Privacy Policy

Trippp Ops (“we”, “us”, or “our”) is a travel operations platform that enables travel agencies to manage trips, participants, bookings, and services. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our platform, whether as a traveler, agency administrator, or trip manager.

We are committed to complying with applicable data protection laws, including the General Data Protection Regulation (GDPR) where applicable, and the Moroccan Law 09-08 on the Protection of Personal Data.

We collect the following categories of personal data:

Account information:

• Email address (required for authentication)
• Full name (optional, provided by you or your agency)
• Profile photo (optional)
• Preferred language

Trip and travel information:

• Nationality and passport number
• Passport scan (uploaded by traveler, visible to agency admins only)
• Dietary requirements, allergies, and medical notes
• Emergency contact name and phone number

Booking and service data:

• Trip assignments and participant records
• Booked services and add-ons
• Payment and commission records (if applicable)

Media:

• Photos and videos uploaded to trip galleries
• Documents shared within a trip

Technical data:

• Session tokens and authentication data
• Audit logs (administrative actions)
• Browser locale preference

We use your personal data for the following purposes:

• Providing and operating the Trippp Ops platform
• Authenticating users and managing access controls
• Enabling agencies to manage trips and participants
• Sending trip-related notifications and updates
• Processing bookings and service assignments
• Generating audit trails for compliance and accountability
• Improving the reliability and security of the platform

We do not sell your personal data to third parties. We do not use your data for advertising purposes.

Depending on your role, different people within the platform can access your information:

• Agency administrators can view all participant data for trips they manage, including passport scans
• Trip managers can view participant details (excluding passport scan contents) for trips they are assigned to
• Travelers can view and edit their own profile data
• Trippp Ops platform administrators (super admins) can access data for support and compliance purposes

Passport scans are visible only to agency administrators. Trip managers can see whether you have uploaded a passport scan (yes/no) but cannot open or download the file.

Your data is stored on servers located in the European Union (Frankfurt, Germany) operated by Supabase, Inc. All data is encrypted at rest and in transit using industry-standard TLS/SSL.

Media files (photos, videos, documents) are stored in Supabase Storage with access controlled by signed URLs. Files are not publicly accessible without a valid, time-limited URL.

We implement the following security measures:

• Row-level security (RLS) on all database tables
• Short-lived signed URLs for media access (15-minute expiry)
• Role-based access control enforced at both API and database levels
• Rate limiting on authentication endpoints
• Audit logging for all administrative actions

We retain your personal data for as long as your account is active or as required to provide the services. Specifically:

• Active user accounts: retained while the account is active
• Booking and trip records: retained for 3 years after the trip ends
• Audit logs: retained for 2 years
• Media files: retained until deleted by an agency administrator or upon account closure
• Deleted accounts: anonymised within 30 days of deletion request (subject to legal retention obligations)

If you are located in the European Economic Area, you have the following rights regarding your personal data:

• Right of access — request a copy of the data we hold about you
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion of your data (subject to legal obligations)
• Right to restriction — request we limit processing of your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests

To exercise any of these rights, contact us at the address below. We will respond within 30 days.

We use strictly necessary cookies for authentication (session tokens) and security. We do not use advertising, analytics, or tracking cookies. No cookie consent banner is required for our strictly necessary cookies under GDPR.

We use the following third-party services to operate the platform:

• Supabase (database, authentication, storage) — EU region
• Trigger.dev (background job processing)
• Resend (transactional email delivery)
• Upstash Redis (rate limiting and caching)
• Vercel (hosting and edge functions)

Each service provider is bound by a Data Processing Agreement and handles your data only as instructed by us.

Our platform is not intended for use by children under the age of 16 without the consent of a parent or legal guardian. If a traveler is under 16, their participation must be arranged and consented to by a parent or guardian through the travel agency.

We may update this Privacy Policy from time to time. When we make significant changes, we will notify agency administrators by email and display a notice within the platform. Continued use of the platform after changes constitutes acceptance of the updated policy.

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.