The short version. To book travel we need who you are and who is travelling, and we pass those details to the airline or hotel you are booking. We keep your trips and preferences so you do not have to repeat yourself. We do not sell your data. We keep it until you delete your account — there is currently no automatic deletion, and this notice says so rather than quoting a period we do not enforce. Two exceptions: we delete our copy of a conversation with Jaunt on WhatsApp or iMessage 24 hours after your last message, and when you delete your account we keep the record of what you paid, without your name, because tax law requires it.
1. Who we are
Jaunt is a travel service operated by Elysium Consult Ltd, company number 15495904, registered office 3rd Floor, 86-90 Paul Street London EC2A 4NE United Kingdom. We are the data controller for the personal data described here.
We are registered with the Information Commissioner's Office under registration number ⚠ NOT YET SUPPLIED — ICO REGISTRATION NUMBER.
This notice covers the Jaunt website at usejaunt.com, the Jaunt connector used inside AI assistants, and Jaunt by text message on WhatsApp and iMessage. All of them run on the same systems and are covered by this one notice.
2. What we collect
Account and identity
- Your email address, and your name if you give one.
- Sign-in records, including the IP address and browser user-agent attached to a session.
- If you sign in with Google, the identity Google returns and the tokens that sign-in produces.
Traveller details for a booking
- Each traveller's name, and where the airline requires it, date of birth and gender as shown on their travel document.
- Contact email and phone number for the booking.
- For some airline bookings, passport number, nationality, issuing country and expiry. Where we collect these they are passed to the airline to complete the booking and are not stored on our systems afterwards.
- Ages of children and infants travelling.
Travel preferences
- Home airport and city, preferred cabin and seat, airlines and airports you want avoided or preferred, maximum layover, budget posture, country of residence.
- Loyalty and frequent-flyer numbers, if you add them.
- Dietary requirements and accessibility needs — see section 3, which deals with these separately because they need different treatment.
- A free-text “traveller memory” — notes about how you like to travel, which you or the assistant can add to.
Trips, bookings and payments
- Flights and stays you search for, plan, save or book, including booking references.
- Saved searches, price alerts, planning pins (which are places on a map, and are often somebody's home).
- Payment records: the amount, currency and the identifiers our payment provider gives us, and, if you are a member, your membership and whether its billing is active. We never see or hold your card number — card details are entered on our payment provider's own page, not ours.
Other people's details, which you give us
- People you add so they can follow a flight — their name, email and phone number. We only email them once you have confirmed them from your account on this website, and every email lets them unsubscribe.
- People you invite to a group trip — their email address.
- Anyone you name as a traveller on a booking.
If you give us someone else's details, please make sure they are happy for you to. They have the same rights over their data as you do over yours, and they can contact us directly to exercise them.
Messages you send us on WhatsApp or iMessage
- Your phone number, and the text of the messages you send us and of our replies.
- We read text only. Photos, voice notes and other attachments are not opened, and on iMessage, group conversations are ignored.
- To follow the thread, we keep the most recent 16 messages of the conversation, yours and ours together. We delete our copy of the whole conversation, including your number, automatically 24 hours after your last message.
- A text conversation is not linked to a Jaunt account. It cannot see your bookings or saved preferences, and you cannot book or pay by text — we send you a link to finish on the website. Please do not send card details, passport numbers or anything else you would not want kept for a day.
The messages also pass through the service you chose to use — WhatsApp, or Apple's iMessage — and through Sendblue, which connects us to iMessage, and each of them may keep its own copies of the messages it carried. A message that cannot be delivered as an iMessage may be sent as an RCS or ordinary SMS text message instead.
Email you send or connect
- If you forward a booking confirmation to your personal Jaunt inbox address, we read that email to extract the flight details. The message itself is not stored — only the extracted flight information.
- If you connect a Gmail account, we search it for booking confirmations and extract flight details the same way. Again, message contents are not stored. Connecting is optional and you can disconnect at any time.
Support and correspondence
Support tickets and chat transcripts, including whatever you choose to write in them. These are held in a separate support system.
If you deal with our team directly, they may also keep a short note on how you seem to prefer to be communicated with — for example brief and to the point, or patient and detailed — using a common four-style model of communication preferences known as DISC, so that whoever picks up your request can reply in a way that suits you. It is a judgement a person makes, and it is only shown to our staff.
