Privacy Policy

What we collect

• Your email address, account identifier and authentication information when you log in or sign up. We send a verification code to your email address.
• The messages you send, generated replies, saved experiences and itinerary details. These may include dates, group size, children’s ages, interests, budget and the area where you plan to stay, if you choose to share them.
• Technical information needed to deliver and protect the service, such as IP addresses, request timing, browser information, errors and usage totals.

Please avoid names of children, identity documents, payment details, passwords, medical records and other sensitive information. General trip requirements are usually enough.

Why we use it

We process your account and chat information to provide the service you request, generate answers, save your plans and let you resume them. We use technical information for legitimate interests in security, abuse prevention, reliability and cost management, and may retain information where required by law.

We do not sell your chats, enrol you in marketing when you sign in, or automatically turn a chat into a booking enquiry. If a future optional feature needs consent, we will ask separately. Agreeing to the Terms is not blanket consent to unrelated uses of your data.

How AI uses your chats

To answer a message, we send relevant recent conversation text, your current trip details and public reference information to OpenAI through its API. Reference searches may also process part of your conversation to find useful public information. Your email address is not added to AI requests by the app; information you type into chat can be included.

When you reopen a saved chat, its recent messages and trip details provide context for your next answer. Other saved chats are not automatically read to build a personal profile.

The application does not run a model-training process on your chats. OpenAI’s published API policy says API inputs and outputs are not used to train its models by default, unless the API organisation explicitly opts in. Requests from this app disable stored model responses. This does not remove OpenAI’s separate security and abuse-monitoring retention, which normally lasts up to 30 days and can be longer for legal or safety reasons. Read OpenAI’s API data controls.

Authorised personnel may access information when necessary to help with a support request, investigate a security issue or comply with the law. Chat history is private to your account in the app; it is not published as a public conversation. Please check important AI answers before booking.

Where your chats are saved

Without an account, chats you choose to save are kept in your browser’s local storage. Sending a message still requires server and AI processing even if you do not save it. Browser data remains until you delete it or clear site storage.

When logged in, chats are automatically saved in our account database. If you log in during a chat, the current chat is added to your account. Older browser-only chats are not automatically imported. Account chats are loaded into memory while you use the app and are cleared from the interface on logout.

We keep saved chats until you delete them or ask us to remove your Mauritius data. Deletion removes them from active chat history; existing infrastructure backups and security records may persist under the relevant providers’ retention arrangements or legal requirements. AI-provider records are governed separately by the controls linked above. Do not assume that deleting a chat instantly erases every backup or security log.

Service providers and international processing

We use Supabase for authentication and saved data, Vercel for hosting, OpenAI for AI processing, Resend for verification emails and Upstash for request limits. These providers receive the information needed for their function. Request limits use IP addresses and hashed email identifiers; verification emails contain your address and sign-in code. Map and image services receive ordinary network information when your browser loads their content.

Data may be processed outside Mauritius, including in locations used by these providers. Applicable data-protection requirements govern those transfers. You can contact us for information about the providers and safeguards relevant to your data. We do not claim that all processing takes place in Mauritius.

If you follow an external booking link, the booking site’s privacy policy applies. Your selected activity, date, time and party size may be included in the booking link to help you continue. Your full chat history is not attached to that link.

Cookies and browser storage

Essential session cookies keep you logged in. Local storage keeps browser-only saved trips and the active trip reference. Blocking these can prevent sign-in or saving. This chat interface does not require advertising cookies. Infrastructure providers may process technical logs for service delivery and security.

Your choices and rights

You can delete a saved chat using the delete control in the sidebar and download your chats from the account area. On a shared device, log out when finished. Clear the site’s browser storage to remove browser-only copies.

You may request access, correction, deletion or restriction of your personal data, and object to processing where applicable. You can withdraw consent for any processing based on consent without affecting earlier lawful processing. Write to info@andeor.travel; we may need to verify your identity. Tell us if your request concerns only Mauritius or other services as well.

If we need to keep information for a legal obligation or claim, we will explain the relevant restriction. You can complain to the Mauritius Data Protection Office or another competent authority available to you. The Office explains rights to correction, erasure and restriction.

Children and changes to this policy

Accounts are intended for adults aged 18 and over. A parent or responsible adult may provide limited trip details about children travelling with them. Contact us if a child has supplied personal information without appropriate permission.

We will update this page when processing changes and bring significant changes to your attention where required. The date at the top identifies the current version.