Privacy & Cookie Policy

Last Updated: 1 October 2026

All Seen LLC, a Delaware limited liability company doing business as TripWays (“TripWays,” “we,” “us,” or “our”), operates TripWays.com and related services. This Privacy and Cookie Policy describes how we collect, use, share, and protect your personal information. (We may refer to this policy as our “Privacy Policy” or “Privacy & Cookie Policy”; it is a single document.)

By using our website or services, you agree to the practices described in this policy. If you do not agree, please do not use our services.

This policy describes what the site does today. It is not a promise that every practice meets every country’s marketing or privacy rules. Where a practice is limited, we say so below.

1. Information We Collect

We collect information you provide directly and information we obtain automatically:

• Account and profile: name, email, password (stored in hashed form), and any profile details you add. After you book, we create a TripWays Customer account for that email if you do not already have one.
• Booking and travel: name, email, phone, booking answers, pickup location, travel dates, party size, special requests, and any other information needed to fulfill your booking (for example passport details, if you provide them).
• Checkout: contact details you enter at checkout. We keep that checkout record and delete the contact details in it 30 days after the cart is abandoned. If the booking is confirmed, we keep the booking record as described in Section 5. We do not store your full card number. Card details are entered in Stripe’s payment form and go to Stripe.
• Payment metadata: what Stripe tells us about the charge, such as the fact of payment, amount, currency, and a payment reference. Not the card number.
• Chat and search: messages you send to the trip assistant, and searches you type, together with a session ID, your WordPress user ID if you are logged in, your IP address, and the time. We store the words as you typed them. We do not mask or redact them before they are saved.
• Communications: messages you send to us (for example via contact forms, WhatsApp, chat, or email) and records of our responses.
• WhatsApp: if you message our WhatsApp number, we receive your phone number, your WhatsApp profile name, the messages you send, and the time. If you tap a WhatsApp button on our site or in an ad, we also record which page and button you used, the tour you were viewing, and any advertising click ID or campaign tag on that visit, and we link them to your chat. See Section 3E.
• Reviews and feedback: content you submit, such as reviews, photos, or ratings.
• Technical and usage data: IP address (and approximate city/country inferred from IP), browser type, device information, pages visited, referring URL, a Google click ID when an ad click includes one (gclid), and similar data collected through cookies and similar technologies (see Section 7).

2. How We Use Your Information

We use your information to:

• Process and fulfill bookings and related transactions.
• Communicate with you about your bookings, account, and support requests, including a confirmation email, a review request about two days after the trip, and (if you are logged in and leave a cart unfinished) a reminder about that cart. Guests who are not logged in do not get that cart reminder.
• Answer questions in the trip assistant and in search, including checking live availability and a price with the operator’s booking system when you ask for a date and a group size.
• Provide customer support and respond to inquiries.
• Improve our services, including analytics, product development, and security. We may review chat and search logs for that purpose.
• Send marketing email as described in Section 2A.
• Measure advertising, including reporting a conversion to Google Ads when we have a stored click ID. The value we report is our commission, not a new charge to you.
• Comply with legal obligations and protect our rights and the rights of others.
• Prevent fraud and abuse, including a Cloudflare Turnstile check at payment, and enforce our terms.

2A. Marketing email

When you complete a booking, we add your email to our mailing list. Checkout does not show a separate checkbox for this. Marketing emails are sent with Amazon SES and include an unsubscribe link. If you unsubscribe, we stop marketing email.

Messages about a booking you made (confirmation, a logged-in cart reminder, and the post-trip review request) are not marketing, and those may still be sent after you unsubscribe from marketing.

If you live in the United Kingdom or the European Economic Area, marketing email there usually needs a clear opt-in before the first marketing message. We do not ask for that opt-in today. You can unsubscribe in any marketing email, or email [email protected] and we will take you off the list.

3. Information Sharing and Disclosure

We share personal information with the following parties, for the purposes stated. Each has its own privacy policy.

