Privacy Policy

1. Introduction

Attention Keeper LLC ("Attention Keeper," "we," "our" or "us") provides a client retention system for travel advisors. This Privacy Policy explains how we collect, use, disclose and safeguard personal data when you visit attentionkeeper.com, use our platform or any apps we release, use a client portal or supplier portal that a travel advisor has invited you to, subscribe to our newsletter, register for a demo, apply for a job or otherwise contact us.

We handle personal data in line with applicable data protection laws, including the EU General Data Protection Regulation (GDPR) and the UK GDPR where they apply to you.

Please read this Privacy Policy carefully. If you do not agree with it, please do not use our website or services.

2. Data Controller Information

Attention Keeper LLC, a Delaware limited liability company, is the controller of the personal data described in this Privacy Policy, including your platform login and account data, except for the data we process on behalf of travel advisors described in section 3. If you have questions about this Privacy Policy or want to exercise your rights, contact us at:

Email: privacy@attentionkeeper.com
Address: 9 East Loockerman St, Dover, DE 19901, United States

3. Data We Process for Travel Advisors

Travel advisors and agencies that use Attention Keeper (our "customers") store information about their own clients, travellers, leads, suppliers and staff in our platform, such as contact details, travel documents, trips and bookings, quotes, invoices and payments, availability and rates, messages, call recordings and documents. For that information, the customer is the controller and we act as their processor. We process it only to provide our services and on the customer's instructions, as set out in our Data Processing Agreement. Each customer is responsible for giving its clients and suppliers its own privacy notice.

If you are a client or supplier of a travel advisor who uses Attention Keeper, the advisor is the business you have a relationship with. Questions about your bookings, payments, documents or the details the advisor holds about you, and requests to access, correct or delete them, should go to that advisor first. If you contact us instead, we will pass your request to them without delay and help them respond.

There is one exception: your platform login (your login email, hashed password, two-step sign-in settings, sessions, sign-in and security logs, and the list of advisors your login is linked to) is our responsibility as controller, because it works across every advisor you deal with. Questions about your login can come to us directly. Our Data Processing Agreement, published at attentionkeeper.com/dpa, describes these commitments in full.

4. Client and Supplier Portals: One Login, Several Advisors

Travel advisors can invite their clients to a client portal (trips, documents, quotes, invoices, payments, e-signatures and messages) and their suppliers, such as hotels, transport companies, guides and venues, to a supplier portal (bookings, availability, rates, inventory, documents, payment requests, payouts and messages). You can only use a portal after an advisor invites you.

You may work with more than one advisor on Attention Keeper, for example a hotel that supplies several agencies, or a traveller who books with two advisors. When a second advisor invites you, you are asked whether to add that advisor to your existing login or to create a separate login with a different email address. Nothing is linked unless you choose it.

Advisors are walled off from each other. Each advisor sees only what you share with that advisor. Advisors are never told that your email address is already registered or that you work with other advisors. No profile details, documents, messages, payment methods or payout accounts move from one advisor to another.

We use the fact that one login is linked to several advisors only to let you sign in once, switch between advisors, keep your account secure, and detect and prevent fraud and abuse. We never use it for marketing, advertising, analytics, profiling or ranking, we never sell or share it, and we never tell one advisor about another.

Each time you link an advisor we record who linked it, when, and which advisor, so that your choice can be shown later. You can remove any advisor from your login at any time without affecting the others. If you delete your account, every link is removed (see section 12).

