden by your rights.
• Consent (Art. 6(1)(a)): Marketing emails and non-essential cookies — you may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)): Compliance with applicable laws (e.g., tax records, anti-money laundering).

5. Cookies & Tracking Technologies

5.1 Cookie Categories

We group cookies into four categories. Non-essential categories are blocked until you consent via the banner or the “Cookies” button in the bottom-left corner of every page.

5.2 Managing Your Cookie Choices

• Consent is stored in the sj_consent cookie (1-year expiry, SameSite=Lax, Secure).
• Withdrawing consent is as easy as giving it — click the Cookies button and adjust.
• You can also block all cookies via your browser settings; note that blocking necessary cookies will impair the Service’s functionality.
• Consent decisions are logged with a policy-version number. When we materially update our cookie practices we bump the version and re-show the banner to all users.

We do not place any cookies for cross-site behavioural advertising. We do not sell or share browsing data with data brokers.

6. Third-Party Service Providers

We share data with the following sub-processors only to the extent necessary to deliver the Service. Each is contractually bound to process data only on our behalf and in accordance with applicable law:

Your itinerary inputs (destination, dates, interests) are transmitted to Anthropic’s Claude API solely for the purpose of generating your itinerary. We do not share your name, email, or payment information with Anthropic.

7. International Data Transfers

Our service providers are primarily located in the United States and Canada. If you are based in the EEA, UK, or Switzerland, your data may be transferred outside your jurisdiction. We ensure such transfers are protected by:

• Standard Contractual Clauses (SCCs) adopted by the European Commission.
• Adequacy decisions where applicable (e.g., Canada under PIPEDA is recognised as adequate by the EU).
• Provider-level compliance certifications (e.g., Stripe and Vercel are certified under applicable frameworks).

8. Your Privacy Rights

8.1 Rights Under GDPR / UK GDPR (EEA & UK Residents)

• Right to access: Request a copy of your personal data.
• Right to rectification: Correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): Request deletion of your data, subject to legal retention obligations.
• Right to restriction: Ask us to pause processing while a dispute is resolved.
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent: Revoke marketing consent at any time without affecting prior processing.
• Right to lodge a complaint: Contact your national data protection authority.

8.2 Rights Under CCPA / CPRA (California Residents)

• Right to know: Request disclosure of the categories and specific pieces of data we have collected about you.
• Right to delete: Request deletion of personal information, subject to exceptions.
• Right to opt-out of sale / sharing: We do not sell or share personal information as defined under CCPA.
• Right to correct: Request correction of inaccurate personal information.
• Right to non-discrimination: We will not discriminate against you for exercising any CCPA rights.

8.3 Rights Under PIPEDA (Canadian Residents)

• Right to access your personal information and request corrections.
• Right to challenge our compliance with this policy.
• Right to withdraw consent, subject to legal or contractual restrictions.

To exercise any of your rights, contact us at info@savvyjetsetter.ca. We will respond within 30 days (or sooner as required by applicable law). We may ask you to verify your identity before fulfilling your request.

9. Data Retention

• Account data: Retained for as long as your account is active, plus 2 years after account deletion for fraud prevention, then securely deleted.
• Itinerary data: Retained for the life of your account. You may delete itineraries from your dashboard at any time.
• Payment records: Retained for 7 years to comply with Canadian and international tax/accounting obligations.
• Email logs: Retained for up to 12 months by Brevo for deliverability and legal compliance.
• Server / access logs: Retained for up to 90 days on our hosting provider (Vercel).

10. Security

We implement industry-standard organisational and technical measures to protect your personal information:

• All data transmission is encrypted via TLS 1.2+ (HTTPS only).
• Database access is protected by row-level security (RLS) policies.
• Passwords are never stored in plaintext — authentication is handled by Supabase Auth.
• Payment card data is never stored on our servers — handled exclusively by Stripe (PCI-DSS compliant).
• Admin access is restricted to specific verified email addresses and role-based controls.

