At AI Concierge L.L.C-FZ (AI Concierge, we, us, or our), we are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and otherwise process personal information when you interact with us, including when you:
access or use our website located at https://aiconcierge.vip/, or any related websites, mobile applications or digital platforms that link to this Privacy Policy (collectively, the Service); and/or
engage with or use the travel, booking, concierge, and related services made available through the Service.
This Privacy Policy also applies, where relevant, to individuals whose personal information is processed in connection with bookings or travel arrangements made on behalf of others (including family members, colleagues, or travellers under a corporate or group programme), as well as representatives, employees, or authorised users of organisations that access the Service.
AI Concierge is an all-in-one travel platform that enables users to search, compare, book, and manage travel, including (as available) hotels, flights, trains, eSIMs, airport transfers, and related travel services.
This Privacy Policy does not apply to products, services, websites, or content offered by third parties (including travel suppliers and partners) that are governed by their own privacy policies.
By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Privacy Policy, you should not use the Service. If you use the Service on behalf of another person (for example, booking for a family member) or on behalf of an organisation (for example, your employer), you represent that you are authorised to do so and to accept this Privacy Policy on their behalf. You are responsible for ensuring that any individual whose Personal Information you provide to us has received appropriate notice of this Policy and (where required by applicable law) has provided valid consent.
CONTENTS
Overview
Definitions
Personal Information We Collect
Sources of Personal Information
How We Use Personal Information
How We Disclose Personal Information
Cookies, Analytics, and Similar Technologies
Interest-Based Advertising and “Do Not Track”
AI Features and Automated Processing
Security
Data Retention
International Transfers
Your Rights and Choices
Additional Notices for Certain Regions
Links to Third-Party Services
Use of the Service by Minors
Changes to This Privacy Policy
Contact Us
1) OVERVIEW
We obtain personal information from various sources to operate our Service and deliver travel-related functionality. This section provides a high-level summary; please read the full Policy for details.
A. Two common ways people interact with AI Concierge
Website visitors: People who browse our public pages, request information, sign up for updates, submit inquiries, or otherwise interact with us without booking.
Service users: People who create an account, build trips, book travel, manage travel, communicate with support, or use corporate/teams features (such as approvals, policy controls, traveller management, reporting, and spend controls), where available.
B. Controller vs. Processor (Important for Corporate/Teams)
Depending on your relationship with AI Concierge, we may process personal information in different roles:
When you use the Service for personal travel, AI Concierge generally acts as a controller (or similar data owner concept) for your personal information processed in connection with your use of the Service.
When your employer/organisation provides you access to corporate/teams features, the organisation is often the primary controller of employee/traveller information used for that organisation’s business travel program, and AI Concierge typically acts as a processor/service provider processing data on the organisation’s instructions (subject to our agreements and applicable law).
If you use the Service through a corporate program, your employer/organisation may have access to certain information (such as business travel itineraries, booking details, approvals, and traveller status) as configured by that organisation and as required to operate the program. Where AI Concierge acts as a processor/service provider, your organisation’s privacy notice will typically govern how the organisation uses that information.
Where AI Concierge acts as a processor/service provider for a Corporate Customer, our Processing is governed by the applicable services agreement and any data processing addendum (DPA) in place with that Corporate Customer. If you are a Traveller under a Corporate Customer program and wish to exercise rights relating to program data, you should contact your Corporate Customer administrator in the first instance, and we may coordinate with the Corporate Customer where required by applicable law.
2) DEFINITIONS
Personal Information means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked (directly or indirectly) with an individual.
Sensitive Personal Information (or similar concept) generally refers to certain categories of information that are subject to heightened legal protections (for example, certain government identifiers, precise geolocation, health-related details, biometric identifiers, and similar categories depending on applicable law).
Processing means any operation performed on personal information (for example, collection, storage, use, disclosure, or deletion).
Corporate Customer (or Organisation) means a business, entity, or group that uses AI Concierge’s corporate/teams features for its travellers or employees.
Traveller means an individual for whom travel is booked or managed through the Service (which could include you or another person you book for).
Account means the account you create (or that is created for you) to access and use the Service.