5. Collection of Your Information

The personal data we collect depends on how you interact with us:

Information You Give Us

We collect the information you provide directly, including:

• Account and contact details: your name, email address, phone number, company name, job title and billing address when you start a trial, subscribe or contact us
• Login details: your email address, a securely hashed password, two-step sign-in settings, session tokens, sign-in history and security events such as failed sign-ins, lockouts and password resets, and the list of advisors your login is linked to
• Inquiries and demo requests: messages you send through our contact form or live chat, and the name and email address you give when you register for a demo
• Newsletter and offers: your email address when you subscribe to our newsletter, download a resource or claim an offer
• Job applications: your name, email address, phone number, CV or résumé, and anything else you choose to include when you apply through our Careers page
• Quiz and poll answers: your responses to quizzes and polls on our blog, and any quiz results you choose to share
• Testimonials: your feedback and, if you agree to its publication, the name and details you choose to show with it
• Supplier business details, if you use a supplier portal: company or trading name, contact people, address, legal name and tax ID, rates, availability and inventory, and a reference to your payout account (such as the last four digits and the payment provider's account id, never your full bank details)

Sensitive Information in Travel Records

Travel advisors may store sensitive information about their clients, travellers, suppliers or staff in our platform, including:

• Passport, visa, national ID and driver's licence numbers and images, dates of birth and nationality
• Health-related needs, such as dietary, medical, mobility or accessibility requirements
• Details of children travelling with their families
• Payroll, bank and tax identification details of the advisor's staff, stored through our HR module

We process this information only as a processor for the advisor (see section 3), limit access to people who need it, and use it only to provide the features the advisor uses. The advisor is responsible for having a lawful basis to store it, including explicit consent where the law requires it.

Sensitive identity, travel, health and payment details, such as passport and ID numbers, dates of birth, booking references and medical or dietary notes, are encrypted in our database with AES-256, so our database, backups and logs hold them only in encrypted form. People with permission see them normally in the app.

Uploaded identity and travel documents are encrypted before they are stored. All data is also protected by access permissions, on-screen privacy masking and an audit log.

Information Collected Automatically

When you visit our website, our servers and service providers automatically receive technical information such as your IP address, browser type, operating system, referring page, the pages you view and the time of your visit. Our homepage also sends your IP address to ipapi.co to show a location-based greeting; we do not store the result.

We store a one-way hash of your IP address, rather than the address itself, to count blog readers (only if you accept analytics cookies), to prevent duplicate poll, quiz and promotion entries, and to protect our contact form from spam. Our servers compute the hash from the connection your browser makes when you take part or send a form, and do not store the address itself. A hash is pseudonymous rather than anonymous, so we treat it as personal data. Separately, to show your approximate region on the homepage and to suggest a language, your browser asks ipapi.co for an approximate location based on your IP address; only that location, without the IP address, is kept in session storage until you close the tab.

Payment Information

When you buy a subscription, AI credits or Services from us, your payment is handled by Stripe. We receive limited details from Stripe, such as the card brand, last four digits, expiry date and billing address, but never your full card number. When a client pays a travel advisor, or an advisor pays a supplier, the payment runs through that advisor's own Stripe or PayPal account. Those providers collect card and bank details under their own terms; we store only the amount, status and a payment or payout reference, and we never hold the funds.

Information From Connected Services

If a travel advisor connects other accounts to our platform, such as Duffel for flight bookings, their own Stripe or PayPal account, their own email server, or messaging and social media accounts, we receive the information needed to run those integrations, as the advisor authorizes. For example, we receive booking confirmations and changes from airlines through Duffel, payment and payout status from payment providers, and the messages and comments you send an advisor through connected channels.

6. Use of Your Information

We process your personal data for the following purposes, based on these legal grounds:

• Contractual Necessity: To provide our platform and any Services you order, manage your account, process payments and give you support.
• Legitimate Interests: To secure and improve our website and services, prevent fraud and spam, respond to inquiries, evaluate job applications and send business marketing where the law allows. We always weigh these interests against your rights.
• Legal Obligation: To comply with legal requirements, such as maintaining business records for tax purposes or responding to court orders.
• Consent: To use optional cookies and analytics, send marketing emails where consent is required, and publish testimonials. You can withdraw your consent at any time.

