Privacy Policy

SquadTravel.ai ("we") operates squadtravel.ai, a group-trip planning service that helps groups find accommodation matching their room needs and coordinate who takes which room. For any privacy matter, contact us at admin@squadtravel.ai.

Since 22 August 2026 we have switched off the three forms on this site that collect personal details: the route updates signup, the form for telling us about a group larger than 20, and the trip feedback question. We are completing the registration of our company, and until we can name that legal entity on this page we would rather pause these forms than keep collecting through them. The sections below that describe them remain, because they describe details some people have already sent us.

Everything we already hold is unaffected: the retention periods on this page keep running, and every right under “Your rights” still applies, including deletion. Confirmation and unsubscribe links from earlier route updates signups keep working, because acting on a choice you already made is not new collection. The rest of the site works as normal. When the registration is complete we will switch the forms back on and update this page.

Account data. There are two ways to sign in. If you sign in with Google, we receive your name, email address, and profile picture from your Google account; we never see your Google password. If you sign in with your email address, we receive only that address — no name and no picture — and we email you a one-time sign-in link. There is no password to create, so we never store one. In both cases the address is used to identify your account and to send you the trip summary when your group's booking is complete. The one-time sign-in email itself is sent by Google Firebase Authentication, which handles sign-in on our behalf (see "Where your data lives" below).

Trip data. Trip names, destinations, dates, room configurations, the display name you enter when joining a trip, and which room you choose. This data is visible to everyone who has your trip's share link, including people who are not signed in — that is what lets you invite someone by sending a single link. Treat the link like a key: anyone you send it to, and anyone they pass it on to, can open it.

Resetting a trip link. The trip's leader or organizer — not other members — can reset its link, a few times a day at most. When they do, the old link stops working immediately for everyone who has it, including anyone they had already sent it to and anyone it was passed on to. It does not remove anybody from the trip: people who have already joined keep their place and their room, but they will need the new link if they had saved or bookmarked the old one. We keep only the date of the reset and how many times it has happened, as a security record; we do not keep the old link itself.

If you want your details off a trip. Ask us (or the organizer) and we will remove your details from that trip. This is done by hand by us, not by a button in the app, and we will act on it within the 30 days described under “Your rights” below. We will always reset the trip's link afterwards, so the version of the trip you appeared in can no longer be opened by anyone still holding the old link. If you only received a link and never joined, resetting the link is on its own enough to end your access. You do not have to ask for the whole trip to be deleted to have your own details removed.

Booking clicks. When a trip leader confirms a booking, we log which property was chosen and the estimated price, so the group can see what was confirmed. We never collect or see payment details — payment happens entirely on our partner's site (e.g. Booking.com).

Trip preferences (optional). If you choose, you can tell us the purpose of your trip, the kind of route, how your group travels, and (for work trips) your group's field. These are optional, help us match better and understand what kinds of group trips people plan, and can be left blank.

How you found us (optional). When you create a trip you can optionally tell us how you heard about SquadTravel (for example a friend, a club, or a web search). We use this only internally, in aggregate, to understand which channels bring people to us; it is never shared in a way that identifies you and can be left blank.

Support conversations. Messages you send to our AI concierge chat are stored so the conversation works, and are processed by Google's AI services to generate replies.

When you email us. If you write to us (including from a contact link on this site), we process your email address and your message in order to reply. It is ordinary correspondence: it stays in our mailbox, is not added to any marketing list, and is deleted when no longer needed.

Trip feedback (optional). After your group's booking completes, the trip leader is shown one optional question — a 0-10 score with an optional comment. Answering is entirely voluntary. If contact details are typed into the comment, we blank them out before storing it. The score stays with the trip; the comment itself is deleted after 12 months (see “How long we keep it”).

Error reports. If a page of our site breaks in your browser, our own code records a technical report so we can find and fix the problem: the error message, the address of the page on our site, your browser type, the window size and — only if you are signed in — your account id. These reports are designed not to include anything you typed into a form, and we take technical measures to keep form contents out of them. They are never visible to other users or used for anything but fixing the problem, they are stored on the same Google infrastructure as the rest of your data (see “Where your data lives”), and they are deleted after at most one year. Separately, our servers keep short-lived technical logs of what our systems did (including your account id and trip id when you are signed in, plus a request reference we may ask you to quote if you report a problem); these are kept for about 30 days.

Security signals. We use Google's reCAPTCHA Enterprise to protect the service from abuse; it collects device and interaction signals for that purpose. This site is protected by reCAPTCHA Enterprise and the Google Privacy Policy and Terms of Service apply.

Site usage (cookie-free). We log which pages are viewed and, if you arrived from a link, which site referred you — no cookies, no visitor ID, and not linked to your account or any other data we hold. This tells us which pages get traffic and where visitors come from in aggregate; we cannot use it to track an individual visitor across visits. If you arrive via a link we've tagged with a campaign identifier and create a trip in that same visit, we note which campaign it came from — the tag travels only in the page's web address from one page to the next, never stored on your device, so it's gone the moment you follow an untagged link or close the tab.

