Privacy Policy

Information we handle

We process the email address used for one-time-code authentication, traveler profile details such as name, optional phone and preferred language, and agency-provided trip information. A trip can contain bookings, transportation, stays, activities, contacts, documents and media. We may also process support messages and security records needed to operate the service.

Why we use it

We use information to authenticate travelers, confirm agency-authorized access, deliver and synchronize itineraries, provide offline access, respond to support and data requests, and protect the service. The traveler mobile app does not use advertising or cross-app tracking.

Processors and international handling

Vercel hosts the production traveler web application and backend-for-frontend at https://go.everhightravel.com. Supabase provides authentication, database and managed file storage. Those providers process information on our behalf and may do so outside your country under their applicable contractual safeguards.

Authorized agency staff manage agency itinerary records. OpenAI is used only in agency-side authoring and conversion workflows when an authorized agency user invokes them; it is not called by the native traveler app. No analytics or crash-reporting SDK is currently included in the traveler mobile app.

Offline data and documents

The mobile app can store an authorized itinerary snapshot in a SQLCipher-encrypted local database, with key material protected by the operating system secure store. Entitlement access expires unless revalidated, and logout removes protected local data. This is device encryption at rest, not end-to-end encryption.

Document metadata may appear in an itinerary. Private document bytes are fetched through authorized server access and are not included in the current mobile offline snapshot cache.

Sharing, retention and deletion

We disclose data to the participating agency, authorized itinerary participants where the product permits, and providers needed to run the service. A specific retention schedule has not yet been established; agency and service records may be retained for operational, contractual, security or legal needs.

Delete an account in Profile or follow /account-deletion. This removes authentication and trip access, erases private traveler content currently stored by the service, and de-identifies the traveler profile and relationship fields. It does not erase another traveler, shared agency itineraries, shared documents, or agency records. Contact the participating agency for access or correction requests.

Security, children and contact

We use one-time-code authentication, server authorization, encrypted local storage and HTTPS. No system is completely secure. This agency-provided itinerary service is not directed to children for independent use.

For privacy questions, follow /account-deletion, contact the agency that provided the itinerary, or email Everhigh IT Services at support@everhighit.com. Material changes will appear at this URL with a revised date.