3) PERSONAL INFORMATION WE COLLECT
The Personal Information we collect depends on how you use the Service, what you choose to provide, and which features you use. Certain Personal Information is required to create an Account and/or complete bookings (including Travel Document Information required by Travel Suppliers or applicable law). If you do not provide the required information, we may be unable to provide the Service or complete your booking.
We collect Personal Information in the categories described below.
A. Information you provide to us
Contact and account information
Name, email address, phone number, username, password (or authentication tokens), profile photo (optional)
Organisation/company name, job title, department/team (for corporate use)
Emergency contact details (if you choose to provide them)
If you provide Personal Information about another individual, you confirm that you have authority to provide that information and that you have provided them with appropriate notice of this Policy and obtained any legally required consents.
Travel profile information
Date of birth, gender (where required for travel booking), nationality (often derived from travel documents)
Travel preferences (e.g., preferred cabin class, hotel style, bed type, amenities, transfer preferences, loyalty memberships)
Dietary and culinary preferences (such as vegetarian, vegan, pescatarian, dairy-free, no pork, and no beef preferences).
Allergy or intolerance information (such as nut-free or gluten-free requirements) where you choose to provide it. Depending on the applicable law, allergy or intolerance information may be treated as sensitive personal information and will be used only for the purpose of facilitating your travel arrangements and related support requirements.
Information about others (e.g., Travellers). If you book for or manage travel for another person, you may provide their Personal Information (including Travel Document Information).
Travel document and eligibility information (as needed for bookings)
Passport details and images, national ID details (where required), visa/residency information, known traveller/redress numbers (where applicable)
Traveller names exactly as on official documents, and other details necessary for booking and compliance
Document validity dates and issuing country/authority
Booking and itinerary information
Trip itineraries, travel dates, destinations, traveller selections, and booking references
Information needed to coordinate travel (e.g., arrival times for transfers, rail seat preferences, hotel check-in requests)
Payment and billing information
Billing address, payment method metadata (e.g., last four digits, expiration month/year), invoices/receipts (where available)
Note: Payment card details are generally processed by third-party payment processors. We typically do not receive or store full payment card numbers.
Communications and content
Messages you send to us (including customer support requests)
Content you create or upload in the Service (e.g., trip notes, itinerary titles, shared trip details, attachments)
Feedback, surveys, and preferences you share
Corporate/Teams program information (where available)
Travel policy settings (role-based permissions, budgets, approval routing)
Approver/admin details and audit logs for organizational workflows
Reports and analytics generated from program usage (often aggregated)
B. Information we collect automatically
We (and our service providers) may automatically collect information about how you access and use the Service, including:
Device and network data
IP address, device identifiers, browser type, operating system, language settings, approximate location (city/region inferred from IP)
Usage data
Pages/screens viewed, searches performed, clicks, session duration, referral sources, interaction patterns, crash logs, performance diagnostics
Cookies and similar technologies
Cookies, local storage, web beacons/pixels, SDKs (see Section 7)
C. Information from third parties
We may receive personal information from third parties, including:
Travel suppliers and partners (airlines, hotels, rail providers, transfer providers, eSIM providers, insurance providers) to confirm bookings, changes, cancellations, service delivery, and support
Payment processors for payment confirmation, fraud signals, and chargeback handling
Identity/document verification providers (if we offer verification features)
Corporate Customers (your employer/organisation) or designated travel admins, who may provide traveller profile details, eligibility, or program configurations
Authentication providers (e.g., if you use social login)
Analytics and marketing partners (subject to your choices and applicable law)
4) SOURCES OF PERSONAL INFORMATION
We collect personal information from:
You (when you create an account, build trips, book travel, contact support, or use other features)
People booking for you (e.g., a family member, colleague, or travel admin)
Corporate Customers (for business travel programs)
Service providers (payments, analytics, communications, security, hosting)
Travel partners and supply networks used to fulfil bookings
Your devices and browsers (automated collection)
5) HOW WE USE PERSONAL INFORMATION
We use personal information for the following purposes (and as otherwise described at the time of collection):
A. Provide and operate the Service
Create and manage accounts and traveller profiles
Facilitate trip planning, search, comparison, and booking
Process reservations, changes, cancellations, refunds, and related customer support
Provide confirmations, receipts, itinerary updates, travel reminders, and alerts (as available)
Coordinate travel services such as transfers, eSIM provisioning, or rail tickets (as available)
B. Communicate with you
Respond to inquiries and support requests
Send administrative messages (security notifications, service updates, policy changes)
Send booking-related communications (confirmations, schedule changes, disruption notifications where available)
C. Personalise and improve the Service
Remember preferences and traveller profile details to reduce re-entry
Provide smarter comparisons and recommendations based on preferences and usage
Analyse usage trends, measure feature performance, and improve reliability and UX
Conduct research and development, including creating aggregated or de-identified data for analytics and product improvement
Where feasible, we use aggregated or de-identified information for analytics and product improvement.
