Privacy notice

Who we are

Tripixo is operated by Ribbitnova Inc. ("Tripixo", "we", "us"). For any privacy question, request, or complaint, contact us at [email protected]. Ribbitnova Inc. does not yet have a fixed registered business address published on this site; if you need it for a formal request (including a GDPR or CCPA request), email us and we will provide it.

What we collect

Preview and creator-interest submissions: name, email address, phone or WhatsApp number, creator type, channel and content links, additional social profiles and follower counts, audience range, travel-content views, monetization preferences, affiliate platforms, selected interests, and the challenge you want to solve. We calculate an internal intent score from this information to help us prioritize research and support; the score does not make an automated legal or financial decision about you, and you can ask us to explain or exclude it (see "Your rights" below).

Creator accounts: profile information, password hashes, sessions, trip drafts, published trip pages and publication history, calendar availability, and (where a creator connects Google Calendar) the calendar access token and event data needed to show and manage booking availability.

Traveller accounts and bookings: name, email address, guest or registered account details, booking and payment metadata (see "Payments" below), messages sent through inquiry forms, and (for booked consultation calls) written transcripts and AI-assisted notes, if you agree on the call-consent screen. We do not record audio or video.

Everyone: published trip pages collect privacy-limited page views and outbound-click events tied to a browser session identifier, not to your name. See our Cookie policy for the full list of cookies, including optional analytics cookies that only load with your consent.

Payments

Card payments for creator subscriptions and traveller bookings are processed by Stripe. We do not store full card numbers on our servers: Stripe collects and stores payment card data directly under its own PCI-compliant systems. We store transaction metadata (amount, status, associated booking or subscription, billing email) needed for receipts, payouts, support, and accounting. See Stripe's privacy policy for how Stripe handles your payment data.

Google Calendar

If a creator chooses to connect Google Calendar, we request access to their email, basic profile, and calendar scopes via Google OAuth. We use this only to check free/busy availability, prevent double-booked planning call slots, and create private Tripixo booking blocks for confirmed planning calls on that creator's own calendar. We do not show private event titles, notes, guests, or locations to travellers. A creator can disconnect Google Calendar at any time from their creator settings, which revokes our access.

Tripixo's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, or use it to train generalized AI models.

Call transcripts and AI notes

Before a paid consultation call, we ask if we may turn the call into a written transcript. If you say yes, we use an AI service to draft notes for your creator. Your creator reviews and edits the notes before you see them. If you say no, you still join the call, and nothing is transcribed. We do not record audio or video. We do not make transcripts public or use them for advertising.

We delete the transcript 30 days after the call ends. The notes your creator shares with you stay on your booking until you delete them or close your account. You can delete the transcript, the notes, and any training copy at any time from your booking page, or by emailing us.

Optional: AI training. On the same screen, you can choose to let us keep the trip details from your call to train our AI. This is separate from the transcript itself, you can say no and still book, and you can withdraw at any time from your booking page. We do not keep the transcript for this. An AI service reduces it to the trip itself (places, dates, budget, interests, and your creator's advice) and leaves out anything about you or the people with you. We keep that summary for up to 24 months, or until you withdraw, whichever is sooner. Deleting your booking or account also deletes it. We cannot remove text that was already used to train a model that is complete, so we will tell you if that applies.

How we use your information

We use this information to: review preview requests and prepare monetization previews; create and operate creator and traveller accounts; process bookings and payments; enable calendar scheduling; provide the call transcription features you've opted into; train our AI, only if you opted into that; prevent duplicate, fraudulent, or abusive submissions; provide customer support; conduct product research and improve Tripixo; and communicate with you about your account or Tripixo's development.

Our legal bases for these uses (under GDPR Article 6) are: performance of a contract (running your account, processing bookings and payments), your consent (optional analytics cookies, call transcription, AI training), our legitimate interests (fraud prevention, product research, service improvement), and legal obligation (accounting and tax records).

How it is stored and shared

Preview-request and creator-interest information may be sent to our configured form-processing webhook or stored in Supabase; a webhook may connect to services such as Google Sheets, Make, Zapier, or n8n. Creator and traveller product data, bookings, and messages are stored in our configured PostgreSQL database. Payment data is held by Stripe. Video calls run on Daily, which also produces the live call transcript. Microsoft Azure OpenAI reads transcripts to draft notes, and reads them again to remove personal details from training copies. Daily and Microsoft act as our processors: they handle this data only on our instructions, and they may not use it for their own purposes. Calendar data is held by Google and mirrored only as needed in our database. We do not sell your personal information.

We use vendors located inside and outside your country, including the United States and other countries where our infrastructure and service providers (such as Supabase, Stripe, Google, Daily, and Microsoft) operate. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on the safeguards those providers offer (such as Standard Contractual Clauses) as part of their own compliance programs.

Retention

We keep preview-request and creator-interest data while the account or research relationship is active, and delete it within 24 months of the last interaction if no account is created. Creator and traveller account data is kept for as long as the account is open, plus a limited period afterward to comply with legal, accounting, and dispute-resolution obligations (generally up to 7 years for financial records). Call transcripts are deleted 30 days after the call. Training copies, if you agreed to them, are deleted after 24 months at most. Text that our systems logged while drafting notes from a transcript is deleted after 30 days.

Your rights

Depending on where you live, you may have the right to: access the personal data we hold about you; correct inaccurate data; request erasure; restrict or object to certain processing; receive a copy of your data in a portable format; and withdraw consent at any time (for example, by rejecting analytics cookies or turning off transcription or AI training). To exercise any of these rights, email [email protected]. If you are in the EEA, UK, or Switzerland and are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.

You can manage optional analytics cookies at any time on our Cookie policy page.

Children

Tripixo is not directed at children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us and we will delete it.

Policy updates

This notice will be updated as our company, infrastructure, and service providers evolve; material changes will update the "Last updated" date above.