The founding traveller list
If you join our founding traveller list before launch: your email address, your first name if you give it, and the campaign that brought you. We keep a record of the consent you gave — the exact wording you agreed to, when, your browser type, and a keyed hash of your IP address rather than the address itself. If you joined through a friend's invitation, or invite friends yourself, we record the link between those sign-ups. The person who invited you can see how many of the people they invited have joined, but not who; if we offer a reward for invitations, they can also see whether one has been earned, which can tell them that you have completed a trip with Jaunt. We email you to confirm your place, and a few times before launch; every email lets you unsubscribe.
If you write a guide for the Journal
Your name, which is published as your byline and as the credit on your photographs; your email address; what you write, including the places on your walk; the photos you upload and the date they were taken; and your confirmation that the words and photos are yours to license. We remove location and camera details embedded in your photos before we store them.
How you found us
Marketing attribution, only if you accept cookies: the campaign parameters and advertising click identifiers in the link you first arrived on, the page you landed on, the referring site, and any referral code in the link. See section 8.
How you use Jaunt
Always, from our own servers: a record of what you did with Jaunt, so we can see which features are used and whether they work — for example that a search, a trip plan or a tool in your AI assistant ran, whether it succeeded and how long it took, that a price alert or saved search was set up, and that a booking was made and of what type. These records carry your account's internal ID, or no ID at all when you are not signed in, and never your name, email address or what you searched for. For a WhatsApp or iMessage conversation they carry a code derived from your number with a secret key, not the number itself.
Only if you accept analytics cookies, from your browser: the pages you visit on this site and the links and buttons you click, with the search details cut out of every web address; the site that referred you; your browser, device type and screen size; and, if you are signed in, your account's internal ID. Never what you type into a form. See section 8.
3. Health and dietary information
Two of the preference fields need calling out on their own, because under UK data protection law they are special-category data — the most protected class there is:
- Accessibility needs. This is health data.
- Dietary requirements. These can reveal health information such as an allergy or a medical condition, and can reveal religious belief.
Both are free-text fields, both are optional, and you never have to fill them in. If you would rather tell the airline or the hotel directly rather than tell us, that is a perfectly sensible choice and the rest of Jaunt works normally without them.
Where you do provide them, we rely on your explicit consent, which you give by entering them and can withdraw at any time by clearing the field in your settings.
What we currently do with them, precisely. They are shown back to you, and shown to you again when you are booking, so you can pass them on yourself. If you use Jaunt through an AI assistant, they are included in what Jaunt returns to it when it reads your preferences or prepares a booking, so the company that provides the assistant receives them too. We do not currently send them to any airline, hotel or other travel supplier. Filling them in does not arrange a special meal or an assistance request — you still need to ask the airline or the property.
4. Where it comes from
- From you — on this website, by talking to a connected AI assistant, or by sending us a message on WhatsApp or iMessage. All of them reach the same systems.
- From your mailbox, if you forward a confirmation or connect Gmail.
- From other people, when someone adds you as a traveller, invites you to a group trip, or invites you to the founding traveller list.
- From our staff, when they note how you prefer to be contacted (see section 2).
- From travel suppliers, when they confirm a booking or send us flight status.
- From your device, automatically — IP address, browser type, and the pages you request.
5. Why we use it, and our lawful basis
Under the UK GDPR we need a lawful basis for each purpose. These are ours.
| What we do | Why | Lawful basis |
|---|---|---|
| Make and manage bookings | Search, book, change, cancel; send confirmations; handle refunds | Contract — we cannot book your travel without it |
| Run your account | Sign you in, keep your trip history, let you use a connected assistant | Contract |
| Answer your text messages | Plan a trip or answer a travel question you send us on WhatsApp or iMessage | Contract — steps you ask us to take before you book |
| Remember your preferences | So results reflect how you actually travel | Legitimate interests — providing a personalised service you asked for |
| Dietary and accessibility fields | Show them back to you when booking | Explicit consent (see section 3) |
| Track flights and notify people | Flight status, and status to people you nominate | Contract, and legitimate interests for the person you nominate |
| Support | Answer your questions, investigate problems, and note how you prefer to be contacted | Contract and legitimate interests |
| Security and abuse prevention | Rate limiting, fraud and abuse detection, audit records | Legitimate interests, and legal obligation where applicable |
| Marketing email | News and offers, and founding traveller emails, only if you opt in | Consent — withdrawable at any time |
| Measuring which marketing works | The attribution cookie, and crediting whoever referred you | Consent (see section 8) |
| Understanding how Jaunt is used | Counting which features are used and whether they work, from the records our servers keep (section 2) | Legitimate interests — improving a service you use, from records that do not name you |
| Browser analytics | Counting page visits and clicks on this site | Consent (see section 8) |
| Publishing guides you write | Your byline and photo credits on the Journal | Contract — your agreement with us as a contributor |
| Keeping Jaunt working | Error monitoring and diagnostics, including recording the steps our AI features take | Legitimate interests |
| Financial and tax records | Keeping records of transactions, including after you delete your account | Legal obligation |
Where we rely on legitimate interests you can object — see section 10. You can withdraw consent at any time without affecting anything done before you withdrew it.
