Where your data lives, and who can see it
Isolation
Every record — trips, travellers, segments, documents, conversations — carries the ID of the agency that owns it, and every query is filtered by it at the data layer rather than by each feature remembering to. One agency cannot read or write another's data, and that boundary is covered by tests.
What we store
- Trip and itinerary data you load.
- Traveller contact details and the preferences they set.
- Documents you or your travellers upload, in object storage, served through short-lived signed links that expire. See requesting documents and chasing them.
- Message history, which is what lets your team see exactly what a traveller was told.
What we do not do
- We never process payments. Balances are tracked for reminders; money moves through your own link.
- We do not sell or share traveller data.
- We do not use your travellers' conversations to train models.
Access
Access to an agency is by membership, with roles: owner, admin, member. Destructive actions are restricted to owners and admins, and every write through the API is recorded in an audit log.
Traveller rights
Travellers can set their own notification level, and can ask to be removed. Travellers set their level themselves; the options are listed in what the concierge sends, and when. Removing a traveller from a trip deletes their access and stops all messaging to them. For a full erasure request, contact us and we will handle it across trips and message history.