D. Corporate/Teams program operations (where available)
Enable approvals, policy checks, spend controls, and travel continuity features
Provide reporting, reconciliation support, and operational oversight for the organisation
Maintain audit logs and administrative records for security and compliance
E. Marketing and promotions (subject to your choices)
Send newsletters or product updates (where permitted)
Run promotional campaigns and measure effectiveness
Invite you to demos, betas, or events (where applicable)
You can opt out of marketing communications as described in Section 13(b).
F. Security, fraud prevention, and compliance
Protect accounts, prevent misuse, and investigate suspicious activity
Detect and prevent fraud, identity theft, and unauthorised access
Enforce our terms and policies
Comply with applicable laws, regulations, and lawful requests
Maintain records needed for accounting, tax, dispute resolution, and compliance obligations (including, where applicable, identity verification and anti-fraud requirements)
Legal Bases (EEA/UK)
If you are located in the EEA or the UK, we process Personal Information only where we have a lawful basis to do so. Depending on the context, our lawful bases may include:
performance of a contract (e.g., to create accounts and facilitate bookings);
legitimate interests (e.g., to secure and improve the Service, prevent fraud, and communicate about service-related matters);
consent (e.g., optional marketing and certain cookies); and
compliance with legal obligations (e.g., accounting, tax, and regulatory requirements).
6) HOW AND WITH WHOM WE SHARE PERSONAL INFORMATION
We may disclose personal information with third parties where necessary to operate the Service, complete bookings, comply with legal obligations, or with your consent. In particular, we may share personal information with recipients for the purposes described in this Privacy Policy:
A. Service providers and vendors
We may disclose Personal Information to vendors that help us operate the Service, such as:
Hosting and cloud infrastructure providers
Customer support tools and communications providers (email, SMS, in-app notifications)
Analytics providers
Security and fraud prevention providers
Identity/document verification providers (if used)
Payment processing providers
Audit and compliance support providers
These providers are authorised to process Personal Information only as needed to provide services to us and under contractual protections. We may also share aggregated or de‑identified information that cannot reasonably be used to identify you for analytics, reporting, and business purposes.
B. AI technology providers (for AI-driven features)
When you interact with AI-driven features (such as conversational trip planning), we may disclose certain information (including chat content and relevant trip context) to AI technology providers that help generate responses and recommendations.
We require AI service providers to use the information only to provide the services to us (e.g., generating responses) and not for their own purposes, subject to our contractual and technical controls and applicable law. Where supported by the AI provider and our configuration, we instruct AI providers not to use Customer content submitted through the Service to train or improve their general-purpose AI models. AI providers may retain and process data for limited periods to provide the AI functionality, maintain safety, and comply with law, subject to our contracts and technical controls.
C. Travel suppliers and travel partners
When you request a booking or travel service, we may disclose personal information to third-party travel partners (such as airlines, hotels, rail providers, transfer providers, and eSIM providers) to facilitate and fulfil your reservation and provide associated customer support. These third parties often process your information as independent controllers under their own privacy policies.
D. Corporate Customers (for business travel programs)
If you use AI Concierge through an organisation, we may disclose personal information to that organisation as necessary to operate the program (for example: traveller identity/profile details, itineraries, approvals, reporting, and spend controls), consistent with program settings and our agreements.
If you are a traveller using a corporate program, your organisation’s own privacy policy and internal policies may apply to how it uses information received from us.
E. Professional advisors
We may disclose personal information to professional advisors (lawyers, auditors, insurers, and consultants) as needed for professional services.
