Privacy Policy
Privacy Policy
Last updated: 27 July 2026
Data controller: Viktor Vitulskyi, sole proprietor registered in Poland
Address: Przystankowa 26, 52-231 Wrocław, Polska
NIP: 5252941012
Email (data protection): privacy@travelboard.fun
Email (general): support@travelboard.fun
This Privacy Policy explains how TravelBoard (travelboard.fun) collects, uses, stores, and protects personal data when you use our tour marketplace platform.
1. Who we are
TravelBoard is a platform that helps travelers find tours and helps organizers publish tour listings, manage conversations, and grow their presence. We operate primarily for users in the European Union and European Economic Area.
We are the data controller for personal data processed through the TravelBoard website and related services.
2. What data we collect
Account and profile data
- Email address and password (or OAuth provider identifier for Google/Facebook sign-in)
- Public display name, avatar, company name and description (organizers)
- User roles (traveler, organizer)
- Social profile links you choose to publish (organizers)
Marketplace activity
- Tour listings: titles, descriptions, photos, pricing, categories, locations, and itinerary data
- Chat messages between travelers and organizers
- Reviews and organizer replies
- Organizer gallery photos
Payment data
- Credit balance and purchase history
- Stripe checkout session identifiers and payment metadata
We do not store full payment card numbers. Card processing is handled by Stripe.
Technical and usage data
- Session cookies (
auth_token, refresh token cookie) - Consent preferences (via c15t)
- Analytics and marketing cookies (only with your consent)
- Server logs: IP address, browser type, timestamps, requested URLs
- Locale and language preference
Data you provide voluntarily
- Messages sent through contact or report email links
- Content you upload or type into forms
3. Why we use your data and legal bases (GDPR Art. 6)
| Purpose | Data | Legal basis |
|---|---|---|
| Create and manage your account | Account data | Contract (Art. 6(1)(b)) |
| Operate tour listings, chat, reviews | Marketplace data | Contract (Art. 6(1)(b)) |
| Process credit purchases | Payment metadata | Contract (Art. 6(1)(b)) |
| Keep the platform secure | Logs, session data | Legitimate interest (Art. 6(1)(f)) |
| Comply with law | Relevant records | Legal obligation (Art. 6(1)(c)) |
| Analytics (with consent) | Usage cookies | Consent (Art. 6(1)(a)) |
| Marketing cookies (with consent) | Ad/tracking cookies | Consent (Art. 6(1)(a)) |
4. Cookies
We use cookies and similar technologies. See our Cookie Policy for details. You can change your preferences at any time via Cookie settings in the footer or on the Cookie Policy page.
5. Who we share data with
We share data only when necessary:
| Processor | Purpose | Location |
|---|---|---|
| Stripe | Payment processing | EU/US (with safeguards) |
| AWS (S3) | Image and file storage | EU (eu-north-1) |
| Self-managed MongoDB 8.0 (AWS ECS Fargate) | Accounts, tour listings, chat, reviews, billing, consent | EU — AWS eu-north-1 (Stockholm); operated by Viktor Vitulskyi |
| Self-hosted c15t (@c15t/backend) | Cookie/consent preferences (subject ID, timestamps, domain, policy version) | Same MongoDB on AWS eu-north-1; no c15t Cloud / no third-party transfer |
| OAuth providers (Google, Facebook) | Authentication | Per provider policy |
We do not sell your personal data.
6. International transfers
If data is transferred outside the EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions, as applicable.
7. How long we keep data
| Data type | Retention |
|---|---|
| Account data | Until account deletion + limited backup period |
| Tour listings | Until archived or deleted by the user or by moderation |
| Chat messages | While account is active; deleted on account removal where feasible |
| Reviews | While relevant to the organizer profile; may be anonymised on deletion |
| Payment records | As required by tax and accounting law (typically up to 5 years in Poland) |
| Server logs | Up to 90 days unless needed for security investigations |
| Consent records | As required by privacy law; stored in self-hosted c15t on AWS eu-north-1 |
8. Your rights
Under GDPR, you have the right to:
- Access your personal data
- Rectify inaccurate data
- Erase your data (“right to be forgotten”) in certain cases
- Restrict processing in certain cases
- Port data you provided in a structured format
- Object to processing based on legitimate interests
- Withdraw consent at any time (for consent-based processing)
- Lodge a complaint with a supervisory authority
Poland: President of the Personal Data Protection Office (UODO) — uodo.gov.pl
To exercise your rights, email privacy@travelboard.fun. We respond within one month, extendable by two months for complex requests.
9. Account deletion
You may request account deletion by contacting support@travelboard.fun. We will delete or anonymise personal data unless we must retain it for legal obligations or legitimate disputes.
10. Children
TravelBoard is not intended for users under 18. We do not knowingly collect data from children.
11. Security
We use technical and organisational measures including HTTPS, httpOnly session cookies, access controls, and secure payment handling via Stripe. No method of transmission over the Internet is 100% secure.
12. Changes
We may update this policy. The “Last updated” date will change. Material changes will be communicated where required by law.
13. Contact
Data controller: Viktor Vitulskyi
Address: Przystankowa 26, 52-231 Wrocław, Polska
Email: privacy@travelboard.fun
For general support: support@travelboard.fun
See also: Impressum | Terms of Service | Cookie Policy