Where your group sets off from (optional). When you create a trip you can tell us the city your group is starting from. You can skip it, and skipping it changes nothing else about your trip. We store the city name and its country — never a street, an address, or anyone's home. We use it to show your group how far your first stop is and roughly how long the journey takes. We also use it to show you a link for trains and buses from that city to your first stop — without it we have nowhere to start the journey from, so a trip with a single stop shows no travel information at all. And if your group completes its booking, the starting city appears in the one-time itinerary summary we email to the organizer, described under “communications records” below — which means that, unlike the rest of your trip, it also sits in that mailbox and in our internal copy of the email rather than only inside the app.

Inside the app it is not visible to the public, nor to anyone who has not joined your group — holding your share link alone is not enough. To show you travel options we build a link to our transport partner's site: when you click it, your starting city and your destination are included in the web address, and the partner uses them to show you the right results. The distance and travel time are worked out using Google Maps. Your name and email are never included in either.

How you heard about us (optional). When you create a trip we ask one optional question — how you came across us (a friend, a search engine, a Meetup group, and so on). You can leave it unanswered. We use it to understand which of our efforts actually reach people, because as a small team we would otherwise be guessing. It is a single choice from a list, never free text about you, and it is never shown to anyone else.

What we do not collect. No payment or card data, no advertising trackers, and no third-party analytics (Google Analytics or similar) — the usage logging above is our own first-party code, not a third-party tracker. We never sell data that identifies you — like your name or email — ever.

You can choose to opt in to two optional things when you create a trip — both are off unless you tick the box, and you can change your mind anytime by contacting us:

Anonymized trend insights. Let your trip preferences (above) contribute to aggregated statistics about how groups travel — for example “a share of our groups travel by bicycle.” These aggregates never identify you and never include your name or email.

Saving your squad. Let us remember your group so you can reuse it for future trips.

Today these choices are only stored — we are not sharing anything with third parties yet, and we will update this policy before we ever do. Sharing anything that could identify you with a partner would require a separate, explicit opt-in that we do not offer today.

Looking ahead: identity details for bookings. To help groups book with certain travel providers in the future (for example rail operators or hotels that require guest names for a group reservation), we may ask for your consent to provide identity-document details (such as the name on your document). We do not collect any of this today. If we ever do, it will be with your separate, explicit, opt-in consent for a specific booking, limited to typed details only — we will never ask you to upload a copy or photo of an identity document — and we will update this policy first.

On our route pages you can provide your email address to receive occasional updates about a specific route. We only do this with your explicit consent (the lawful basis under GDPR Art. 6(1)(a)), and the process is strictly double opt-in: after you tick the consent box we send a single confirmation email, and nothing further is ever sent unless you click the confirmation link in that first email. We store your email address, the route(s) you expressed interest in, and the date and time of your consent and confirmation — nothing else, and we never share it. Every update email includes a one-click unsubscribe link. If you unsubscribe, we stop sending immediately but keep your address on a minimal suppression list so we can honor your objection indefinitely — a legal obligation on our side (GDPR Art. 6(1)(c)), not a marketing use. You can have even that suppression record deleted by writing to admin@squadtravel.ai.

Our matching works for groups of up to 20 people at one property. If your group is bigger, we offer a short form so you can tell us about it instead of being turned away with nothing. We only store what you type there with your explicit consent (the lawful basis under GDPR Art. 6(1)(a)), which you give by ticking a box that is never pre-ticked. Filling it in is entirely voluntary and no contract or law requires it. If you would rather not, nothing else about the site changes; we simply cannot reply about your group.

We store the size of your group, where you want to go, roughly when, your email address, and the date and time of your consent. Nothing else, and we never share it with anyone. We do not record your IP address.

The purpose is narrow and we hold ourselves to it: Olivier reads your message and replies to you personally by email. No automated system decides anything about you or your group. You are not subscribed to anything, you will not receive marketing, and sending the form does not create an account. Your answers also tell us which group sizes and destinations people actually ask for, which is how we decide what to build next.

We keep your details for six months after our last contact about your trip. We then delete your email address, and what remains is the group size, destination and approximate dates, held under a new random reference with no link back to the original record. We do not claim that remainder is fully anonymous, because a destination and a set of dates could in principle still point to someone. So we go on treating it as your data, and the rights below still apply to it.

You can withdraw your consent at any time, and ask us to correct or delete anything we hold, by writing to admin@squadtravel.ai. Withdrawing is as easy as giving it was: tell us and we stop. It does not undo what we lawfully did while your consent was in place, and it costs you nothing else.