F. Legal compliance and protection
We may disclose personal information to courts, law enforcement, regulators, government authorities, and other parties when we believe disclosure is necessary to:
comply with law or legal process,
protect rights, safety, and security,
investigate fraud or security incidents, or
enforce our terms and agreements.
G. Business transfers
If we are involved in a merger, acquisition, financing, reorganisation, bankruptcy, or sale of all or part of our business or assets, personal information may be disclosed or transferred as part of that transaction.
H. With your direction
We may disclose personal information when you ask us to, consent to it, or choose to use features that inherently share information (for example, sharing a trip itinerary with another traveller).
Certain features may allow you to share trip information, booking details, traveller information or other travel-related information with individuals you authorise. Where required, we may request confirmation that you have authority to share such information and may record the consent or authorisation provided through the Service.
7) COOKIES, ANALYTICS, ADVERTISING, AND SIMILAR TECHNOLOGIES
A. Technologies we use
We and third parties acting on our behalf may use cookies, software development kits (SDKs), pixels, tags, web beacons, local storage, device identifiers, session-replay technologies, tracking links, application programming interfaces, scripts, and other similar technologies in connection with the Service.
These technologies may be used to:
operate, secure, and maintain the Service;
authenticate users and maintain user sessions;
remember user settings, language selections, and other preferences;
facilitate bookings, payments, account functionality, and referral attribution;
understand how users access, navigate, and interact with the Service;
measure traffic, usage, engagement, conversions, and the performance of features;
identify errors, crashes, performance issues, fraud, or security threats;
conduct analytics, testing, research, and product improvement;
measure the effectiveness of communications, promotions, referral arrangements, and marketing campaigns; and
where enabled and permitted by applicable law, personalise content or advertising and measure advertising performance.
We partner with Microsoft Clarity and Microsoft Advertising to capture how you use and interact with our website through behavioral metrics, heatmaps, and session replay to improve and market our products/services. Website usage data is captured using first and third-party cookies and other tracking technologies to determine the popularity of products/services and online activity. Additionally, we use this information for site optimization, fraud/security purposes, and advertising. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement.
B. Categories of technologies
The technologies used through the Service may fall within the following categories:
Strictly Necessary Technologies. These technologies are required to provide functions specifically requested by you or to operate, secure, and maintain the Service. They may include technologies used for authentication, account security, fraud prevention, payment processing, booking functionality, session management, load balancing, consent-preference storage, and referral attribution where necessary to fulfil an applicable referral arrangement.
Functional Technologies. These technologies allow the Service to remember choices and provide enhanced functions, such as language settings, location preferences, traveller preferences, and other personalised features.
Analytics and Performance Technologies. These technologies help us understand how users access and use the Service, including which pages or screens are visited, how users navigate through the Service, which functions are used, whether errors occur, and how the Service performs. We use this information to analyse usage, diagnose technical issues, assess engagement, improve functionality, and develop our products and services.
Advertising, Marketing, and Attribution Technologies. Where enabled, these technologies may be used to measure marketing or referral campaigns, attribute visits or transactions to particular campaigns or partners, build or measure audiences, deliver or measure advertising, and understand activity across websites, applications, devices, or services.
C. Information collected through these technologies
Depending on the technology and your use of the Service, we and our providers or partners may collect or receive:
IP address;
cookie identifiers, device identifiers, advertising identifiers, or other online identifiers;
browser type, browser settings, operating system, and device type;
approximate location derived from an IP address;
language, time zone, screen resolution, and device configuration;
pages, screens, or content viewed;
links, buttons, advertisements, or features selected;
searches, interactions, and navigation paths;
referral URLs, campaign information, and attribution data;
dates and times of access, session duration, and frequency of use;
account or user identifiers, including pseudonymous or hashed identifiers where used;
booking-related events or transaction events, where configured;
error reports, crash data, diagnostics, and performance information;
communications and interactions with the Service, where expressly disclosed; and
information indicating whether a user has completed a particular action, such as creating an account, beginning or completing a booking, or responding to a campaign.
The precise information collected depends on the analytics, marketing, attribution, advertising, or other technology implemented through the Service and its configuration.
D. Analytics providers
We may use third-party analytics providers, including Google Analytics, and may introduce other analytics, measurement, session-replay, attribution, or marketing technologies from time to time.
