Privacy policy

N8Go Travel Ltd is the data controller for the personal data described here. You can contact us about data protection at privacy@n8go.travel.

We collect the following categories of data:

• Account data — your email address, name, and a hashed password. Needed to give you an account. Lawful basis: performance of a contract.
• Booking data — traveller names, dates of birth where an airline requires them, contact details, and booking references. Needed to make bookings on your behalf. Lawful basis: performance of a contract.
• Payment data — we do not store card numbers. Stripe processes payments and returns only a token and the last four digits. Lawful basis: performance of a contract, and legal obligation for transaction records.
• Preferences and activity — your onboarding answers and which trip ideas you save or skip, used to personalise what we show you. Lawful basis: legitimate interests, and you can reset this at any time.
• Trip planning conversations — what you tell the trip planner, used to produce your itinerary. Lawful basis: performance of a contract.

We use Anthropic’s Claude API to turn your description of a trip into search criteria, and to write short explanations of why an option was chosen. This shapes what we suggest to you; it does not make a decision with legal or similarly significant effects about you, and it never sets a price. Prices always come from the airline or accommodation provider.

Personalisation of your homepage feed is likewise a ranking of editorial content, not a decision about you.

• Airlines and accommodation providers — the traveller details required to make a booking you have asked us to make.
• Duffel and RateHawk — the distribution platforms through which those bookings are made.
• Stripe — for payment processing.
• Anthropic — trip planning conversation content, for generating itineraries.

We do not sell personal data, and we do not share it with advertising networks.

Some of our processors are located outside the UK and EEA. Where that is the case, the transfer is covered by UK International Data Transfer Agreements or EU Standard Contractual Clauses, together with additional safeguards where required.

• Account data: while your account is open, then 12 months.
• Booking and payment records: 7 years, to meet tax and accounting obligations.
• Trip planning conversations: 24 months.
• Preference and activity data: until you reset it or close your account.

You have the right to access your data, to have it corrected, to have it erased, to restrict or object to processing, and to receive it in a portable format. You can exercise these by emailing privacy@n8go.travel.

Where we rely on legitimate interests — personalisation — you can object at any time and we will stop.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office (ico.org.uk), or to your local supervisory authority if you are in the EEA.

Passwords are hashed with Argon2id. Card data never reaches our servers. Access to production data is restricted and logged.