Privacy Policy

1. Who we are

Travilios (“Travilios”, “we”, “us”) is the data controller for the personal data described in this policy. Travilios is part of Musallam Group, and can be reached at:

2. What we collect

When you submit the enquiry form on this site, we collect:

• Your name
• Your contact details (email address and, where provided, phone number)
• The details of your travel enquiry, including any free-text brief you write
• A salted hash of your IP address (never the raw IP address itself), your approximate country, and your browser’s user agent string — collected automatically for fraud and spam prevention

We do not collect payment information through this site.

3. Why we process it, and our legal basis

We process enquiry data to respond to your request, prepare a bespoke travel proposal, and safeguard the service against spam and abuse. This relies on two legal bases: our legitimate interest in operating a travel enquiry service and protecting it from misuse, and, where you provide it voluntarily in the free-text brief, your consent to us reading and acting on that information.

4. How long we keep it

We retain enquiry data for up to 3 years from your last contact with us, after which it is deleted or anonymised. This period is configurable and may be shortened; it exists to let us follow up on multi-year travel planning cycles without holding data indefinitely.

5. Your rights

You may ask us at any time to:

• Confirm what personal data we hold about you, and provide a copy (access)
• Export that data in a portable format
• Correct inaccurate data
• Erase your data (“the right to be forgotten”)
• Restrict or object to how we process it

To exercise any of these rights, email info@travilios.com. We will respond within a reasonable time and may need to verify your identity first.

6. Who we share it with

We use a small number of specialist processors to run this site and deliver your enquiry to our team. None of them may use your data for their own purposes.

• Vercel — application hosting
• Neon — database hosting (where enquiry data is stored)
• Resend — delivery of notification and confirmation emails
• Upstash — rate limiting infrastructure (abuse prevention)
• Cloudflare — bot/spam protection
• Sentry — error monitoring (see the note on scrubbing below)

If we ever enable Sentry error monitoring, it is configured to strip enquiry content — names, contact details, and message text — from every report before it leaves our servers; only technical error data is retained.

7. Cookies and tracking

This site sets no analytics or advertising cookies. We do not track you across other websites, and we do not use your data for advertising. The only cookie this site sets is a session cookie for staff who log in to the admin console — it is not set for, or readable by, ordinary visitors.

8. International transfers

Our processors operate infrastructure in the European Union and the United States. Where data leaves the country it was collected in, our processors rely on their own published data-protection safeguards (such as EU Standard Contractual Clauses) to keep it protected in transit and at rest.

9. Changes to this policy

We may update this policy as our processors or practices change. The date at the top of this page always reflects the most recent revision.

10. Contact

Questions about this policy or your data can be sent to info@travilios.com. See also our Terms of Use.