Specifically, we use personal data to:

• Create and manage your account and subscription.
• Process payments, refunds and invoices.
• Provide platform features, including the client and supplier portals and the integrations an advisor connects.
• Respond to inquiries, demo requests and support requests, including through live chat.
• Send service messages, and newsletters or offers you have asked for.
• Evaluate job applications.
• Monitor website performance and fix errors.
• Understand how visitors use our website, with your consent.
• Prevent fraud, spam and abuse, and enforce our Terms of Service.
• Let you link several advisors to one login at your request, and keep the record of that choice.

7. Artificial Intelligence Features

Our platform includes AI features, such as drafting follow-up messages and social posts, transcribing and summarizing calls, suggesting trips, translating text and creating marketing content. To provide them, we send the relevant text to AI and translation providers that act as our sub-processors and are listed in our Data Processing Agreement.

Before any text is sent, we remove names, email addresses, phone numbers, postal addresses, document numbers, payment details, dates of birth and tax or national identifiers, and refer to clients only by an internal id. The AI model has no access to our tools or database and returns plain text only. We do not use customer data to train AI models, and we use these providers under terms that do not permit them to train their models on it.

AI output can be inaccurate. Travel advisors review AI suggestions and decide how to use them, and they may choose to let the platform send certain messages automatically. We do not make decisions that have legal or similarly significant effects on anyone based solely on automated processing.

8. Disclosure of Your Information

We do not sell personal data, and we do not share it for targeted advertising. We share personal data only in the following situations:

Service Providers

We use service providers that process personal data on our behalf, under contracts that require them to protect it and to use it only to provide their services to us:

• Cloud infrastructure provider: database, server functions, scheduled jobs and file storage
• Payment processor: our own subscription payments and billing
• AI and translation providers: AI features, with identity data removed before sending
• Communications provider: text messages, WhatsApp, social media messaging and posting, Google Business Profile and phone calls, including call recording and transcription when an advisor turns them on
• Email delivery provider: sending and receiving email, including emails advisors send through our mail domain
• Live chat provider: live chat, if you accept functional cookies
• Analytics provider: website analytics, if you accept analytics cookies
• Error monitoring provider: error monitoring for our website
• IP lookup services: IP address lookups for our homepage greeting, duplicate checks and spam protection
• Video conferencing provider: video sessions for product demos
• Travel booking provider: flight search and booking when an advisor uses it. An advisor payment card saved for flight bookings is entered directly into the booking provider's secure card form and never reaches our servers
• Vetted contractors: delivery of Done-For-You Services, under confidentiality and data protection obligations
• Hosting and content delivery providers: hosting, delivering and protecting our website and the platform's uploaded files, images and videos, DNS, and serving advisor and portal domains
• Weather data provider: weather forecasts for the destinations and dates of a client's trip; no personal data is sent
• Bot protection provider: protects sign-in, sign-up, password reset, invite and public lead forms
• Browser push services, chosen by your browser: deliver in-app notifications to devices where you turned push on; the notification content is encrypted end to end

Services a travel advisor connects with its own account, such as its own Stripe or PayPal account for client payments and supplier payouts, its own Duffel account for flight bookings, its own email server, or its own social media accounts, are the advisor's own providers, not ours. We pass data to them only on the advisor's instruction, and they handle it under their own terms and privacy policies. We never hold client payments or supplier payouts.

By Law or to Protect Rights

If we believe the release of information about you is necessary to respond to legal process, to investigate or remedy potential violations of our policies, or to protect the rights, property, and safety of others, we may share your information as permitted or required by any applicable law, rule, or regulation.

Business Transfers

If we are involved in a merger, acquisition, financing or sale of assets, personal data may be transferred as part of that transaction. We will notify you before your personal data becomes subject to a different privacy policy.

9. Text Messages and Calls

If you give us your mobile number and agree to receive text messages from Attention Keeper, such as login codes, account alerts and updates, message frequency varies and message and data rates may apply. Reply STOP at any time to opt out, or HELP for help.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the categories of recipients described in this Privacy Policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Travel advisors can also text and call their own clients through our platform. The advisor is responsible for getting consent for those messages and, if they record or transcribe calls, for informing everyone on the call and getting any consent the law requires. Recordings, transcripts and messages are handled as the advisor's data under section 3.

