AVARA's Digital Sanctuary
How AVARA protects your travel data — encryption, minimal collection, GDPR rights, and the quiet-luxury principles behind our security posture.
Our commitment to your privacy and security — explained plainly.
A members-only club doesn't shout your name across the room. AVARA treats your travel information the same way: collected only when needed, shared only with your consent, and protected as though it were being kept in a private safe rather than a filing cabinet.
, seated in Stockholm. Our legal identity, terms, and data-processing records are published openly — a small but important signal of legitimacy in a category full of anonymous middlemen.
Every request uses TLS. Sensitive fields — travel documents, contact details, payment references — are additionally encrypted at the database layer.
Our database enforces access at the row level: you can only ever read or modify data that belongs to you or a trip you've been invited to.
We ask only for what a given feature genuinely needs. Optional fields stay optional.
Every privileged action — admin access, exports, security-sensitive changes — is logged and reviewed.
AVARA never stores card details and is never the merchant of record. No Travel-as-a-Service partner is contracted yet, so AVARA does not currently take payment for travel; when a partner is in place, payments will be handled by them through their PCI-compliant systems.
As an EU-based company, AVARA is bound by the General Data Protection Regulation. You have the right to access your data, correct it, export it, restrict its use, and delete it. Deletion is one click from Settings and cascades across trips, messages, expenses, and analytics.
Live location is only shared when you explicitly trigger an emergency check-in. Movement logs are stored for a maximum of 72 hours and then permanently deleted. Nothing is shared with third parties for advertising.
Consent is granular. You choose separately whether to allow functional cookies, analytics, session replay, and marketing. Session replay and error monitoring only activate after you opt in — never by default.
Our privacy and legal documents are linked from the footer of every page. If anything is unclear, you can reach our privacy team directly and expect a human response — not a form letter.
Yes. AVARA is operated by AVARA Technologies AB, a company registered with Bolagsverket in Stockholm (org-nr 559585-8753). We publish our legal terms, privacy policy, and data-processing records openly.
How does AVARA protect my personal and travel data?
All traffic is TLS-encrypted, sensitive fields are encrypted at rest, access is scoped by row-level security, and audit logs track every privileged action. We collect the minimum data required to plan and protect your trip.
Yes. GDPR gives you the right to access, correct, export, and delete your data at any time. Deletion is one click from Settings and cascades across trips, messages, and analytics.