Privacy Policy
How AVARA collects, uses, stores, and protects your personal data, in line with GDPR and global privacy standards.
AVARA is committed to protecting your personal data in accordance with GDPR and other applicable privacy laws.
The data controller for personal information processed through the AVARA platform is:
Name, email address, phone number, date of birth, passport details
Trip itineraries, bookings, preferences, travel history, group travel information
Payment card details (tokenized), billing address, transaction history, expense tracking
Real-time location (only during emergency mode or with explicit consent), destination searches
IP address, browser type, device information, usage patterns, cookies
Emergency contacts, safety check-in status, crisis alerts
If you choose to sign in with Google, Google shares your name, email address and profile picture with AVARA. AVARA receives nothing else from your Google account: no contacts, calendar, Gmail, Drive or other Google data. We use your email address to create your AVARA account and sign you in, and your name to prefill it in AVARA, for example in booking and quote requests. Your name is shared with other people only as described in section 6. Your profile picture is stored with your sign-in record and is not displayed in AVARA. This data is stored in the EU, kept and deleted as described in section 5, and never sold. You can remove AVARA's access to your Google account at any time at myaccount.google.com/linkedapps.
We process your data to provide travel booking and management services you've requested.
For location tracking during emergencies, marketing communications, and optional analytics.
To improve our services, prevent fraud, and ensure platform security.
To comply with financial regulations, tax requirements, and legal requests.
Provide intelligent travel assistance powered by automated processing
We retain your data while your account is active and for the duration required to provide services.
After account closure, we retain data for 90 days (for account recovery) then delete or anonymize it, except for:
Financial records: 7 years (tax and accounting requirements)
Deleted automatically after 72 hours unless you request earlier deletion.
We do not sell your personal data. We share data only as necessary with:
Database and authentication (GDPR compliant, EU servers)
Receives the booking and traveller details needed to sell and deliver the trip, and takes your payment as merchant of record. That provider is an independent data controller for the booking, not an AVARA processor, and its own privacy policy applies to what it does with your data.
Airlines, trains, buses, ferries (to complete bookings)
We may disclose data to comply with legal obligations, court orders, or to protect our rights and safety.
When you join a group trip, certain information (name, itinerary) is shared with group members.
Request deletion of your data (subject to legal retention requirements)
Receive your data in a structured, machine-readable format
Object to processing based on legitimate interests or for direct marketing
Withdraw consent for consent-based processing at any time
You also have the right to lodge a complaint with your local data protection authority.
Encryption in transit (TLS 1.2+) for all traffic between your device and AVARA