Back
Legal

Privacy Policy

Last updated: August 8, 2026

1. Introduction

Destineries ("we", "us", "our", or "the Company") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you access or use the Destineries platform, website, and related services (collectively, the "Service" or "Platform"). The Platform provides AI-powered tools that enable travel creators — including local guides, travel agents, hotels, and content creators — to build, price, market, and sell travel packages to customers worldwide.

This Privacy Policy is designed to comply with applicable international data protection regulations, including the General Data Protection Regulation (GDPR) of the European Union and the European Economic Area (EEA), the California Consumer Privacy Act (CCPA), the UK Data Protection Act 2018, and other applicable privacy laws. We are the data controller responsible for your personal information under these laws.

By accessing or using our Service, you consent to the collection, use, and processing of your personal information as described in this Privacy Policy. If you do not agree with the practices described herein, please do not use the Service.

2. Who We Are

Destineries operates the Platform accessible at destineries.com. We provide AI-powered tools for travel creators to build, price, and market travel packages.

Data Controller: Destineries
Contact Email: hello@destineries.com
WhatsApp: +62 818 0361 4636

For data protection inquiries specifically, you may contact our Data Protection Officer or privacy team at hello@destineries.com with the subject line "Privacy Inquiry."

3. Personal Information We Collect

We collect various categories of personal information depending on how you interact with the Platform. The categories of personal information we may collect include:

  • Identification and Account Data: Full name, email address, password (encrypted), user role (creator, traveller, or administrator), and profile information you provide when registering for an account.
  • Business and Verification Data: For creators and business accounts — legal name, company registration number, business type, tax identification number, authorised representative details, address, and uploaded verification documents such as identification cards, business licenses, and tax certificates.
  • Booking and Travel Data: Traveller names, email addresses, phone numbers, travel dates, number of travellers, booking preferences, special requests, and any notes submitted during the booking process.
  • Content Data: Travel packages, itineraries, pricing information, images, videos, marketing content, reviews, and any other materials you create, upload, or publish on the Platform.
  • Usage Data: Information about how you interact with the Platform, including pages visited, time spent on pages, features used, click data, search queries, device type, operating system, browser type, IP address, and referral URLs.
  • Communications Data: Messages, inquiries, and correspondence sent to us via our contact form, email, WhatsApp, or other communication channels, including the content of those communications.
  • Payment Data: We do not store full payment card details on our servers. Payment processing is handled by our third-party payment processors. We may retain transaction records, billing addresses, and the last four digits of card numbers for accounting and dispute resolution purposes.
  • Technical and Log Data: Server logs, error reports, device identifiers, and other technical information collected automatically when you use the Platform.

How We Collect: We collect personal information (a) directly from you when you create an account, submit a booking, upload content, or communicate with us; (b) automatically through cookies, analytics tools, and similar technologies when you use the Platform; and (c) from third parties such as our service providers and partners.

4. Legal Basis for Processing (GDPR)

Under the GDPR, we process personal information only where we have a lawful basis to do so. The legal bases on which we rely are:

  • Contractual Necessity (Article 6(1)(b)): Processing is necessary for the performance of a contract to which you are a party, or to take steps at your request prior to entering into a contract — for example, processing your information to create an account, process bookings, or deliver services you have requested.
  • Legal Obligation (Article 6(1)(c)): Processing is necessary for compliance with a legal obligation to which we are subject — for example, retaining financial records for tax compliance or responding to lawful requests from authorities.
  • Legitimate Interests (Article 6(1)(f)): Processing is necessary for our legitimate interests or those of a third party, provided such interests are not overridden by your rights and freedoms — for example, platform security, fraud prevention, product improvement, and internal analytics.
  • Consent (Article 6(1)(a)): You have given consent to the processing of your personal information for a specific purpose — for example, sending marketing communications or setting non-essential cookies. You may withdraw consent at any time.
  • Vital Interests (Article 6(1)(d)): Processing is necessary to protect the vital interests of you or another natural person — for example, in a medical or safety emergency.

For special categories of personal data (Article 9), we will only process such data where we have obtained your explicit consent or where processing is necessary for another limited purpose permitted under the GDPR.

5. How We Use Your Personal Information

We use the personal information we collect for the following purposes:

  • Service Provision: To create and manage your account, process bookings, generate AI-assisted itineraries and content, and deliver the services you request.
  • Communication: To send booking confirmations, status updates, service notifications, security alerts, and responses to your inquiries. Where you have provided consent, to send marketing communications and promotional materials.
  • Verification and Compliance: To verify creator identities and business credentials, conduct due diligence, and comply with legal and regulatory obligations including anti-money laundering (AML) and know-your-customer (KYC) requirements.
  • Platform Improvement: To analyse usage patterns, understand user behaviour, develop new features, improve existing functionality, and enhance the overall user experience.
  • Security and Fraud Prevention: To monitor for suspicious activity, prevent fraud, unauthorised access, and other malicious activities, and to protect the integrity and security of the Platform.
  • Dispute Resolution: To investigate, respond to, and resolve disputes, complaints, and legal claims arising from bookings or use of the Platform.
  • Analytics and Research: To conduct aggregated and anonymised analytics to understand trends, measure performance, and make data-driven business decisions.
  • Legal Compliance: To comply with applicable laws, regulations, court orders, and lawful requests from government and regulatory authorities.

