Effective date: October 17, 2026 Last updated: October 18, 2026
This Privacy Policy explains how TravelBreeze LLC ("TravelBreeze," "we," "us," or "our") collects, uses, discloses, and protects personal information when you visit travelbreeze.com, use our short-link service at linx.bio, or use the TravelBreeze customer relationship management software (together, the "Services").
Contents
- Who We Are
- Our Two Roles: Controller and Service Provider
- Information We Collect
- How We Use Information
- AI-Assisted Features
- How We Share Information
- Text Messages (SMS)
- Email Communications
- Cookies and Similar Technologies
- How Long We Keep Information
- How We Protect Information
- Data Breach Notification
- Your Choices
- US State Privacy Rights
- Privacy Rights in the EEA, UK, and Switzerland
- International Data Transfers
- Children's Privacy
- If You Are a Traveler
- Do Not Track
- Third-Party Sites and Services
- Changes to This Policy
- Contact Us
Who We Are
TravelBreeze LLC is a Florida limited liability company (Florida document number L24000285620). Our principal office and mailing address is:
TravelBreeze LLC 30318 Plymouth Creek Cir Sorrento, FL 32776 United States
TravelBreeze provides CRM software for travel agencies and travel advisors. TravelBreeze is a software provider. We are not a travel agency, tour operator, or seller of travel, and we do not book travel.
Our Two Roles: Controller and Service Provider
Our role depends on whose information it is and why we have it.
When we act as a controller (business). We decide how and why information is used for:
- people who create a TravelBreeze account ("Users"), such as agency owners, administrators, and advisors;
- billing contacts for agencies and advisors;
- visitors to our marketing website and to linx.bio; and
- people who contact us for sales or support.
When we act as a service provider (processor). Travel agencies and advisors who subscribe to TravelBreeze ("Customers") enter information about their own clients and prospects ("Travelers") into the Services. Travelers may also submit information directly to a Customer through forms, quote requests, contact forms, and shared trip pages hosted by TravelBreeze. We process this information ("Customer Data") on the Customer's behalf and under the Customer's instructions, under our Terms of Service and any data processing agreement with that Customer.
For Customer Data, the Customer is responsible for its own privacy notices, for having a lawful basis (including any required consent) to collect and share the information with us, and for responding to Travelers' privacy requests. If you are a Traveler, see If You Are a Traveler.
Information We Collect
Account and profile information
When you sign up or are invited to an agency, we collect your email address, first and last name, and agency membership and role. We do not use passwords; you sign in with a one-time code sent to your email.
You may choose to add profile information, such as a display name, title, photo, biography, location, specializations, certifications, social links, travel photos, testimonials, and contact details. If you publish a public advisor profile, public agency page, or blog post, that information is visible to anyone on the internet and may be indexed by search engines.
You may also add personal contact and preference details to your own advisor record (for example, phone numbers, address, emergency contact, travel preferences, allergies, and accessibility preferences).
Billing information
When you buy a paid plan, our payment processor, Stripe, collects your payment card details and billing information directly. We do not receive or store your full card number. We receive and keep subscription details from Stripe, such as plan, seat count, billing status, customer and subscription identifiers, and invoice and payment status.
Customer Data (Traveler information entered by agencies)
Customers decide what to enter. Depending on how a Customer uses the Services, Customer Data may include:
- Identity and contact details: names, preferred names, honorifics, email addresses, phone numbers, mailing addresses, preferred contact method, preferred language, and emergency contacts.
- Demographics: date of birth, gender, nationality, anniversary dates, relationships between Travelers (for example spouse, child, guardian), and whether a Traveler is managed by another Traveler (such as a parent managing a child's profile).
- Government identifiers and travel documents: passport numbers, issuing countries and expiration dates, passport photos, driver's license numbers and photos, TSA PreCheck Known Traveler Numbers, CLEAR member IDs, and visa notes.
- Health and accessibility information: allergies, dietary and meal preferences, accessibility and mobility needs, special concerns, and pregnancy status and related dates.
- Eligibility details: whether a Traveler is 55 or older, military, law enforcement, or fire/EMT (used for travel discounts).
- Payment information: payment card numbers, expiration dates, cardholder names, bank account and routing numbers, payment-app usernames, and billing addresses that a Customer chooses to store. We do not store card security codes (CVV/CVC).
- Account credentials: usernames and passwords for Travelers' third-party travel accounts (for example airline or cruise-line logins) that a Customer chooses to store.
- Loyalty and insurance: loyalty program memberships and numbers, travel and other insurance policy details, and beneficiaries.