These providers may process information collected through cookies, SDKs, pixels, scripts, or similar technologies to provide reports, analytics, measurements, technical support, and related services to us. Depending on the provider, configuration, applicable contract, and features enabled, a provider may process information solely on our behalf or may process certain information for its own purposes.
We do not authorise an analytics provider to use Personal Information for purposes beyond those permitted under our agreement with that provider. However, where a provider processes Personal Information as an independent business, third party, or controller, its separate privacy policy and practices may also apply.
E. Consent requirements for EEA and UK users
Where required under applicable law, including in the EEA and UK, we will not activate non-essential analytics, performance, advertising, marketing, attribution, personalisation, or similar technologies unless and until you have provided the required consent.
Consent for non-essential technologies will be requested separately from acceptance of the Terms. You may refuse consent without being prevented from using the core functions of the Service, except where a particular non-essential feature cannot technically operate without the relevant technology.
Where available, you may use our cookie preference tool to:
accept or reject non-essential technologies;
select particular categories of technologies;
review or change your preferences; and
withdraw previously provided consent.
Withdrawing consent will not affect the lawfulness of processing carried out before consent was withdrawn. Non-essential technologies will remain disabled unless and until the required consent has been obtained.
F. Managing your preferences
You may be able to manage cookies and similar technologies through:
the cookie preference tool made available through the Service;
your browser or device settings;
privacy controls offered by the relevant browser, device, or operating system;
recognised opt-out preference signals, where applicable and supported; and
contacting us using the details in Section 18.
Disabling certain technologies may affect the availability or operation of some Service features. Strictly Necessary Technologies may continue to operate where they are required to provide the Service, preserve your choices, secure the Service, or fulfil another purpose permitted without consent under applicable law.
8) SALE, SHARING, TARGETED ADVERTISING, AND U.S. STATE PRIVACY OPT-OUTS
A. Meaning of “sale” and “sharing”
Certain U.S. state privacy laws define the terms“sale”,“sharing”,“targeted advertising”, and similar expressions more broadly than their ordinary meanings.
A “sale” may include certain disclosures or transfers of Personal Information to another business or third party in exchange for monetary or other valuable consideration. A “sale” therefore does not necessarily require AI Concierge to receive a direct monetary payment for Personal Information.
“Sharing” may include disclosing or making Personal Information available to a third party for cross-context behavioural advertising, whether or not money is exchanged.
Accordingly, the use of certain third-party analytics, advertising, attribution, conversion-measurement, retargeting, marketing, or similar technologies may be treated as a “sale”, “sharing”, disclosure for targeted advertising, or another regulated disclosure under applicable U.S. state privacy laws.
California’s official CCPA guidance confirms that California consumers have the right to opt out of the sale or sharing of their personal information, including through Global Privacy Control, and that covered businesses must provide notices explaining their privacy practices. [oag.ca.gov]
B. Our disclosures
We do not knowingly sell Personal Information in exchange for money.
However, when certain third-party technologies are enabled, those third parties may collect or receive identifiers, device information, internet or electronic network activity, usage information, interaction information, approximate location, referral information, campaign information, or similar information.
Depending on:
the technology used;
the features and integrations enabled;
whether the technology is linked to advertising, conversion measurement, audience building, retargeting, or cross-service tracking;
the purposes for which the provider processes the information;
whether the provider uses the information solely to provide services to us or for its own purposes; and
the contractual restrictions imposed on the provider,
these disclosures may constitute a “sale”, “sharing”, disclosure for targeted advertising, or another regulated disclosure of Personal Information under applicable law.
C. Service providers and contractors
A disclosure to a service provider or contractor will not necessarily constitute a “sale” or “sharing” where the recipient processes Personal Information solely on our behalf for specified business purposes and is subject to appropriate contractual restrictions concerning its collection, retention, use, disclosure, combination, and onward transfer of the Personal Information.
We seek to contractually restrict service providers from:
selling or sharing Personal Information;
retaining, using, or disclosing Personal Information outside the specified business purposes;
using Personal Information outside the direct business relationship with us; and
combining Personal Information received from us with information obtained from unrelated persons or sources, except where permitted under applicable law.