6. Sharing and Disclosure of Personal Information

We do not sell your personal information to third parties. We may share or disclose your personal information in the following circumstances:

  • Service Providers and Processors: We share personal information with third-party service providers who perform services on our behalf, including cloud hosting providers, email delivery services, analytics providers, payment processors, and customer support tools. These providers are bound by data processing agreements and are only permitted to use your information to provide services to us.
  • Travel Creators and Vendors: When you book a travel package, we share your booking information (name, contact details, travel preferences) with the relevant travel creator or vendor to facilitate and fulfil your booking.
  • Legal and Regulatory Authorities: We may disclose personal information when required by law, court order, or lawful request from government or regulatory authorities, or to cooperate with law enforcement investigations.
  • Business Transfers: In the event of a merger, acquisition, reorganisation, or sale of all or a portion of our assets, personal information may be transferred as part of that transaction. We will notify you via email or a prominent notice on the Platform before your information becomes subject to a different privacy policy.
  • Protection of Rights: We may disclose personal information to protect the rights, property, safety, or security of Destineries, our users, or others, including to prevent fraud, enforce our Terms of Service, or take action against activities that may be illegal or harmful.
  • Consent: We may share personal information with third parties when you provide consent or direct us to do so.

7. Data Retention

We retain personal information for as long as necessary to fulfil the purposes for which it was collected, including to comply with legal, accounting, and reporting requirements, and to resolve disputes. Our retention periods are as follows:

  • Account Data: Retained for the duration of your active account. If you request account deletion, we will delete or anonymise your account data within 30 days, subject to legal retention requirements.
  • Booking Records: Retained for a minimum of 7 years to comply with financial, tax, and accounting regulations.
  • Verification Documents: Retained for the duration of the creator's active account and for up to 5 years after account closure, as required for compliance purposes.
  • Usage and Log Data: Retained for up to 24 months, after which it is deleted or anonymised.
  • Communications: Retained for up to 3 years for customer support and dispute resolution purposes.
  • Marketing Data: Retained until you withdraw consent or unsubscribe, after which it is deleted within 30 days.

When personal information is no longer needed, we will securely delete or anonymise it in accordance with our data retention and deletion policies.

8. Data Security

We implement appropriate technical and organisational measures designed to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:

  • Encryption of data in transit using TLS/SSL and encryption of sensitive data at rest.
  • Role-based access controls and least-privilege access principles.
  • Regular security assessments, vulnerability testing, and code reviews.
  • Secure data centres with physical and environmental controls.
  • Staff training on data protection and information security.
  • Incident response and breach notification procedures.

However, no method of transmission over the internet or method of electronic storage is completely secure. While we strive to protect your personal information, we cannot guarantee absolute security. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and affected individuals in accordance with applicable legal requirements and within the timeframes prescribed by law.

9. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

GDPR Rights (EEA and UK Residents)

  • Right of Access: You may request a copy of the personal information we hold about you.
  • Right to Rectification: You may request that we correct any inaccurate or incomplete personal information.
  • Right to Erasure ("Right to be Forgotten"): You may request that we delete your personal information, subject to legal retention requirements.
  • Right to Data Portability: You may request that we provide your personal information in a structured, commonly used, and machine-readable format, or transfer it to another controller.
  • Right to Restriction of Processing: You may request that we restrict the processing of your personal information in certain circumstances.
  • Right to Object: You may object to the processing of your personal information based on legitimate interests or for direct marketing purposes.
  • Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
  • Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority. In the EU, you can find your local authority at edpb.europa.eu.

CCPA Rights (California Residents)

  • Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, the purpose, and the third parties with whom we have shared it.
  • Right to Delete: You may request that we delete your personal information, subject to exceptions.
  • Right to Opt-Out of Sale: We do not sell personal information. However, you have the right to opt-out of any future sale.
  • Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

To exercise any of these rights, please contact us at hello@destineries.com. We will respond to your request within the timeframe required by applicable law (generally within 30 days). We may need to verify your identity before processing your request.

10. International Data Transfers

Your personal information may be transferred to, stored in, and processed in countries outside your jurisdiction, including countries that may not have the same data protection standards as your country of residence. When we transfer personal information outside the European Economic Area (EEA) or the United Kingdom, we ensure that appropriate safeguards are in place to protect your information, such as:

  • Standard Contractual Clauses (SCCs) approved by the European Commission.
  • Binding Corporate Rules (BCRs) where applicable.
  • Transfer to recipients in countries that have been deemed to provide an adequate level of data protection.
  • Other lawful mechanisms for data transfer as permitted by applicable law.

11. Children's Privacy

Our Service is not directed to, and we do not knowingly collect personal information from, children under the age of 18. If we become aware that we have collected personal information from a child under 18 without parental consent, we will take steps to delete such information. If you believe we have collected personal information from a child, please contact us at hello@destineries.com.

12. Cookies and Tracking Technologies

We use cookies and similar tracking technologies (such as web beacons, pixels, and local storage) to track activity on our Platform and to store certain information. For detailed information about the cookies we use and how to manage them, please refer to our Cookie Policy. You can set or amend your cookie preferences through your browser settings at any time.

13. Third-Party Links and Services

Our Platform may contain links to third-party websites, services, and applications that are not operated by us. We have no control over and are not responsible for the privacy practices or content of these third parties. We strongly encourage you to review the privacy policies of any third-party sites or services you visit. This Privacy Policy applies solely to information collected through our Platform.

14. Automated Decision-Making and Profiling

We use AI-powered tools to assist in generating itineraries, pricing, and marketing content. These tools do not make solely automated decisions that produce legal or similarly significant effects on you. Where any automated processing produces such effects, you have the right not to be subject to a decision based solely on automated processing, and to request human intervention, express your point of view, and contest the decision.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by posting the updated policy on this page and, where appropriate, by sending an email notification or displaying a prominent notice on the Platform. We encourage you to review this Privacy Policy periodically. The "Last updated" date at the top of this page indicates when the policy was last revised. Your continued use of the Platform after any changes constitutes acceptance of the updated Privacy Policy.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: