Privacy Policy and Processing of Personal Data

In effect since July 5, 2026 · Version 1.1

This is an English translation provided for your convenience. Selfy Travel operates under the laws of Colombia; in the event of any discrepancy, the Spanish version prevails.

This policy describes how SELFY TRAVEL S.A.S. (hereinafter, "Selfy Travel", "we"), a company incorporated in Colombia, identified with tax ID (NIT) 902080919-7, registered in the National Tourism Registry (RNT) under No. 294826 and domiciled in Rionegro, Antioquia, collects, uses, stores and protects your personal data when you use the Selfy Travel mobile and web application (the "App"). We act as data controller under Law 1581 of 2012, Decree 1377 of 2013 and other Colombian data protection regulations.

Contact channel for anything related to your data: soporte@selfytravel.com.

1. What data we collect

1.1 Your account data

• Email, name and phone (phone is optional), and your password in encrypted form. We use them to create and authenticate your account and to communicate with you.

1.2 Your trip content

• Itineraries, reservations and notes that you or your agency record: destinations, dates, times, places, providers and confirmation codes.
• Documents you upload voluntarily (for example passports, visas, insurance, tickets or vouchers). They are stored encrypted at rest. The documents you upload are private: only you (and the people who take part in your trip) can see them; your agency cannot view or download them. Documents your agency uploads for your managed trip (tickets, vouchers) are visible to both you and the agency.
• Shopping, packing and medicine lists. The medicine list is a personal organization tool that you fill in voluntarily; by using it you authorize us to store that information, which may be considered sensitive data. We do not use it for any purpose other than showing it to you and the people on your trip.

1.3 Location (GPS)

• The AI travel guide uses your point-in-time location only at the moment you request it ("Where am I?"), to identify nearby places. We do not track your location in the background and we do not store location histories linked to your identity: the App only temporarily keeps the places detected around a coordinate, without linking them to your account.

1.4 Emails you forward to us

• If you forward a confirmation email to reservas@selfytravel.app, we process its content (subject and body) to extract the reservation details and propose them to you in the App. The email is processed automatically; we keep an excerpt so you can review it before accepting the reservation.

1.5 Technical data

• Push notification token of your device (if you allow notifications).
• Error and diagnostic reports (Sentry): sent without your email or name — only an internal identifier and technical data about the failure, with URLs scrubbed of credentials.
• In the web version we use the browser's local storage to keep your session signed in. We do not use advertising cookies or third-party trackers.

1.6 Optional profile data

• Home city and country and travel interests that you choose to add to your profile. We use them to personalize your suggestions and to pre-fill your preferences in the AI planner. They are optional: you can leave them empty or delete them whenever you want from Profile. We do not use them for advertising and we do not sell them.

2. What we use your data for (purposes)

• Provide the service: create your account, save and show your trips, sync them across devices and enable collaboration with people that you (or your agency) invite.
• If you are an agency client: organize and manage the trip you booked.
• Generate artificial intelligence content that you request (travel guide, itinerary planning, reading of reservation emails).
• Send you notifications about your trip (changes, flight and check-in reminders), which you can disable on your device.
• Send transactional emails (invitations, access links, password resets).
• Maintain the security of the service, prevent abuse (for example, usage limits) and diagnose errors.

We do not sell your data and we do not use it for third-party advertising.

3. Artificial intelligence

4. Who we share data with (data processors)

We use infrastructure providers that process data on our behalf, under their own security and data protection commitments:

These providers may be located outside Colombia (mainly in the United States). By accepting this policy you authorize the international transfer and transmission of your data to said processors, exclusively for the purposes described.

In addition, a trip's content is visible to the people who take part in it: your agency (in managed trips) and the collaborators invited to the trip. Exception: the private documents that you upload are not visible to your agency (see 1.2).

5. Your rights

As the data owner you may, at any time: access, update, rectify and delete your data; revoke the authorization granted; request proof of the authorization; and file complaints with the Superintendence of Industry and Commerce (SIC).

• You can edit your name and phone directly in the App (Profile).
• You can delete your account from the App (Profile → Danger zone): your profile, your own trips and your files are deleted. This action is irreversible.
• For any other request write to soporte@selfytravel.com. We answer inquiries within 10 business days and claims within 15 business days, as required by law.

6. How long we keep your data

• While your account is active, we keep your data to provide the service.
• When you delete your account, your personal data is removed from the active database. Technical backups may persist for a limited period before being rotated.
• Technical caches not associated with your identity (public place information) are purged automatically in 30- to 90-day cycles.
• We may retain data that the law requires us to keep (for example, accounting information for services booked with the agency).

7. Security

We apply appropriate technical and organizational measures: encryption in transit (TLS) and at rest, row-level access controls in the database (each user can only read and modify what belongs to them), secrets managed outside the code, anti-abuse usage limits and error monitoring. No system is infallible; if we detect a security incident affecting your data, we will notify you and report it to the authorities as required by law.

8. Minors

The App is not directed to people under 18 and we do not knowingly collect data from minors. A responsible adult may record travel information of minors traveling with them (for example, in the reservations of a family trip), under their responsibility as a representative.

9. Changes to this policy

We may update this policy. We will publish the current version on this page with its date, and if the change is material we will inform you through the App or by email before it takes effect.

10. Data controller

SELFY TRAVEL S.A.S. — NIT 902080919-7
National Tourism Registry (RNT) No. 294826
Rionegro, Antioquia, Colombia · Commercial registration No. 182859
soporte@selfytravel.com · selfytravel.app