10. International Data Transfers

Your personal data may be transferred to, and processed in, countries other than the country in which you are resident. These countries may have data protection laws that are different from the laws of your country.

Our servers are located in the United States (US East, N. Virginia). Our service providers are located in or process data in the United States, the European Union, the United Kingdom and Australia.

When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we rely on the Standard Contractual Clauses approved by the European Commission, together with the UK Addendum and Swiss adjustments where required, or on another lawful transfer mechanism.

11. Data Retention

We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances, we may anonymize your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

Specific retention periods:

• Account and subscription data: for as long as your account is active. When you ask us to delete your account, deletion is scheduled 30 days ahead and you can cancel it during that window; after that it is carried out, unless the law requires us to keep something
• Data travel advisors store in our platform, including passport and ID details: for as long as the advisor keeps it. When an advisor deletes its workspace, the workspace is held pending deletion for 30 days (access ends, sending and automations stop, and the owner can restore it), then it is deleted, including files and profiles held at our sub-processors
• Billing, invoice, payment and payout records: for as long as tax and accounting laws require, typically up to seven years, even after a person's other data has been erased
• Job applications: 12 months after you apply, unless you are hired or agree that we may keep your application longer
• Contact messages and demo requests: 24 months, unless they become part of a customer relationship
• Newsletter subscriptions: until you unsubscribe
• IP address hashes: for as long as needed for the related poll, quiz, promotion or readership statistics
• Client and supplier portal accounts: deletion is scheduled 30 days after you ask and shown to the advisor, who may cancel it in that window where it has grounds to. At the date, your access to that advisor ends and the advisor's record of you is erased or anonymized; your login is erased too if it serves no other advisor
• Records of which advisors you linked to your login: while the link exists, then only for as long as needed to show the choice you made and to deal with legal claims
• Security, audit and activity logs: archived after 90 days and deleted after one year; search history is deleted after 90 days; read in-app notifications after 30 days and unread ones after 90 days
• Supplier tax IDs: a company's tax ID may be kept as a business record after the personal account is deleted; a sole trader's is erased

Deleted data may remain in encrypted backups for a limited period, until those backups are overwritten in the normal cycle.

12. Your Rights

Depending on your location, you may have the following rights:

• Right to access: You have the right to request copies of your personal data.
• Right to rectification: You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.
• Right to erasure: You have the right to request that we erase your personal data, under certain conditions.
• Right to restrict processing: You have the right to request that we restrict the processing of your personal data, under certain conditions.
• Right to object to processing: You have the right to object to our processing of your personal data, under certain conditions.
• Right to data portability: You have the right to request that we transfer the data that we have collected to another organization, or directly to you, under certain conditions.
• Right to withdraw consent: If we rely on your consent to process your personal data, you have the right to withdraw that consent at any time.

You can do most of this yourself in the app:

• Download your data. Clients can download their data from the client portal's Privacy tab, suppliers from the supplier portal settings, and advisor staff from their account settings. Downloads are readable files.
• Delete your account. Deletion is scheduled 30 days later and you can cancel it in that time (for a client portal account, the advisor can too). Records the law requires the advisor to keep, such as invoices and payments, stay with the advisor.
• Remove an advisor from your login. You can unlink any one advisor at any time; the others stay as they are.
• Correct your details. Clients and suppliers can update their own details in the portal; changes to a supplier's legal name, tax ID or payout account take effect after the advisor approves them.

For anything else, email privacy@attentionkeeper.com. For data a travel advisor controls, send your request to the advisor; if you send it to us we will pass it on. We may need to verify your identity first. We will respond within one month, or within the time the law that applies to you requires, and we will not treat you differently for exercising your rights. If we decline a request, we will explain why, and you can ask us to reconsider.