- Trips and bookings: itineraries, bookings, suppliers, confirmation numbers, prices, invoices, recorded payments, commissions, notes, tasks, and communications logs.
- Documents: files uploaded by Customers or Travelers, such as booking confirmations, passports, insurance documents, and receipts, and text extracted from those files.
- Form responses and signatures: answers submitted through Customer-created forms, including electronic signatures and initials, plus an audit trail (IP address, browser user agent, referring page, and timestamps).
- Feedback that Customers record from their Travelers.
Information submitted through public pages
TravelBreeze hosts pages that Customers share with the public or with Travelers. When you use them, we collect what you submit on behalf of the Customer:
- Advisor profile contact form: your name, email address, phone number (if provided), and message, which we email to the advisor.
- Quote request forms: your contact details, number of travelers, and for each traveler their full legal name, gender, birthday, citizenship and state of residence; travel dates, destinations, and preferences; discount qualifiers; seasickness, accessibility, and allergy details; how you heard about the advisor; contact preference; and notes.
- Shared trip pages: messages you send to the advisor and a session record so you stay signed in to the password-protected page.
- Customer forms: responses, signatures, and the audit trail described above.
Notification and device information (Users)
If you enable notifications, we collect your notification preferences and web push subscription details from your browser (a push endpoint and encryption keys). If you opt in to text notifications, we collect your mobile phone number (after you verify it with a one-time code) and a record of your consent: the date and time you agreed and the version of the consent disclosure you were shown.
Information collected automatically
- Sign-in sessions: IP address, browser user agent, and session timestamps.
- Product analytics: We run our own instance of the open-source analytics tool Umami at stats.travelbreeze.com. It records pages viewed, referrers, device, browser, operating system, approximate location derived from IP address, and in-product events (such as signing in, creating a trip, or starting checkout). When you are signed in, we associate this activity with your email address, name, and user ID. On our production site, Umami also records session replays and heatmaps (a reconstruction of clicks, scrolling, and page content during your visit) to help us find usability problems.
- Public profile analytics: When someone views a public advisor profile, we record the visitor's IP address, user agent, device, browser, operating system, language, referrer, UTM campaign parameters, approximate country (from our network provider), the tabs viewed, and whether they contacted the advisor. We show aggregated statistics to the advisor.
- Error reports: When the Services encounter an error, we send technical details (such as the error, the page or API route, browser information, and the application version) to our own self-hosted error-tracking system (Bugsink).
- Server and network logs kept by our hosting and network providers, including IP addresses and request details. This includes requests to linx.bio short links. We do not store a per-click record of short-link visits in our database.
Feedback
If you use our in-app feedback widget (provided by Frill) or our feedback portal, we share your email address and display name with that provider so your feedback is attributed to you.
Information from third parties
We receive subscription and payment status from Stripe, delivery status from our email and SMS providers, phone verification results from Surge, and approximate country from our network provider (Cloudflare). We may receive information about prospects from public sources or referrals.
How We Use Information
We use information to:
- provide, operate, and maintain the Services, including signing you in, hosting public pages, and delivering Customer Data where Customers direct;
- process subscriptions and payments, and prevent fraud;
- send transactional messages, such as sign-in codes, invitations, form and quote notifications, trip messages, and billing notices;
- send the email, push, and text notifications you choose;
- extract and organize information from uploaded documents when a Customer uses document-scanning features (see AI-Assisted Features);
- provide customer support, including, with appropriate authorization, viewing an account as the User sees it to diagnose a problem;
- understand how the Services are used, fix errors, and improve features;
- secure the Services, detect abuse, and enforce our Terms;
- comply with law and respond to lawful requests; and
- for other purposes we describe when we collect the information, or with your consent.
We use Customer Data only to provide the Services to the Customer, as instructed by the Customer, and as permitted for service providers by law (for example security, debugging, and legal compliance). We do not sell Customer Data, and we do not use it for our own marketing or to build advertising profiles.
AI-Assisted Features
Some features use artificial intelligence (AI) to save Customers time. For example, when a Customer uploads a booking confirmation, payment document, or traveler document, the file is sent to an AI provider to read the text and suggest structured details (such as dates, suppliers, prices, and traveler names), match payments, or generate activity details.
- Providers: Google (Gemini API and Document AI) and OpenRouter, which routes requests to model providers including Anthropic and Google.
- What is sent: the document contents and the minimum context needed for the task (for example, a list of the trip's travelers so the system can match names).
- No model training: We configure these services so that, under their terms, Customer Data is not used to train or improve the providers' general models.
- Human review: AI suggestions can be wrong. Customers review and confirm results before relying on them.