We process your data to provide the service you asked for — creating trips, matching properties, coordinating rooms, sending you service emails (performance of a contract, GDPR Art. 6(1)(b)) — and to keep the service secure and abuse-free (legitimate interest, Art. 6(1)(f)). Route updates by email are sent only with your explicit, confirmed consent (Art. 6(1)(a)), which you can withdraw anytime via the unsubscribe link.

Telling us about a group larger than 20 also rests on your explicit consent (Art. 6(1)(a)), given by a box that is never pre-ticked, and you can withdraw it at any time by writing to us. We chose consent rather than “steps taken at your request” (Art. 6(1)(b)) deliberately: we take no payments and make no bookings, so asking us a question is not you preparing a contract with us.

Showing a trip to someone who opens its share link without signing in also rests on legitimate interest (Art. 6(1)(f)): it is how an invitation works — you send one link, and the people you invited can see what they are being invited to without having to create an account first. We keep that view to what an invitation needs, and these pages are never indexed by search engines.

The two optional answers described above — where your group sets off from, and how you heard about us — also rest on legitimate interest (Art. 6(1)(f)): the first to show you transport options you asked to see, the second to understand which of our efforts reach people. Both are genuinely optional, both are minimal, and neither is used to make any decision about you. You can object to either at any time and we will remove it (see “Your rights” below) — leaving them out costs you nothing but a transport link.

Error reports and our server logs rest on legitimate interest (Art. 6(1)(f)): keeping the service working and secure. The optional trip feedback rests on the same basis — improving a service you already use — which is why it is a question you can simply skip, not a consent box. Neither is used to profile you or to make any decision about you.

Our infrastructure runs on Google Cloud / Firebase with primary storage and processing in the European Union (Belgium and the Netherlands). Some processing — AI-generated concierge replies and security checks — may occur on Google servers in the United States; Google participates in the EU-U.S. Data Privacy Framework and processes data under standard contractual clauses.

When you click "Confirm group booking," you leave our site for a booking partner (via Stay22 to Booking.com or similar). From that point their privacy policies apply; the link we hand over contains your destination, dates, and guest count — never your name or email.

The same applies to the optional links for transport and for things to do near a stop: clicking one takes you to that partner's site, carrying the city names in the web address, after which their privacy policy governs. Some of these partners, and the click-tracking services they use, operate outside the European Economic Area. We are reviewing the safeguards that apply to those transfers with legal counsel; if you would rather not have your details reach them, simply do not click the link — nothing else about your trip depends on it.

Account and trip data are kept while your account is active. Ask us to delete your data at any time (see below) and we will remove it within 30 days, except minimal records we must keep for legal or security reasons.

The two optional answers — where your group sets off from, and how you heard about us — are kept with the trip they belong to, and go when it does. We also review them at 24 months and delete anything no longer useful, because a marketing answer from two years ago tells us nothing worth keeping.

When a trip's booking flow completes, we send the organizer a one-time transactional itinerary summary by email and keep an internal copy of that email as a business record of the completed booking flow (legitimate interest, Art. 6(1)(f) GDPR). These communications records are covered by the deletion rights below.

What you send us about a group larger than 20 is kept for six months after our last contact with you about it. Your email address is then deleted automatically. The group size, destination and approximate dates are kept beyond that under a new random reference, and because we do not claim that remainder is fully anonymous, you can still ask us to delete it.

Error reports are deleted after at most one year; our server-side technical logs are kept for about 30 days. A feedback comment is deleted after 12 months — the score alone, which identifies nobody, stays with the trip. All three run on automatic schedules, not on someone remembering.

Under the GDPR you can ask for access to your data, correction, deletion, restriction of processing, portability, or object to processing. Where we rely on your consent, you can also withdraw it at any time, as easily as you gave it, and withdrawing does not affect anything we did lawfully before you withdrew. Email admin@squadtravel.ai from the address linked to your account and we will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

On a specific trip. If you object to your details appearing on a trip you joined, we remove your details from that trip — resetting its link alone would not do this, because your access came from being a member rather than from the link. We then always reset the link as well, so no old link can reopen the version of the trip you appeared in. We do not need to delete the whole trip to do either, so the rest of the group is unaffected.

We use only cookies and local storage that are strictly necessary for the service to function: keeping you signed in (Firebase Authentication) and protecting the site from abuse (reCAPTCHA Enterprise). We set no advertising or analytics cookies, which is why you don't see a cookie consent banner here.

One more, for the same reason: if you are planning a trip and ask us to email you a sign-in link, we save that half-finished trip in your own browser so it is still there when you come back. Otherwise signing in would wipe everything you had typed. It stays on your device — we never receive it — and it is deleted the moment we put it back, or after an hour if you never return, whichever comes first.

If we change this policy in a way that matters, we will update the date above and, for significant changes, tell you in the app. Questions? admin@squadtravel.ai.