7. International transfers
Several of the providers above process data in the United States — including Stripe, Resend, Anthropic, Google, Cloudflare, Meta, Sendblue and Mapbox. Some keep what we send them in a particular place: our main database is held in Cloudflare's Western Europe region and our support system in its Eastern Europe region, our error reports are stored in Sentry's EU region, our analytics in PostHog's EU region, the records of our AI features' steps in LangSmith's EU region, and the RateHawk relay runs on Fly.io servers in London — although Cloudflare, Sentry, PostHog, LangChain (which provides LangSmith) and Fly.io are all American companies. A text-message conversation is stored wherever Cloudflare places it, which may be outside Europe. Some travel suppliers are outside the UK too, necessarily: if you are flying to another country, your booking details go there.
When personal data leaves the UK, UK law requires the transfer to be covered by a recognised safeguard. Where we have confirmed it from the provider's own published terms:
- Stripe, Cloudflare, Resend, Mapbox, Google, Sentry and Fly.io are certified under the UK extension to the EU–US Data Privacy Framework, so transfers to them in the United States are covered by the UK's adequacy regulations for the United States.
- Anthropic's data processing terms include the EU standard contractual clauses together with the UK's International Data Transfer Addendum.
- Transfers to providers in the European Economic Area, such as HERE Technologies in the Netherlands and Nuitée in Ireland, are covered by the UK's adequacy regulations for the EEA.
For any other provider, you can ask us which safeguard applies and for a copy of it.
9. How long we keep it
Plainly: we keep your data until you delete your account. There is currently no automatic expiry of trips, bookings, searches or preferences. We would rather tell you that than quote a retention period we do not actually enforce.
| What | How long |
|---|---|
| Account, trips, bookings, preferences | Until you delete your account |
| Records of what you paid | After you delete your account, kept without your name or contact details for six years, because UK tax law requires it. We do not yet delete them automatically when the six years are up |
| WhatsApp and iMessage conversations | Our copy is deleted automatically 24 hours after your last message |
| Sign-in sessions | A session stops working after 7 days without use, and sign-in links and codes after 10 minutes. The record of past sessions, with their IP address and browser, is kept until you delete your account |
| Flight-sharing links | Stop working after 30 days. They cannot currently be revoked early — anyone with the link can see that flight until it lapses |
| Group-trip invite links | Do not currently expire |
| Gmail connection | Until you disconnect it or delete your account |
| Founding traveller list | A sign-up you never confirm is deleted after 30 days. A confirmed one is kept until you ask us to remove it — deleting your Jaunt account does not remove it |
| Marketing consent records | Kept as evidence of consent while your account exists |
| Unsubscribe / do-not-contact list | Kept indefinitely — deleting it would mean emailing you again by mistake |
| Support tickets | Held in a separate support system and not currently deleted with your account |
| Usage records in PostHog | Kept by PostHog under the retention set for our account; we have not set a shorter period of our own. They carry your account's internal ID, not your name, and are deleted when you delete your account (section 9) |
| Records in LangSmith | Kept under the retention set for our LangSmith account. They carry a code derived from your account's internal ID, not the ID itself or your name. Deleting your account does not currently delete them |
What deleting your account does
You can delete your account at Settings → Delete account. A connected AI assistant will normally send you to that page rather than do it for you. Before anything is deleted, that page shows you what will be removed and tells you that your payment records are kept.
When we will not delete it yet. While a booking is still being confirmed or paid for, or while you have a trip coming up — your account is how you manage that trip, and how we reach you if the airline or hotel changes something. Cancel the trip or wait until it is over. If you have a Jaunt membership, we cancel its billing with our payment provider first, straight away; if we cannot confirm that billing has stopped, we do not delete the account, so that you are never charged by an account you can no longer see.