The classification of a disclosure nevertheless depends on the actual arrangement, the provider’s data practices, the contractual terms, the technology’s configuration, and applicable law.
D. Categories of Personal Information involved
Where analytics, advertising, marketing, measurement, or attribution disclosures constitute a sale or sharing under applicable law, the categories of Personal Information involved may include:
identifiers, including IP addresses, cookie identifiers, device identifiers, and other online identifiers;
internet or other electronic network activity information, including browsing, search, usage, interaction, and session information;
approximate geolocation information derived from an IP address;
device, browser, and technical information;
commercial or transaction-related events, such as whether a user initiated or completed a booking, where configured;
inferences concerning preferences or interests, where created by the relevant provider; and
other information described in Sections 3 and 7 of this Privacy Policy.
We do not knowingly sell or share passport information, national identification information, payment card details, health information, or other Sensitive Personal Information for cross-context behavioural advertising.
E. Categories of recipients
The categories of recipients may include:
analytics and performance providers;
advertising and marketing platforms;
attribution and conversion-measurement providers;
social media platforms;
referral and affiliate technology providers;
session-replay and user-experience providers; and
other technology providers that support measurement, audience development, campaign management, or personalised advertising.
The actual recipients will depend on the technologies enabled through the Service from time to time.
F. Purposes of disclosure
We may disclose or permit the collection of the information described above for purposes including:
measuring and analysing Service traffic and usage;
understanding user engagement;
diagnosing errors and improving performance;
improving the Service and developing features;
measuring marketing, referral, or advertising effectiveness;
attributing visits, account registrations, or bookings to campaigns or referral partners;
preventing fraud and maintaining security;
delivering or measuring targeted or personalised advertising, where enabled; and
creating audiences or understanding activity across services, where enabled and permitted by law.
G. Your right to opt out
Where applicable law gives you the right to opt out of a sale, sharing, targeted advertising, or similar processing, you may exercise that right by:
selecting the appropriate option through our cookie preference tool;
using any “Do Not Sell or Share My Personal Information” or equivalent control made available through the Service;
enabling a recognised browser-based opt-out preference signal, including Global Privacy Control, where supported and legally required; or
contacting us at the email address provided in Section 18.
We will process applicable opt-out requests in accordance with legal requirements. An opt-out request will apply to the browser and device from which the preference is submitted unless you are logged into your Account and our systems are able and legally required to associate the preference with your Account.
If you clear cookies, change browsers or devices, or use the Service while logged out, you may need to renew your preference unless a recognised universal opt-out signal is active.
H. Global Privacy Control
Where required by applicable law and technically supported, we will treat a valid Global Privacy Control signal as a request to opt out of the sale or sharing of Personal Information and applicable targeted advertising for the browser or device sending the signal.
We will not require you to create an Account to submit a browser-based opt-out request. Where you are logged into your Account and applicable law requires account-level treatment, we may associate the preference with your Account.
I. No discrimination
We will not unlawfully discriminate against you for exercising an applicable privacy right. Exercising an opt-out right will not result in the denial of core services, a different price, or a different level or quality of service, except where a difference is reasonably related to the value provided by the relevant Personal Information or otherwise permitted by applicable law.
J. Children’s information
The Service is not intended for persons under 18 years of age. We do not knowingly sell or share the Personal Information of persons under 18 for cross-context behavioural advertising.
K. Changes to analytics and advertising practices
Our technologies and providers may change as the Service develops. We will update this Privacy Policy and, where appropriate, our cookie preference tool or other notices to reflect material changes to the categories of Personal Information collected, relevant purposes, categories of recipients, or available privacy choices.
9) AI FEATURES AND AUTOMATED PROCESSING
AI disclosure
Some Service features are AI-driven (including conversational trip planning). When you use these features, you are interacting with an automated system and not necessarily a human operator.
Inputs and outputs.
AI features may process (i) information you submit (such as prompts, chat messages, and uploaded content) and (ii) relevant trip context to generate outputs such as recommendations, itineraries, comparisons, or suggested booking options. AI outputs may be inaccurate, incomplete, or unsuitable; you should verify key booking details before purchase.
