This Privacy Policy explains how personal data is collected, used and protected when you use the iTrip.az website (itrip.az) and the iTrip mobile app.
iTrip.az is an online marketplace where travel agencies publish their tours and travellers send enquiries to those agencies.
1. Who we are
The website and the mobile app are operated by iTrip.az. For any privacy question, contact [email protected].
2. Data we collect
- Travellers (no account needed): when you send a tour enquiry or a contact message — your name, e-mail, phone (optional), number of travellers and your message, plus the tour and agency concerned.
- Agencies (account holders): login e-mail and password (stored only as a hash), agency profile (name, contact details, address, logo, social links), tours and photos, enquiries received, featuring and advertising payments, partner applications.
- Mobile app (agency accounts): device session (a rotating token stored as a hash), push notification token, device platform and name, app version, notification language.
- Technical data: IP address and browser/device information in server logs; a session cookie for signed-in users; anonymous usage statistics through Google Analytics (pages viewed, approximate location, device type).
- Payments: card payments are processed by PayTR. Your card details are never sent to or stored by us; we keep only the payment reference, amount and status.
3. How we use data
- To deliver your enquiry to the travel agency you chose and to answer your contact messages;
- To run agency accounts and publish their tours and profiles;
- To notify agencies about new enquiries and moderation (e-mail, push, WhatsApp);
- To process featuring and advertising payments;
- To keep the service secure and prevent abuse;
- To produce aggregated statistics that help us improve the service.
4. Legal bases
We process data to fulfil your request or our contract with the agency, on our legitimate interests (security, statistics), on your consent where required (analytics cookies), and to meet legal obligations (accounting).
5. Sharing
- The travel agency you contact — the details of your enquiry;
- Service providers: hosting, e-mail delivery, PayTR (payments), Meta WhatsApp Business (agency notifications), Expo (push notifications), Google Analytics;
- Competent authorities where required by law.
We do not sell personal data.
6. Retention
- Enquiries and messages are kept as long as needed to handle them and while the agency account exists;
- Account data is kept until the account is deleted;
- Payment records are kept for the period required by tax and accounting law;
- Server logs are kept for a limited period.
7. Your rights
You have the right to access, correct or delete your data, to object to processing and to withdraw your consent. To do so, write to [email protected]. How to delete an account and its data is explained on the "Account deletion" page.
8. Cookies
We use a necessary session cookie for signed-in users and Google Analytics cookies. You can block cookies in your browser settings; signing in to the panel may then not work.
9. Security
All connections are encrypted with HTTPS, passwords and session tokens are stored as hashes, and access to data is limited to authorised people.
10. Children
The service is not intended for children under 16 and we do not knowingly collect their data.
11. Changes
We may update this policy; changes are published on this page with the date of the update.