What is destroyed. Your account and sign-in records; your preferences, including the fields in section 3 and your traveller memory; flights you track and the people you added to follow them; saved searches, price alerts, planning pins and notes your AI assistant saved; group trips you own and your place in other people's; invitations you created; your membership record; your marketing-consent records; how you found us; any Gmail connection and forwarding address; and any checkout you started but never paid for. We also tell our analytics provider, PostHog, to delete the usage records it holds under your account's internal ID, and its record of you (section 2). If PostHog cannot be reached at that moment, we keep trying automatically until it confirms, and we ask again half an hour later to catch anything sent in the meantime.
What is kept, without your name. The record of every booking that involved a payment — including cancelled and refunded ones — because UK tax law requires us to keep records of payments for six years. We keep the amount, the currency, the date, the status, what was booked (for a hotel, its name, the dates and the number of guests), the airline's or hotel's booking reference and our payment reference. We permanently remove the names, email addresses, phone numbers, dates of birth and travel-document details of you and everyone travelling with you, along with the full booking details the supplier sent us. What is left does not name you, but the booking and payment references still match the records the supplier and our payment provider keep under their own rules.
What is kept as it is, no longer attached to your account:
- The do-not-contact list, so we do not start emailing you again.
- Your details on other people's bookings — if someone else booked a trip with you on it, that is their record, not yours.
- Records our staff keep: actions they took on your account, trip proposals they prepared for you, and any note on how you prefer to be contacted (section 2). These carry your name or email address.
- Your place on the founding traveller list, if you joined it, with its consent record and referral links — ask us and we will remove it.
- Payment-event records, refunds we still owe you, orders we are still cancelling, and records of invitations or referrals you took up, which carry an internal account reference but not your name.
- Support tickets, which live in a separate system.
- Records of the steps our AI features took for your requests, held by LangSmith (section 6), which carry a code derived from your account's internal ID rather than the ID itself.
- The authorisation record for any AI assistant you connected, held by our sign-in system with your details encrypted. It is not currently removed when you delete your account, so disconnect Jaunt in the assistant too.
If you want everything possible removed rather than the automatic deletion, write to support@usejaunt.com and we will handle it manually.
10. Your rights
You have the right to:
- Be told what we hold and why — this notice.
- Get a copy of your personal data.
- Correct anything inaccurate — most of it is editable in your settings.
- Delete your data, subject to what section 9 explains.
- Restrict or object to processing, including anything based on legitimate interests.
- Portability — a machine-readable copy of data you gave us.
- Withdraw consent at any time, including for marketing, for cookies, and for the fields in section 3.
We do not make any decision about you by purely automated means that produces a legal or similarly significant effect.
To exercise any of these, write to support@usejaunt.com. We will respond within one month. There is no charge.
A limitation we would rather state than hide. Self-service data export is currently only available through a connected AI assistant. It covers what we hold in our main database, but not support tickets, which live in a separate system. If you want a complete copy, email us and we will assemble it by hand.
11. Security
Data is held on Cloudflare's infrastructure. Traffic is encrypted in transit. Sign-in has no password to steal — we email you a single-use link or a one-time code instead, or you can sign in with Google. Access to operational tools is restricted and audited, and requests that spend money require a separate confirmation step.
We never see your card number. Card details are entered on our payment provider's own page.
Where we hold a credential on your behalf — the token that lets us read your Gmail if you connect it — it is encrypted at rest. Most other data is stored unencrypted at the field level within our managed database, protected by the platform's own access controls rather than by application-level encryption.
A text-message conversation is filed under a code computed from your phone number with a secret key, so our usage limits and records never hold your number in readable form. The number itself is kept only inside the conversation, so that we can reply, and is deleted with it.
If you disconnect Gmail we stop reading your mailbox and remove the stored token. We recommend also removing Jaunt from your Google account's third-party access list at myaccount.google.com/permissions.
12. Children's data
Jaunt is for adults. You must be 18 or over to hold an account or to message Jaunt. We do process children's details — names and ages — when an adult books travel for them, on the instruction of the adult making the booking, who must have authority to give us those details.
13. Changes to this notice
We update this notice when what we do changes. The date at the top is when it was last reviewed. Material changes will be notified to account holders.
14. Contact and complaints
For anything about your personal data, write to support@usejaunt.com, or by post to Elysium Consult Ltd, 3rd Floor, 86-90 Paul Street London EC2A 4NE United Kingdom.
If you are unhappy with how we have handled it, you can complain to the Information Commissioner's Office — ico.org.uk/make-a-complaint, or 0303 123 1113. We would appreciate the chance to put it right first.