Privacy policy

1. Who is responsible for your data

Damian Rivero Alvarado, based in Calle 140 # 13-51, Bogotá, Colombia. Email for anything related to personal data: contacto@tripbudgetapp.com. Phone: +57 317 777 5415.

2. What we collect

• Your account: your email address and your password. Your password is stored encrypted; we never see it or store it as is.
• Saved searches and price alerts: origin, destination, dates, number of travelers, passport country, budget and currency, each alert's target price and the last price we checked.
• Searches without an account: what you enter in the search (cities, dates, budget and passport) is used to calculate results at that moment and isn't stored linked to you.
• IP address, to prevent abuse: we limit searches to 20 per hour. To do so we don't store your IP as is, only an encrypted version (a hash) next to a counter, and counters older than a day are deleted automatically.
• Technical visit data: our hosting provider (Vercel) logs technical data about each visit, such as the IP address, the browser and the page visited, for security and to keep the service running, and keeps it for a short time under its own policies.
• Analytics: we count visits with Vercel Web Analytics, which works without cookies and shows aggregated data that doesn't identify you.
• Language: if you pick a language, we remember it in a cookie (see the cookie policy).

We don't ask for your name, your phone number or any payment details.

3. What we use it for

• Creating and managing your account, and keeping you logged in.
• Saving your price alerts, checking them automatically once a day and emailing you when a price drops below your target.
• Sending you a password reset link when you ask for one.
• Showing you travel results based on your budget, dates and passport.
• Protecting the service against abuse and keeping it running.
• Measuring, in aggregate, how many people use the site, so we can improve it.

We don't sell your personal data or use it for personalized advertising.

4. Your consent and legal bases

When you create an account, you give us your prior, express and informed authorization to process your data for these purposes by ticking the acceptance box. We store the date and the version of this policy you accepted. For people in the European Union, the legal bases are performing the service you request (account and alerts), our legitimate interest (security, usage limits and aggregated analytics) and your consent where applicable.

5. Who we share data with

We use providers that process data on our behalf and only to deliver their service:

• Vercel Inc.: website hosting and visit analytics (United States).
• Neon: cloud database where your account and alerts are stored (servers outside Colombia).
• Resend: delivery of price alert and password reset emails (US company; emails are sent from servers in Brazil).
• ImprovMX: receives the emails you send us at contacto@tripbudgetapp.com and forwards them to our inbox (servers outside Colombia).
• Cloudflare: the "verify you are human" check (Turnstile) on sign-up and password reset, which reviews technical data from your browser to tell people from automated programs (United States).

Because these servers are outside Colombia, by accepting this policy you authorize the transfer of your data to those countries. We work with providers that offer contractual data protection safeguards.

Booking sites: TripBudget doesn't sell tickets or bookings. When you click to book (for example on Aviasales or Klook, through the Travelpayouts affiliate network), you leave TripBudget and that site handles your data under its own policy. We don't send them your email or account; the link only carries the search (route and dates).

Travel data: flight price providers (Sky Scrapper, through RapidAPI, and the Aviasales data API) receive the search parameters, such as cities, dates and number of travelers, not your personal data.

We would also hand over data to an authority if the law requires it.

6. How long we keep it

• Account, saved searches and alerts: as long as you have an account. If you ask us to delete it, we delete the account and everything linked to it.
• Session: the session cookie lasts up to 30 days or until you log out.
• Password reset links: they expire after 30 minutes and work only once.
• Search counters by (encrypted) IP: deleted after a day.
• Hosting provider logs: as long as that provider keeps them.

7. Your rights

Under Colombia's Law 1581 of 2012, you can:

• Know, update and correct your data.
• Ask for proof of the authorization you gave us.
• Be told, on request, how we have used your data.
• Revoke your authorization and ask us to delete your data, unless there is a legal or contractual duty to keep it.
• Access your data free of charge.
• File complaints with Colombia's Superintendence of Industry and Commerce (SIC), after making your request or claim with us.

If you are in the European Union, you can also ask us to restrict processing, request data portability, object to processing, withdraw your consent and complain to your local data protection authority. If you live in California, you can know what data we hold, ask us to correct or delete it, and not be treated differently for exercising your rights. We don't sell or share personal data for targeted advertising.

8. How to exercise your rights

Email us at contacto@tripbudgetapp.com from your account's email address and tell us what you need.

• Requests for information (for example, what data we hold): we reply within 10 business days at most. If we can't, we'll explain why and reply within 5 more business days.
• Claims (correcting, updating or deleting data, or revoking your authorization): we reply within 15 business days at most. If we can't, we'll explain why and reply within 8 more business days.
• If a claim is incomplete, we'll ask for what's missing within the next 5 business days. If we don't hear back from you within 2 months, we'll consider the claim withdrawn.

9. Security

Passwords are stored encrypted, the site only runs over a secure connection (HTTPS), the session cookie can't be read by other scripts on the page, and password reset links work only once. No system is infallible, but we take reasonable measures to protect your data.

10. Children

TripBudget is meant for adults (18 or older), and you have to confirm your age to create an account. We don't knowingly collect data from minors; if you think a minor has given us their data, email us and we'll delete it.

11. Changes and effective date

This policy is effective from the date shown above. If we change it, we'll publish the new version on this page with its date and, if the change is substantial, we'll let you know before it applies. Data is kept for the periods in section 6.