Users should avoid submitting payment card information, passport details, national identity information, health information, or other sensitive personal information through free-text AI chat features unless specifically requested through a dedicated secure workflow.
Automated recommendations and profiling
We may use automated processing to:
generate travel recommendations,
rank or filter search results,
detect fraud or suspicious activity, or
assist with policy checks (for corporate programs).
Where required by law, you may have rights related to automated decisions (see Section 13).
10) SECURITY
We maintain technical, organisational, and physical safeguards designed to protect personal information. However, no security measure is perfect, and we cannot guarantee absolute security.
Important: Free-text fields (including chats) can capture information you choose to enter. Please avoid entering payment card numbers or unnecessary sensitive information into free-text chats. Use only designated secure checkout and document upload flows when available.
If you believe your interaction with us is no longer secure, please contact us promptly (see Contact Us).
11) DATA RETENTION
We retain personal information for as long as necessary to:
provide the Service,
maintain your account and travel history,
comply with legal and regulatory requirements,
resolve disputes,
enforce agreements, and
maintain backups and security logs.
Retention periods vary depending on the type of information and the purpose for which it is processed. We may retain aggregated or de-identified information for longer periods.
Retention criteria
We determine retention periods by considering: (i) the duration of our relationship with you (including active Accounts), (ii) the need to provide travel history and support, (iii) legal, tax, accounting, and regulatory requirements, (iv) fraud prevention, security, and dispute resolution needs, and (v) the nature and sensitivity of the information. We may retain booking and transaction records for the period required by applicable law and for legitimate business needs such as audits, chargebacks, and dispute handling.
If you request deletion, we will delete or de-identify information where required and feasible, but we may retain certain information as permitted or required by law (for example, for accounting, fraud prevention, or legal compliance). We may also retain limited information to maintain suppression lists (e.g., marketing opt-outs) and to prevent fraud or misuse.
Even where you request deletion, we may retain limited information necessary to: (i) comply with law, (ii) maintain suppression lists (e.g., marketing opt-outs), (iii) detect and prevent fraud or misuse, and (iv) establish, exercise, or defend legal claims.
Booking and transaction records may be retained for up to seven (7) years for accounting, tax, audit, compliance, chargeback, fraud-prevention, dispute-resolution, and travel-history purposes.
When you request deletion of your Account, your Account will be deactivated and your personal information will be restricted from ordinary use immediately. For thirty (30) days after your request, your Account may be restored through our customer support process during the applicable recovery period. Following the expiration of this recovery period, your personal information will be permanently deleted or anonymised unless we are required or permitted to retain specific information under applicable law.
Identity and travel-document information, including passport details, visa information, national identity details, traveller numbers, and similar travel credentials, may be deleted immediately following a valid deletion request and may not be recoverable if an Account is later restored during the recovery period.
AI Chat Retention
AI chat interactions may be restricted upon receipt of a deletion request and may be anonymised following expiry of the applicable account recovery period. Once anonymised, such information may be retained for product improvement, service-quality review, safety monitoring, research, analytics, testing and model-evaluation purposes, provided it is no longer reasonably capable of being linked back to an identifiable individual.
Security and Compliance Records
Security, fraud-prevention, compliance, audit, dispute-resolution and related investigation records may be retained for longer periods where necessary to protect the Service, comply with legal obligations, investigate incidents or defend legal claims.
Analytics and Session Replay Data
General analytics, telemetry, and session-replay information may be retained for operational purposes for limited periods, generally not exceeding ninety (90) days, unless a longer retention period is necessary to investigate security incidents, legal claims, or operational issues.
Backup Retention
Deleted information may remain within encrypted backup systems for a limited period before being permanently overwritten. Backups are maintained solely for disaster-recovery and business-continuity purposes and are not used for ordinary business operations. Backup copies are generally overwritten within thirty (30) days.
12) INTERNATIONAL TRANSFERS
AI Concierge is based in the United Arab Emirates and operates globally. Your personal information may be processed in countries other than where you live, including countries that may have different data protection laws.
Where required by law, we implement appropriate safeguards for cross-border transfers (such as contractual protections and other lawful transfer mechanisms). You can contact us for more information about our transfer safeguards.