No method of transmission over the Internet is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security. In the event of a data breach, we will notify affected users and relevant authorities as required by applicable law.

11. Children’s Privacy

The Service is not directed at children under the age of 16 (or 13 in jurisdictions where applicable). We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us immediately and we will delete it promptly.

⚠️ 12. Liability Disclaimer & Travel Advisory Notices

12.1 AI-Generated Content Disclaimer

Savvy Jetsetter uses artificial intelligence (Anthropic Claude) to generate personalised travel itineraries and destination guides. All AI-generated content is provided for informational and inspirational purposes only. It does not constitute professional travel, legal, medical, financial, or safety advice.

AI-generated itineraries may contain:

• Inaccurate, outdated, or hypothetical information about destinations, venues, prices, visa requirements, or entry conditions.
• Suggestions for businesses, hotels, or restaurants that may have closed, changed ownership, or altered their offerings.
• Generalised information that may not apply to your specific circumstances, nationality, or travel needs.

You are solely responsible for independently verifying all travel information, including but not limited to: visa and entry requirements, health and vaccination requirements, travel advisories, local laws and customs, hotel and venue availability, pricing, and safety conditions.

12.2 No Professional Travel Agency Representation

Savvy Jetsetter is a certified travel advisor affiliated with Fora Travel. However, the automated, AI-generated itinerary and guide products on this platform do not constitute the services of a licensed travel agent and do not create an advisor-client relationship. An advisory relationship is only established through a separate, explicit consulting engagement directly with Savvy Jetsetter.

12.3 Travel Insurance

We strongly recommend that all travellers purchase comprehensive travel insurance covering trip cancellation, medical emergencies, evacuation, and baggage loss before any trip. Savvy Jetsetter is not responsible for any losses, costs, or damages arising from failure to obtain adequate travel insurance.

12.4 Limitation of Liability

To the maximum extent permitted by applicable law, Savvy Jetsetter and Savvy Jetsetter shall not be liable for any direct, indirect, incidental, special, consequential, or punitive damages arising from or relating to:

• Your use of, or inability to use, the Service or any AI-generated content.
• Any reliance on AI-generated itineraries, guides, visa information, or travel recommendations.
• Travel disruptions, cancellations, health incidents, safety incidents, or losses of any kind during travel.
• Third-party services, websites, businesses, or vendors referenced in any itinerary or guide.
• Service outages, data loss, or security incidents beyond our reasonable control.

In jurisdictions where the exclusion or limitation of liability is restricted by law, our liability is limited to the maximum extent permitted. In no event shall our total liability to you exceed the amount you paid to us in the 12 months preceding the claim, or CAD $100, whichever is less.

12.5 Third-Party Links & Services

Our Service may contain links to third-party websites, booking platforms, or services. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party sites or services. We encourage you to review the privacy policies of any third-party site you visit.

12.6 Government Travel Advisories

Before travelling to any destination, consult your government’s official travel advisory website:

• 🇨🇦 Canada: travel.gc.ca/travelling/advisories
• 🇺🇸 United States: travel.state.gov
• 🇬🇧 United Kingdom: gov.uk/foreign-travel-advice
• 🇦🇺 Australia: smartraveller.gov.au
• 🇪🇺 EU: ec.europa.eu/consularprotection

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For material changes, we will notify registered users by email at least 14 days before the change takes effect. Your continued use of the Service after the effective date constitutes acceptance of the revised Policy.

14. Contact Us & Data Protection Requests

For all privacy inquiries, data subject access requests, or to exercise your rights:

• Email: info@savvyjetsetter.ca
• Mail: Savvy Jetsetter, Toronto, Ontario, Canada

If you are an EEA or UK resident and believe we have not adequately resolved your complaint, you have the right to contact your local supervisory authority. For a list of EU data protection authorities, visit edpb.europa.eu.