Who we are
Ithaca is operated by Ithaca Travel Co., the operator of the Ithaca service. "We," "us," and "our" in this policy mean that operator.
What we collect
On this website: what you send us directly — applying to join includes your name, email, phone, and business name.
Within the Service itself, for approved advisors: your business and account details, your clients' contact information, and whatever trip/booking details you choose to store — which may include sensitive traveler information such as travel document numbers, emergency contacts, and dietary or accessibility notes.
How it's used
To run the Service — reviewing and approving advisor applications, organizing bookings, generating itineraries, powering the client portal, and (for hosted & managed customers) operating the underlying infrastructure. We do not sell advisor or traveler data to third parties.
AI-assisted features
Receipt/booking-document import, destination safety lookups, and day-by-day schedule summaries send the relevant data (the uploaded document, a destination name, or a trip's itinerary titles) to a third-party AI provider (currently Anthropic) to generate that specific result. Only what's needed for that feature is sent, and only for that purpose.
How long we keep it
Your data is kept for as long as your account is active. If your account is cancelled or an application is rejected, we keep the relevant records for a limited period afterward — to allow for reactivation, respond to legitimate legal requirements, or in case you request an export — and then delete them.
Who can see the data
Each advisor's data is isolated to their own account — enforced at the database level, not just in the app's interface, so one advisor's clients and bookings are never visible to another. Within an advisor's account, access follows what that advisor sets up: their clients (for their own trip) and anyone a client explicitly invites to a shared trip view. A small number of platform administrators can review pending advisor applications and manage advisor access, but do not have standing access to advisors' client or booking data.
Where it's stored, and who else processes it
Data is stored with our infrastructure providers, acting as data processors on our behalf: currently Supabase (database, authentication, and file storage), Anthropic (AI-assisted features), Stripe (payment processing for your subscription to the Service), and, where an advisor has configured them, Resend (email) and Twilio (SMS). None of these providers use your data for their own purposes beyond providing that service to us.
For your clients' personal data specifically, you are the data controller and we act as a data processor on your instructions — see our Data Processing Addendum for the full detail, including how international transfers are handled if you or your clients are located somewhere with its own data protection law.
Security
Connections to the Service are encrypted in transit. Data access is scoped per advisor account at the database level (row-level security), not only by the application's own logic, so a bug in the interface can't on its own expose another advisor's data. No system is perfectly secure, and we can't guarantee absolute security of information transmitted to the Service.
Cookies and tracking
We use cookies required to keep you signed in and to remember your session — nothing beyond that. We don't currently run third-party advertising or analytics trackers on this site. The Cookie Policy has the full list.
Children's privacy
The Service is intended for use by travel advisors operating a business, not by children, and we don't knowingly collect information from anyone under 18 through this website.
Your rights
Advisors can view, edit, and delete client and trip records directly within the Service, and can download a copy of their business data (clients, trips, itineraries, messages) at any time from "Your data" in Settings. To ask us to correct something, or to request full account and data deletion, contact us through the channel provided when you signed up or applied.
Depending on where you're located, you may have additional rights under a specific law — for example, the right to access, correct, delete, or port your data, restrict or object to certain processing, or withdraw consent (rights along these lines appear in laws like the GDPR, CCPA/CPRA, and similar laws elsewhere). We'll honor requests along these lines through the same contact channel, whether or not a specific law technically applies to you.
International data transfers
Our infrastructure providers operate primarily in the United States. If you're located outside the US, using the Service means your data may be transferred to and processed there. See our Data Processing Addendum for how this applies to your clients' data specifically.
Changes to this policy
We may update this policy from time to time; the "last updated" date at the top will reflect the most recent change.
Contact
For questions about this policy, you can contact us at info@ithacatravel.club.