Security and data

Your travellers trust you.Here's what we do with that.

The AI never guesses.

The assistant answers only from the documents you give it: itinerary, inclusions, hotel notes, FAQs.

When they don't cover a question, it says so plainly and sends the traveller to your team. It can't book, change or cancel anything.

For general destination questions (weather, what to wear) it can give common-sense advice, and says it is general advice.

Before anything reaches an AI model, passport, ID and card numbers are removed. Our AI providers don't train their models on your data.

Passports stay on the phone.

Passport and visa scans a traveller keeps in WanderBuddy are stored on their own phone. They are not uploaded to us.

We keep only the passport country, so we can check entry rules for that passport.

Where data is stored.

Trips, members and messages: a Postgres database run by Supabase on AWS (Tokyo region), encrypted at rest by the host.
Row-level security in the database: a traveller can only read the trips they belong to.
Everything travels over HTTPS.
Sign-in sessions sit in the phone's encrypted keychain (iOS Keychain, Android Keystore).
In the CRM, each agency can only reach its own records, and each teammate only what their role allows.

Deleting data.

Any traveller can delete their account in the app (Profile, then Delete account) or at wanderbuddyapp.com/delete-account. That removes their profile and the data linked to it. Copies in encrypted backups are purged on a rolling basis.

When a trip ends, tell us and we switch its assistant off.

Who else touches the data.

Service	What for	What it sees
Supabase	Database, sign-in, storage	Trip and account data
Meta (WhatsApp), Twilio	Delivering WhatsApp messages	The messages a traveller sends and receives
Groq	Writing the assistant's answers, drafts and summaries	The question and the parts of your trip documents or CRM records needed to answer it. Never passport, ID or card numbers.
OpenRouter	Writing answers when Groq is busy	The same as Groq, sent only to AI providers that keep no copy
Google Cloud Translation, DeepL	Chat translation	The text being translated

The full list is in our privacy policy.

Data protection.

Data protection laws ask for notice, consent, purpose limits and a way to erase data. Here is how WanderBuddy lines up today:

Notice: our privacy policy says what we collect and why, in plain English.
Consent: travellers agree to it when they join, and optional features (location sharing, face grouping) are off until they turn them on.
Agencies: our Data Processing Terms say how we handle your travellers' data for you, and the CRM records when your agency accepts them.
Purpose: we use trip data to run the trip. We don't sell it and don't use it for advertising.
Erasure: account deletion in the app or on the web, as above.
Contact: support@wanderbuddyapp.com for any data request or complaint.

Your compliance team has questions? Write to headofsales@wanderbuddyapp.com and we'll answer in writing.

Seen enough?

Book a 15-minute call Back to how it works