How We Share Information
We share personal information only as described here. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.
Service providers (subprocessors). We use the following providers to run the Services. They may process personal information only to perform services for us.
| Provider | Purpose | Information involved |
|---|---|---|
| Railway Corporation | Application hosting and PostgreSQL database; hosts our self-run analytics (Umami) and error tracking (Bugsink) | All information stored in the Services |
| Cloudflare, Inc. | File storage (R2) for photos and documents; network services | Uploaded files and images; IP address and request data |
| Resend | Transactional email delivery | Email address, name, message content |
| Surge | Text message delivery and phone number verification | Mobile number, verification codes, message content |
| Stripe, Inc. | Subscription billing and payment processing | Billing contact and payment details (collected by Stripe) |
| Google LLC | AI document processing (Gemini API, Document AI); address search and maps (Google Maps Platform) | Document contents; address search text; IP address |
| OpenRouter, Inc. (and model providers it routes to, such as Anthropic and Google) | AI document processing | Document contents and task context |
| Frill | In-app feedback widget | Email address, display name, feedback |
| FeedLog | Feedback portal sign-in | Email address, display name, feedback |
| Unlayer | Visual editor for advisor blog posts | Blog content you create |
| OpenFreeMap | Map tiles shown in the Services | IP address and map area requested |
| Browser push services (for example Google, Apple, Mozilla) | Delivering web push notifications you enable | Encrypted notification content, push endpoint |
Customers and their teams. Customer Data is available to the Customer agency and the Users it authorizes. If you submit information through an advisor's public profile, form, quote request, or shared trip page, it goes to that advisor and agency.
Public content. Information you choose to publish (public profiles, agency pages, blog posts, short links) is available to anyone.
Legal and safety. We may disclose information if we believe in good faith it is required by law, subpoena, or court order, or necessary to protect the rights, property, or safety of TravelBreeze, our Users, Travelers, or others.
Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to this Policy.
With your direction or consent. We share information when you ask us to or agree that we may.
All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.
Text Messages (SMS)
TravelBreeze sends text messages only to Users who check a consent box, verify their mobile number with a one-time code, and choose which account notification alerts to receive by text. Text notifications are off until you give consent. We keep a record of your consent (date, time, and disclosure version) as described in How Long We Keep Information.
Mobile information, including phone numbers and text messaging opt-in data and consent, will not be shared with third parties or affiliates for marketing or promotional purposes. We share mobile numbers only with our SMS provider as needed to verify your number and deliver messages you requested.
You can opt out at any time by replying STOP, by turning off text alerts, or by removing your number in Notification Preferences. Reply START to opt back in. Reply HELP for help. Message and data rates may apply. Full details are in our Messaging Terms.
Email Communications
Transactional email. We send email needed to provide the Services, such as sign-in codes, agency invitations, form and quote submissions, trip messages, notifications you enable, and account notices. These are not marketing messages and you cannot opt out of essential ones while you have an account, though you can turn off optional notifications in Notification Preferences.
Marketing email. If we send you marketing or promotional email, it will identify TravelBreeze, include our postal address, and include a working unsubscribe link. We honor unsubscribe requests within 10 business days, as required by the CAN-SPAM Act.
Email sent for Customers. Some messages to Travelers (for example form invitations and replies about a shared trip) are sent through TravelBreeze for a Customer. The Customer decides who receives them and is responsible for their content and for compliance with email laws. TravelBreeze does not currently provide bulk or marketing email campaigns to Travelers.
Cookies and Similar Technologies
We use a small number of first-party cookies and browser storage items to keep you signed in, protect shared trip pages, and remember your display preferences. Our analytics do not use advertising cookies, and we do not use third-party advertising pixels. Details are in our Cookie Policy.
How Long We Keep Information
We keep personal information only as long as needed for the purposes in this Policy, including legal, tax, accounting, and dispute-resolution needs.
