When you create a TravelNest account we collect:

• Full name
• Email address
• Encrypted password (email/password authentication)
• Profile information you voluntarily add

If you choose to register or log in using Google Sign-In, we receive your name, email address, and profile picture from Google. We do not receive or store your Google password. Your use of Google Sign-In is also subject to Google's Privacy Policy.

In the course of using TravelNest you provide us with:

• Trip details — destination, travel dates, number of travellers, budget, interests, and preferences
• Flight information — airline, flight numbers, departure/arrival times, booking references, passenger names, seat numbers, and baggage details
• Hotel bookings — property names, check-in/check-out dates, booking references, pricing, and cancellation policies
• Travel documents — document titles, categories (passport, visa, insurance, etc.), expiry dates, and file uploads you choose to store in the Application
• Journal entries — written notes, mood ratings, highlights, and any text you enter in the Travel Journal
• Photos — images you upload to journal entries or trip records. Photos are stored securely on our cloud infrastructure and are not shared with third parties or used for AI training
• Packing lists — items and personal packing preferences
• Dream trips — saved destination ideas and inspiration

TravelNest uses artificial intelligence to generate personalised itineraries, packing lists, budget plans, and travel suggestions. To do this, we send your trip preferences (destination, dates, budget, interests, traveller ages) to our AI service providers. We do not send your name, email address, payment details, or document files to AI providers.

AI-generated content is stored as part of your trip record and is treated as your personal data under this policy.

TravelNest offers optional premium subscriptions. Payments are processed by Stripe, our third-party payment processor. We do not store your full credit or debit card number, CVV, or bank account details — those are handled directly by Stripe and never touch our servers. The available plans and current pricing are displayed within the Application at the time of purchase and may change from time to time. We receive and store only:

• Your subscription plan, status, and current billing period expiry date
• Stripe customer and subscription identifiers (needed to verify your entitlement and manage billing)
• Whether you have scheduled cancellation at the end of your billing period

Premium subscriptions are recurring and renew automatically until you cancel. Full billing, renewal, and cancellation terms are set out in our Terms of Service. Stripe retains its own billing and payment records in accordance with its own policies and applicable law; we do not control Stripe's retention of your payment data. See Stripe's Privacy Policy.

We automatically collect certain technical data when you use the Application, including:

• Device type, operating system, and browser/app version
• IP address (anonymised where possible)
• Pages and features accessed, and time spent
• Error logs and crash reports
• Referral source

This data is used solely to improve the Application and is not sold to third parties.

TravelNest offers an optional Google Calendar sync feature. Connecting Google Calendar is entirely voluntary and is not required to use TravelNest.

• What we access — with your permission, TravelNest accesses event data on calendars you own, limited to creating, updating, and deleting events that TravelNest itself created from your saved itinerary. We sync to your primary calendar only.
• Scope — the integration requests only the OAuth scope https://www.googleapis.com/auth/calendar.events.owned, which lets TravelNest view and manage events you own. We do not request access to your Gmail, Contacts, Drive, or any other Google service through this integration.
• Token handling — your Google authorisation is handled through our secure backend connector. Access tokens are stored server-side and are never exposed to other users or used for advertising.
• Disconnect — you can disconnect Google Calendar at any time in Settings. After disconnecting, TravelNest stops accessing your calendar, though your existing calendar events remain unless you delete them yourself.
• Account deletion — when you delete your TravelNest account, you may choose to have TravelNest-created events removed from your Google Calendar, or keep them. The internal sync metadata linking TravelNest to those events is removed either way.

In line with Google's API User Data Policy, any Google user data we access through this integration is used only to provide the Calendar sync functionality to you. It is not sold, used for targeted advertising, transferred to others except as necessary to provide the feature, or used to train any model. We request only the scope described above and do not request access to other Google services through this integration.

We engage trusted third-party companies to perform services on our behalf, including:

• Cloud infrastructure & database hosting — your data is stored on secure servers
• AI providers — anonymised trip preferences for itinerary generation (no personal identifiers)
• Payment processors — for subscription billing (they are PCI-DSS compliant)
• Email delivery services — for transactional email communications
• Analytics services — for aggregated, anonymised usage data

All service providers are contractually bound to process data only as instructed and in accordance with applicable data protection law.

We may disclose your information if required to do so by law, court order, or governmental authority, or where we believe disclosure is necessary to protect the rights, property, or safety of The Nest Lab, our users, or the public.

If The Nest Lab is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.

TravelNest lets you invite other people to collaborate on trips you own. Sharing is never automatic — it happens only when you actively invite someone, and only the specific trip you invite them to is shared. An invited person can access that shared trip only after they accept the invitation, and only within the role you assign them:

• A Viewer can read the shared trip
• An Editor can read the shared trip and make changes to it
• Only you, as the trip owner, can manage collaborators and delete the trip

A collaborator's access ends immediately when you remove them, when they decline or leave, or when the trip is deleted. Collaborators never receive your other trips, your payment data, your documents, or any other user's data.

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure — request deletion of your personal data ("right to be forgotten")
• Right to restriction — request that we restrict processing of your data in certain circumstances
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests or for direct marketing
• Rights related to automated decision-making — you are not subject to solely automated decisions that produce legal or significant effects

To exercise any of the above rights, please contact us at thenestlab.support@gmail.com. We will respond within 30 days. We may need to verify your identity before processing your request.

You can delete your TravelNest account data at any time from within the Application (Settings → Account → Delete Account). When you do, TravelNest will, for the signed-in user only:

• Delete your owned trips and their associated data (itineraries, flights, hotels, expenses, packing lists, journal entries, document references, and calendar sync metadata)
• Remove your memberships and pending invitations on trips shared by others (other users' trips and their data are never touched)
• Delete your dream trips and any beta feedback you submitted
• Cancel any active premium subscription at the end of its current billing period (no automatic refund is issued, and premium access continues until your paid period ends), then remove your local subscription record
• Offer you the choice to remove TravelNest-created events from your connected Google Calendar, or keep them; either way, TravelNest syncs no further and the internal sync metadata is removed
• Disconnect your Google Calendar integration from TravelNest

Important limitations to be aware of:

• The underlying TravelNest login/account identity (your email and authentication record) cannot be deleted automatically from within the Application. After your app data is deleted, your stripped login identity remains on the platform. To request full deletion of the underlying login identity, contact us at thenestlab.support@gmail.com and we will process it through our platform provider's account process.
• When you delete a Travel Document, the reference to it is removed from your records. The underlying file stored by our hosting provider may remain on the platform infrastructure to the extent the platform does not expose a safe per-file deletion API to us. We handle deletion requests to the extent supported by the hosting platform and will assist you with any residual hosted files on request to thenestlab.support@gmail.com.
• Some records held by third parties (for example billing records retained by Stripe) are outside our direct control and may be retained by those providers according to their own policies and legal obligations.

You may also request data deletion by emailing thenestlab.support@gmail.com. We will verify your identity before processing a request made by email.

If you are in the EEA or UK and believe we have not handled your data correctly, you have the right to lodge a complaint with your local supervisory authority (e.g. the Irish Data Protection Commission, the UK Information Commissioner's Office).