• Stripe (privacy) — to take payment in USD, including card, Apple Pay, and Google Pay when those are shown at checkout, and 3-D Secure when your bank requires it. Your card number goes to Stripe. It does not go to TripWays servers, the trip assistant, or our assistant server.
• Bokun (privacy) and the tour operator — Bokun is the booking system of record. To fulfill the booking we send the traveler’s name, email, phone, booking answers, and pickup details to Bokun and to the operator who runs the tour.
• OpenAI (privacy) — to write assistant replies and to turn searches into embeddings so we can find relevant tours. The usual model for the assistant is a smaller OpenAI model; if our assistant server is down, the site may call OpenAI directly with another smaller model.
• Meta (WhatsApp Business Platform) (privacy) — WhatsApp messages to our business number are delivered through Meta’s WhatsApp Business Platform. Meta processes them to deliver them, under its own terms. Messages to a business on this platform are not end-to-end encrypted to us: our systems and our team can read them.
• Slack (privacy) — our team reads WhatsApp chats and replies to them in a private Slack channel, so your WhatsApp messages and the assistant’s replies are copied there.
• Pinecone (privacy) — to store and search embeddings of our tour catalog and of the search you typed.
• Amazon Web Services (Amazon SES) (privacy) — to deliver email.
• Cloudflare (privacy) — to deliver the site (CDN) and to run the Turnstile bot check at payment.
• Google (privacy) — Google Tag Manager, Google Analytics (GA4), and Google Ads. For a logged-in visitor, analytics may include a user ID. A purchase can also be sent with a client ID. See Section 6A for advertising “sharing.”
• Suppliers and marketplace partners: When you book, we share what is needed to fulfill the booking with the relevant supplier. Those parties process it under their own policies and applicable law.
• Google Things to do and similar surfaces: Where you discover or book experiences that involve Google programs (for example, Google Things to do or related booking paths), TripWays and Google may act as independent controllers of certain personal data for those services, each for its own purposes and as described in Google’s terms and the Google Controller-Controller Data Protection Terms (or successor terms) where they apply. For example, names, contact details, and booking-related information may be shared with Google to facilitate discovery, transactions, measurement, or support as permitted by law and our agreements.
• Legal and safety: We may disclose information when required by law, to protect our rights or safety, or to prevent fraud or harm.

We do not sell your personal information to data brokers for money.

Our own assistant server

The trip assistant runs on a server we operate, at n8n.allseen.com, on the same infrastructure as TripWays.com. All Seen LLC owns and controls that server. It is not a separate hosting company. That server receives your chat message and sends it to OpenAI to produce the reply. It does not receive your card number or the contact details you type only at checkout.

3C. The trip assistant

• Replies are generated by AI from our tour data. They can be wrong. The tour page and checkout are what you should rely on for price, inclusions, and cancellation.
• The assistant only reads data. It cannot book or change a booking by itself. A price it shows is informational until checkout confirms the total.
• Your messages are stored and sent as described above, as you typed them.
• Do not put payment card numbers or other sensitive information in the chat. If you do, we may refuse to answer, but the text can still be stored.
• We may review chats to improve the service, and we may rate-limit use.

3D. ChatGPT, Claude, and similar apps

If you use ChatGPT, Claude, or another AI app with the TripWays connector (https://mcp.tripways.com), that app’s privacy terms govern what you type there. Our connector receives the search or tour details the app sends us. It does not receive your account with that app. The connector returns public catalog information, availability, prices, and booking links. It does not create a booking, a hold, or a cart.

A guide for people is at tripways.com/mcp.

3E. WhatsApp

You can write to TripWays on WhatsApp (+1 415-343-5626). What happens:

• Who answers. Our trip assistant (the AI described in Section 3C, running on our own server and using OpenAI) answers first. A member of our team can read the chat and take over at any time, and then replies come from a person. Tell us if you want a person; we may not always be able to answer at once.
• What we keep. Your phone number, WhatsApp profile name, messages and our replies, and the page and ad details in Section 1. We create a TripWays account for your phone number so the conversation stays together. If you already have a TripWays account that uses the same phone number, or you book with an email address, we link the chat to that account so you do not end up with two. Conversations are kept as described in Section 5.
• Advertising. If you came from a Google ad, the link we send you in the chat carries the ad click ID, so we can tell whether the ad led to a booking. This is the same click ID described in Section 7.
• Bookings. The assistant sends you a link to our checkout; you pay on the website, never in the chat. Do not send card numbers, passport details, or other sensitive information in WhatsApp. If you do, the text can still be stored.
• Tour operators. If you write as a tour operator, we may point you to our partner page or to Bokun, and we may match your number to your partner record.
• Your choices. You can stop writing to us at any time, block the number, or ask us to delete your conversation and account (Section 6). We only send you a message in reply to one of yours.

3A. U.S. bulk sensitive data compliance (Data Compliance Program)

TripWays maintains a Data Compliance Program (DCP)—reviewed and updated as our services and U.S. rules evolve—to help ensure we do not engage in prohibited transfers of bulk U.S. sensitive personal data (including, where applicable, categories such as precise geolocation of U.S. persons) to countries of concern or covered persons as defined under U.S. law, including rules such as the Department of Justice’s program addressing access to bulk U.S. sensitive personal data (and related regulations). The scope of the DCP depends on what data we actually collect, how much we process, and how we share it; we scale controls as volume and risk grow.