| Information | Retention |
|---|---|
| Account and profile information | While your account is active, then deleted or de-identified within 90 days after account closure, unless we must keep it longer by law |
| Subscription and billing records | 7 years, for tax and accounting purposes |
| Customer Data | For the life of the Customer's subscription. After termination, the Customer can export its data for 30 days. We then delete it within 90 days after that export period ends. Backup copies are overwritten on their normal backup cycle. We keep copies only where the law requires |
| Records a Customer deletes (for example a Traveler) | Hidden from the Services immediately and permanently deleted within 30 days |
| Sign-in sessions | Expire after 30 days of inactivity |
| One-time sign-in codes | Expire after 5 minutes |
| Shared trip page sessions | Expire after 30 days or when the advisor turns off sharing |
| SMS consent records | For as long as you are enrolled in text notifications, and for 5 years after you opt out or remove your number, so we can show that messages were sent with consent |
| Analytics and session replays | 13 months |
| Public profile view records | 25 months. Each record includes the visitor's full IP address, which is kept for the same 25 months and then deleted with the record |
| Error reports and logs | 90 days |
How We Protect Information
We use administrative, technical, and physical safeguards designed to protect personal information, including:
- encryption in transit (HTTPS/TLS);
- application-level AES-256-GCM encryption for especially sensitive Customer Data fields, including passport numbers, driver's license numbers, Known Traveler and CLEAR numbers, stored payment card and bank account numbers, stored third-party account credentials, and text extracted from booking documents;
- private file storage with short-lived, signed access links;
- password protection (hashed) for shared trip pages;
- HttpOnly, secure session cookies and passwordless one-time-code sign-in;
- role-based access within each agency; and
- limiting staff access to personnel who need it.
No method of transmission or storage is completely secure. You are responsible for keeping your email account secure, because it is used to sign in.
Data Breach Notification
If we discover a security incident affecting personal information, we will investigate, take steps to contain it, and notify affected individuals, Customers, and regulators as required by applicable law, including Florida's Information Protection Act (Fla. Stat. § 501.171). For Customer Data, we will notify the affected Customer without undue delay so the Customer can meet its own notification obligations.
Your Choices
- Profile and account information: update it in your account settings.
- Public content: unpublish your public profile or blog posts at any time.
- Notifications: turn email, push, and text notifications on or off for each notification type in Notification Preferences. To stop texts, reply STOP to any text or remove your mobile number in Notification Preferences.
- Marketing email: use the unsubscribe link in any marketing email.
- Cookies: see our Cookie Policy.
- Account closure: contact [email protected].
US State Privacy Rights
Several US states give residents rights over their personal information. This section applies to information for which TravelBreeze is the controller (business). For Customer Data, please contact the Customer (your travel agency or advisor); we will help them respond.
Categories of personal information we collect (as a business)
The table below describes the information we collected in the past 12 months, using the categories in the California Consumer Privacy Act (CCPA), as amended by the CPRA.
| Category | Examples | Sources | Business purposes | Disclosed to (for a business purpose) |
|---|---|---|---|---|
| Identifiers | Name, email, phone, IP address, user ID, online identifiers | You; your device; your agency (invitations) | Provide Services, security, support, communications, analytics | Hosting, email, SMS, billing, feedback, and analytics providers |
| Customer records (Cal. Civ. Code § 1798.80(e)) | Name, address, phone, billing details | You; Stripe | Provide Services, billing | Hosting, billing providers |
| Commercial information | Plan, seats, subscription and payment history | You; Stripe | Billing, account management | Billing and hosting providers |
| Internet or network activity | Pages viewed, clicks, session replays, referrers, device and browser data, error data | Your device | Analytics, debugging, security, improve Services | Hosting provider (self-hosted analytics and error tracking) |
| Approximate geolocation | Country, region, or city derived from IP address | Your device; Cloudflare | Analytics, security | Hosting provider |
| Audio, electronic, visual | Profile photos, uploaded images, session replays | You; your device | Provide Services, analytics | Hosting and storage providers |
| Professional information | Agency, role, title, certifications, specializations | You; your agency | Provide Services, public profiles | Hosting provider; the public (if you publish) |
| Inferences | Product usage patterns | Derived from activity | Improve Services | Hosting provider |
| Sensitive personal information | Account sign-in (email with one-time code); any health or accessibility details you add to your own advisor record | You | Provide Services | Hosting provider |
We do not use or disclose sensitive personal information for purposes that would give California residents the right to limit its use under Cal. Civ. Code § 1798.121.
Retention periods are described in How Long We Keep Information.
No sale or sharing
We do not sell personal information and have not sold it in the past 12 months. We do not share personal information for cross-context behavioral advertising, and we do not use targeted advertising. We do not knowingly sell or share the personal information of consumers under 16.
Global Privacy Control
Because we do not sell, share, or use personal information for targeted advertising, there is nothing for a Global Privacy Control (GPC) signal to opt you out of. If that changes, we will treat GPC signals as valid opt-out requests for the browser and, where known, the account.