If you are in the European Economic Area, the United Kingdom or Switzerland, you also have the right to lodge a complaint with your local data protection authority. We would appreciate the chance to address your concerns first, so please contact us.

13. Children's Privacy

Our website, platform and portals are intended for adults and businesses. You must be at least 18 years old to create an account or hold a portal login, and we do not knowingly collect personal data from children through our website. If you believe a child has given us personal data, please contact us and we will delete it.

Travel advisors may store details of children travelling with their families in our platform. We process that information only as a processor for the advisor, who is responsible for obtaining any parental consent the law requires.

14. Security of Your Information

We use administrative, technical, and physical security measures to help protect your personal information. While we have taken reasonable steps to secure the personal information you provide to us, please be aware that despite our efforts, no security measures are perfect or impenetrable, and no method of data transmission can be guaranteed against any interception or other type of misuse.

Specific measures include:

• Encryption in transit everywhere (HTTPS), and AES-256 encryption at rest for sensitive identity, travel, health and payment details (section 5)
• Sensitive uploaded files are encrypted before storage; other files sit in private storage and are shared through short-lived signed links
• Every request is checked against the advisor's workspace and the user's role; advisors are strictly separated, and portal users see only what the selected advisor shares with them
• Two-step sign-in with an authenticator app, which an advisor can require for its staff and suppliers; session time-outs, failed-attempt lockouts and bot protection on sign-in
• Audit logs of sensitive actions and privacy masking of sensitive fields on screen
• Changes to a supplier's bank account, legal name or tax ID require approval by the advisor's owner or admin
• Strict limits on what can reach AI providers (section 7)
• Payment card data is handled exclusively by PCI DSS-compliant providers (Stripe, PayPal and the booking provider's card form). Attention Keeper never stores or directly processes card numbers.

15. Data Breach Notification

In the event of a data breach that compromises your personal information, we will promptly notify you and the relevant authorities as required by law. This notification will include:

• The nature of the breach
• The types of data affected
• Steps we are taking to address the breach
• Recommendations for what you can do to protect yourself
• Contact information for questions

Under the GDPR, we will notify the relevant supervisory authority within 72 hours of becoming aware of a breach where feasible, and we will notify affected individuals without undue delay when the breach is likely to result in a high risk to their rights and freedoms. If a breach affects data we process for a travel advisor, we will notify that advisor within 48 hours so they can meet their own obligations. If a breach affects only platform login data, we handle the notices ourselves and tell the advisors concerned.

16. Cookies and Similar Technologies

Our website uses cookies and similar technologies, such as your browser's local storage. Cookies are small text files stored on your device that help a website remember information about your visit.

We use the following types:

• Essential: needed for the website to work, for example to remember your cookie choices, language and theme, and to keep you signed in
• Functional: live chat provided by Crisp
• Analytics: Microsoft Clarity, which helps us understand how visitors use our website
• We do not use advertising or targeting cookies.

Functional and analytics cookies load only after you accept them, and you can change your choices at any time with the Manage Cookies button at the bottom left of every page. If your browser sends a Global Privacy Control signal, we treat it as a refusal of analytics cookies. Because there is no common standard for Do Not Track signals, our website does not respond to them.

For a full list of the cookies we use and how long they last, see our Cookies Policy.

17. Information About Other People

If you give us personal information about someone else, for example when you invite a colleague to your account, you confirm that you are allowed to share it and that you have told them about this Privacy Policy.

Information that travel advisors store about their own clients, travellers and suppliers is handled as described in section 3.

18. Changes to this Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date at the top.

For significant changes that materially affect your rights or how we use your data, we will provide a more prominent notice (such as email notification). We encourage you to review this Privacy Policy periodically for any changes.

If you continue to use our website or services after an update takes effect, the updated Privacy Policy applies to you.

19. Contact Us

If you have questions or comments about this Privacy Policy, please contact us at:

Email: privacy@attentionkeeper.com