3B. Listing content and partner feeds

We use reasonable efforts so that supplier-provided listing text and media we send to distribution partners does not contain unnecessary personally identifiable information (for example, personal phone numbers or personal email addresses embedded in descriptions). Suppliers remain responsible for the content they provide.

4. Cross-Border Data Transfers

Your personal information may be transferred to, stored, and processed in countries other than your country of residence, including the United States and countries where our suppliers and service providers (including OpenAI, Pinecone, Stripe, Bokun, Amazon, Cloudflare, and Google) operate. We take steps so that your data receives an appropriate level of protection in line with applicable law (for example, standard contractual clauses or other approved mechanisms where required).

5. Data Retention

• Abandoned checkout contact details: deleted after 30 days.
• Confirmed bookings: kept as long as we need them for the trip, customer support, accounting, tax, and other legal duties.
• Accounts: kept until you delete the account or ask us to delete it, except records we must keep for a booking or a legal duty.
• Chat messages and search queries: kept for our records and to run, secure, and improve search and the assistant. We do not delete them on a fixed schedule. If you ask us to delete information about you, we will delete chat and search logs we can tie to you, except where we must keep a record for a booking, accounting, fraud prevention, or a legal duty.
• WhatsApp conversations and the account made for your phone number: treated like chat messages above. We keep them until you ask us to delete them, except where we must keep a record for a booking, accounting, fraud prevention, or a legal duty.
• Cookies: see Section 7 for how long each one lasts.

6. Your Rights

Depending on your location, you may have rights to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your information, subject to legal and contractual retention needs (see Section 5).
• Restrict or object to certain processing.
• Data portability (for example, a copy of your data in a portable format).
• Withdraw consent where processing is based on consent.
• Lodge a complaint with a supervisory authority.

To exercise these rights, contact us at [email protected]. We will respond in accordance with applicable law.

6A. California and other U.S. state privacy rights

If you are a California resident, the California Consumer Privacy Act (CCPA/CPRA) may give you the rights to know, delete, and correct personal information, and to opt out of “sale” or “sharing” for cross-context behavioral advertising. We do not sell personal information for money.

We do use Google Analytics, Tag Manager, and Google Ads, including a stored Google click ID for conversion reporting. That advertising use may count as “sharing” under California law.

To opt out, email [email protected] with the subject Do Not Sell or Share My Personal Information. We will treat that as an opt-out of sale and of sharing for cross-context advertising. You can also use your browser’s cookie controls and Google’s ad settings.

Other U.S. state privacy laws may give similar rights. Use the same email address to make a request. We will not discriminate against you for exercising these rights.

7. Cookies and Similar Technologies

We use cookies and similar technologies (for example local storage) to:

• Keep you logged in and remember your preferences.
• Keep a booking in progress.
• Understand how you use our site (analytics) and measure ads.
• Support security and fraud prevention.

Name	What it is	How long
tripways_bokun_cart	Remembers the checkout cart	7 days
tripways_cart_owner	Ties a cart in the browser to the account that owns it	Until you log out or the cart ends
tripways_gclid	Stores a Google Ads click ID so we can report a conversion	Until it expires or you clear cookies
_ga (and related Google cookies)	Google Analytics	As set by Google
twnc_active_cart, twnc_pending_*, twnc_purchased_*	Local storage for the checkout in progress and a completed purchase	Until you clear site data, or the cart ends

You can control cookies through your browser settings. Disabling certain cookies may affect site functionality, including checkout.

8. Data Security

We implement technical and organizational measures to protect your personal information against unauthorized access, loss, or alteration. These include secure transmission (for example TLS), access controls, and secure storage. Card data is collected by Stripe, not stored on our servers. No system is completely secure; we encourage you to use strong passwords and protect your account.

9. Third-Party Links

Our site may contain links to third-party websites (for example suppliers, and affiliate partners for flights and transfers, visas, or luggage storage). We are not responsible for their privacy practices. We recommend reviewing their privacy policies. A booking you make on those sites is with that partner, not a TripWays tour booking.

10. Children

Our services are not directed at children under the age of 16. We do not knowingly collect personal information from children under 16. If you believe we have collected such information, please contact us so we can delete it.

11. Changes to This Privacy Policy

We may update this policy from time to time. Changes will be posted on this page with an updated “Last Updated” date. Your continued use of our services after changes take effect constitutes acceptance of the updated policy where permitted by law.

12. Contact Us

For questions about this Privacy Policy or our data practices:

All Seen LLC
131 Continental Drive, Suite 305
Newark, DE 19713
Email: [email protected]