Where required by law (including for transfers from the EEA/UK), we rely on recognised transfer mechanisms such as adequacy decisions and/or the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum or UK IDTA, as applicable), together with supplementary measures where required.
13) YOUR RIGHTS AND CHOICES
Depending on where you live and how you use the Service, you may have certain rights regarding your personal information, which may include:
Access to the personal information we hold about you
Correction of inaccurate or incomplete information
Deletion of personal information (subject to legal exceptions)
Objection to certain processing, or restriction of processing
Portability of certain information
Withdrawal of consent (where processing is based on consent)
Opting out of marketing communications
Verification procedures may be required before completing deletion requests. Account deletion requests may involve a temporary deactivation and recovery period as described in Section 11.
A. How to exercise your rights
To submit a request, contact us using the details in the Contact Us section. We may need to verify your identity and confirm your authority if you submit a request on behalf of someone else. We may decline or limit a request where permitted by applicable law (for example, where fulfilling the request would adversely affect the rights of others or would conflict with a legal obligation).
We aim to respond within the timeframe required by applicable law and, where no specific timeframe applies, generally within 30 days. We may extend this period, where permitted by law, depending on the complexity and number of requests.
B. Marketing choices
You can opt out of marketing emails by using the unsubscribe mechanism provided in those emails. Even if you opt out of marketing, we may still send non-marketing communications (such as booking confirmations, account notices, and security alerts).
C. Corporate/Teams users
If you use the Service through an organisation, your organisation may be responsible for fulfilling certain requests relating to business-travel program data. In those cases, we may direct you to your organisation or coordinate with it consistent with our agreements and applicable law.
14) ADDITIONAL NOTICES FOR CERTAIN REGIONS
This section provides supplemental information that may apply depending on your location.
A. UAE
We process personal information in accordance with applicable UAE data protection requirements. The UAE provides certain rights to data subjects and conditions for cross-border transfers, subject to legal exceptions and implementing requirements.
B. EEA/UK (GDPR-style notices)
If you are located in the European Economic Area or the United Kingdom, you may have rights such as access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with your local data protection authority.
Our legal bases for processing may include:
performance of a contract (e.g., providing bookings and traveller services),
legitimate interests (e.g., improving and securing the Service),
consent (e.g., certain marketing and cookies), and
legal obligations.
International transfers (EEA/UK)
Where we transfer Personal Information from the EEA/UK to countries that do not provide an adequate level of protection, we rely on appropriate safeguards such as standard contractual clauses and (where applicable) the UK International Data Transfer Addendum, together with supplementary measures as required.
More detail on legal bases
Depending on the context, we typically rely on: (i) performance of a contract to create Accounts and deliver bookings; (ii) legitimate interests to secure and improve the Service, prevent fraud, and communicate about service-related matters; (iii) consent for optional marketing and certain cookies; and (iv) compliance with legal obligations (e.g., tax, accounting, and regulatory requirements).
C. United States (state privacy)
If you are a resident of certain U.S. states, additional rights may apply under state privacy laws (for example, rights to access, delete, correct, and opt out of certain targeted advertising or certain sale/sharing concepts as defined by law). We will honour applicable requests in accordance with the relevant legal requirements.
15) LINKS TO THIRD-PARTY SERVICES
The Service may link to third-party websites or services (including travel suppliers). We are not responsible for the privacy practices of third parties. Your interactions with those services are governed by their privacy policies.
16) USE OF THE SERVICE BY MINORS
The Service is intended only for individuals who are at least eighteen (18) years old. By creating an Account, you represent and warrant that you are at least 18 years old.
We may request date-of-birth information, age confirmations, or other information reasonably necessary to verify eligibility to use the Service.
We reserve the right to suspend, restrict, or terminate Accounts where we reasonably believe the user is under the minimum age requirement.
We do not knowingly collect personal information from individuals under 18 years of age. If we become aware that we have collected such information in violation of applicable law, we will take steps to delete it.
17) CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time. If we make material changes, we will notify you as required by law (for example, by posting an updated policy with a new Last Updated date and, where appropriate, providing additional notice).
18) CONTACT US
If you have questions about this Privacy Policy, our privacy practices, or want to submit a privacy request, contact:
AI Concierge L.L.C-FZ
Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates
Email: contact@aiconcierge.vip