Privacy Policy

1. Purpose

We collect and process personal data to provide AI-generated travel recommendations, manage user accounts, and operate our website and app.

2. Data We Collect

• Name, email address, and login credentials
• Payment information (processed securely via Lemon Squeezy; we do not store full card details)
• Product usage and analytics data (described in Section 6)
• Device and usage information (such as browser type, IP address, and device ID)
• Marketing and newsletter preferences (stored securely in our own service infrastructure)

3. Lawful Bases

We rely on the following lawful bases under UK GDPR:

• Contract – to deliver the services you request
• Consent – for marketing communications and non-essential cookies
• Legitimate Interest – for security, performance, and fraud prevention

4. AI Processing

Our assistant operates on Base44, which may use models such as ChatGPT, Claude, or Gemini. Responses are AI-generated and may contain inaccuracies. Please verify information before acting.

5. Data Sharing and Transfers

We may share data with trusted providers that help us operate our service, including:

• Base44, which hosts and operates our application infrastructure and enables our AI features
• Lemon Squeezy, which processes payments as our payment provider and merchant of record
• Google, if you choose to sign in with Google
• Foursquare: if you use our Near Me feature, your approximate location is sent to Foursquare to retrieve nearby places; we do not permanently store your exact location
• CARTO, which delivers the map imagery used in our mapping features
• Stay22 and Travelpayouts, which provide the accommodation and travel booking links shown alongside your itineraries
• Meta, whose marketing pixel processes data only where you have consented to marketing cookies

Where data is transferred outside the UK, appropriate safeguards such as the UK Addendum to EU Standard Contractual Clauses are applied.

6. Cookies and Tracking Technologies

Essential cookies are required for the website to function.

We also operate first-party product analytics. As you use our website and app, we record how you interact with our product (such as the pages and features you use and your trip-generation activity), together with technical details such as session identifiers, browser and device information, and, where available, the referring website and marketing campaign (UTM) information. This data is stored in our own application and database infrastructure and is used to operate, maintain, and improve our service. It does not depend on non-essential cookie consent.

Third-party analytics and marketing cookies (such as the Meta Pixel) are only used with your consent. If you do not consent, these third-party technologies are not loaded.

You can manage or withdraw your consent at any time through our cookie banner and the Cookie Settings link in our footer.

7. Email Communications

Service communications. We may send operational emails relating to trips you create, such as an upcoming-trip reminder. You can manage trip reminders from your Profile.

Marketing communications. If you choose to hear from us, we may use your email address to send travel updates, offers, and content. We do not currently operate a regular newsletter-sending flow, and marketing preference management is not currently available from your Profile.

If we introduce marketing communications, we will provide a way to opt out, such as a link in those emails. You can also contact us at info@themagictravelgenie.com at any time to stop receiving them.

8. Data Retention

We retain personal data only as long as necessary, typically up to 24 months after account closure, unless legal obligations require longer retention.

9. Your Rights

You have the right to:

• access your personal data
• correct inaccurate data
• request deletion
• restrict processing
• request data portability
• withdraw consent at any time
• object to processing based on legitimate interests

You may also lodge a complaint with the ICO at ico.org.uk.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data from unauthorised access, loss, or misuse.

11. Children's Data

This Service is not intended for individuals under the age of 16, and we do not knowingly collect personal data from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Updates will be posted on this page with a revised effective date.

13. ICO Registration

Sandman AI Ltd is registered with the Information Commissioner's Office.

ICO Registration Number: ZC106530