Your rights
Depending on where you live, you may have the right to:
- Know and access the personal information we have about you, including the categories, sources, purposes, and recipients;
- Get a copy of your personal information in a portable format;
- Correct inaccurate personal information;
- Delete personal information, subject to legal exceptions;
- Opt out of the sale of personal information, targeted advertising, and profiling that produces legal or similarly significant effects (we do none of these);
- Limit use of sensitive personal information (we use it only as permitted without a limitation right); and
- Appeal our decision on your request.
These rights are provided by, among others, California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), and Florida (Florida Digital Bill of Rights, to the extent it applies), and other states with similar laws.
How to make a request
Email [email protected] with the subject "Privacy Request" or write to us at the address in Contact Us.
Verification. We will verify your request by confirming you control the email address on your account (for example, by sending a one-time code) and may ask for more information if needed. We will use that information only to verify your request.
Authorized agents. You may use an authorized agent. We will ask the agent for signed written permission from you (or a valid power of attorney) and may ask you to verify your identity directly.
Timing. We respond within 45 days, and may extend once by 45 more days where allowed, with notice.
Appeals. If we deny your request, you may appeal by replying to our decision or emailing [email protected] with the subject "Privacy Appeal." We will respond within the time required by your state's law. If you disagree with the result, you may contact your state attorney general.
Non-discrimination. We will not deny you service, charge you a different price, or provide a different quality of service because you exercised your privacy rights.
California "Shine the Light"
California residents may ask whether we disclosed personal information to third parties for their direct marketing in the prior calendar year. We do not make such disclosures.
Privacy Rights in the EEA, UK, and Switzerland
If you are in the European Economic Area, the United Kingdom, or Switzerland, the GDPR, UK GDPR, or Swiss Federal Act on Data Protection may apply. TravelBreeze LLC is the controller of the information described in Our Two Roles as controller information. For Customer Data, the Customer is the controller and we are its processor.
Lawful bases
| Purpose | Lawful basis |
|---|---|
| Providing the Services and managing your account and subscription | Performance of a contract |
| Transactional messages | Performance of a contract; legitimate interests |
| Text and push notifications | Consent (you can withdraw at any time) |
| Analytics, session replay, and error tracking | Legitimate interests in operating and improving the Services |
| Security, fraud prevention, and enforcing our Terms | Legitimate interests |
| Marketing email | Consent, or legitimate interests where permitted for existing customers |
| Legal compliance | Legal obligation |
Your rights
You may have the right to access, correct, delete, restrict, or object to processing of your personal information, to data portability, and to withdraw consent at any time (without affecting earlier processing). To exercise these rights, email [email protected]. You also have the right to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner).
We do not make decisions based solely on automated processing that produce legal or similarly significant effects about you.
International Data Transfers
TravelBreeze is based in the United States, and our providers process information in the United States and other countries. If you are outside the United States, your information will be transferred to the United States, where privacy laws may differ from those in your country. When we transfer personal information from the EEA, UK, or Switzerland, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (with the UK Addendum or Swiss amendments as applicable), or a provider's certification under the EU-US Data Privacy Framework and its UK and Swiss extensions.
Children's Privacy
The Services are designed for businesses and are not directed to children. We do not knowingly collect personal information directly from children under 13 (or under 16 where that age applies), and Users must be at least 18. If you believe a child has given us personal information directly, contact [email protected] and we will delete it.
Travel agencies often plan trips for families, so Customer Data may include information about minors (for example a child's name, date of birth, or passport details entered by an advisor or a parent). The Customer is responsible for obtaining any required parental consent and for handling that information lawfully. We process it only on the Customer's instructions.
If You Are a Traveler
If a travel agency or advisor uses TravelBreeze to manage your trips, that agency controls your information. Its privacy policy applies, and you should send privacy requests (access, correction, deletion) to the agency. If you contact us, we will forward your request to the agency where we can identify it and will assist the agency as required by our agreement and applicable law.
Do Not Track
Some browsers send "Do Not Track" signals. There is no common industry standard for these signals, so we do not respond to them. We do respond to Global Privacy Control as described above.
Third-Party Sites and Services
The Services link to or embed third-party services (for example Stripe Checkout, Google Maps, supplier websites, and links advisors share). Their privacy practices are governed by their own policies, including the Google Privacy Policy for Google Maps features. We are not responsible for third-party practices.
Changes to This Policy
We may update this Policy from time to time. We will post the updated version with a new "Last updated" date. If we make material changes, we will notify Users by email or in the Services before the change takes effect. Where required by law, we will ask for your consent.
Contact Us
Questions, requests, or complaints about privacy:
- Email: [email protected]
- Mail: TravelBreeze LLC, Attn: Privacy, 30318 Plymouth Creek Cir, Sorrento, FL 32776, USA
- Support: [email protected]