1. Purpose and scope
This Data Processing Addendum ("DPA") is incorporated into and forms part of the Terms of Service for Advisors (the "Agreement") between you ("Advisor," "you") and Ithaca Travel Co., the operator of the Ithaca service ("we," "us"). It applies whenever we process personal data on your behalf in connection with the Service, and reflects the reality that you and your clients may be located anywhere — this DPA isn't written to assume any single country's law applies.
2. Definitions
"Personal Data" means any information relating to an identified or identifiable natural person that we process on your behalf through the Service — principally your clients' contact information and any trip/booking details you choose to store, including sensitive traveler details like travel document numbers, emergency contacts, or dietary and accessibility notes.
"Controller" means the party that determines the purposes and means of processing Personal Data — that's you, for your clients' data.
"Processor" means the party that processes Personal Data on the Controller's behalf and instructions — that's us.
"Sub-processor" means a third party we engage to assist in processing Personal Data on your behalf (see Section 5).
3. Roles of the parties
For Personal Data relating to your clients, you are the Controller and we are the Processor. You determine what data to collect, from whom, and why; we process it only to provide the Service to you. We are not responsible for determining whether you have a valid legal basis to collect or store any given piece of Personal Data — that determination is yours, under whichever laws apply to you and your clients.
4. Our obligations as Processor
We will:
- Process Personal Data only on your documented instructions — which include the normal operation of the Service's features as you use them — and not for our own separate purposes;
- Keep Personal Data confidential, and limit access to it to personnel and Sub-processors who need it to provide the Service;
- Implement appropriate technical and organizational security measures (see Section 6);
- Assist you, to a reasonable extent, in responding to requests from your clients to access, correct, or delete their Personal Data — those requests should come to you first, since you hold the direct relationship with your clients, and we'll help you fulfill them within the Service;
- Notify you without undue delay after becoming aware of a breach affecting Personal Data we process on your behalf; and
- Delete or return Personal Data at the end of our engagement, as described in Section 8.
5. Sub-processors
We use the following Sub-processors to provide the Service. Using the Service means you authorize these, and any replacement providing the same category of service:
- Supabase — database, authentication, and file storage
- Anthropic — AI-assisted features (receipt import, safety lookups, schedule summaries)
- Resend — email delivery
- Twilio — SMS delivery
- Stripe — payment processing, for your subscription to the Service (not your clients' payment data — that's a separate, not-yet-released feature, and will be added here when it ships)
We'll update this page if that list changes materially. We remain responsible for each Sub-processor's handling of your data to the same extent we'd be responsible if we handled it ourselves.
6. Security measures
Connections to the Service are encrypted in transit. Every advisor's data is isolated at the database level (row-level security enforced by Postgres on every query, not just by the application's interface), so one advisor's clients and bookings are never reachable from another advisor's account. Access within an account follows what you set up — your clients, and anyone a client explicitly invites to a shared trip. No system is perfectly secure, and we can't guarantee absolute security of data transmitted to the Service.
7. International transfers
Our Sub-processors operate infrastructure primarily in the United States. If you or your clients are located somewhere that restricts transferring personal data outside its borders (for example, under the EU or UK GDPR), using the Service means Personal Data may be transferred to and processed in the United States. We rely on our Sub-processors' own safeguards for such transfers (including, where applicable, Standard Contractual Clauses); we don't independently certify each Sub-processor's current mechanism, and this DPA doesn't itself constitute a Standard Contractual Clauses agreement. If your business specifically requires one, contact us before relying on the Service for that data.
8. Deletion and return of data
When your account is cancelled or terminated, we retain your data for a limited period (to allow for reactivation or export) and then delete it, as described in the Terms of Service. You can request an export of your data, or immediate deletion instead of waiting out that period, by contacting us.
9. Verifying compliance
We're a small, closed-beta operation without a formal third-party security certification (e.g. SOC 2) at this stage. We'll respond in good faith to reasonable written requests for information about how we handle Personal Data under this DPA.
10. Liability and precedence
Liability under this DPA is subject to the limitation of liability in the Terms of Service. If this DPA conflicts with the Terms of Service on how Personal Data is handled, this DPA controls; otherwise, the Terms of Service control.
11. Changes & contact
We may update this DPA from time to time; the "last updated" date at the top will reflect the most recent change. For questions about this DPA, you can contact us at info@ithacatravel.club.