Data Protection Agreement
Last updated: July 2026
This document is a draft pending review by legal counsel. It should not be relied upon as final legal advice. Please consult qualified legal counsel before relying on these terms.
1. Scope and Roles
This Data Processing Addendum ("DPA") forms part of the Travistant Terms of Service and reflects the parties' agreement with respect to the processing of personal data. Travistant acts as a data controller for personal data collected through the platform (e.g., account information, booking records). Companions and travelers act as independent data controllers with respect to their own communications and interactions facilitated by the platform.
2. Data We Process
We process the following categories of personal data: account information (name, email, photo), identity verification documents (government ID, certifications), booking and transaction records, in-app messages, live location data during active bookings, device and session information, and cookie consent preferences. We do not process special category data beyond what users voluntarily submit for identity verification.
3. Legal Basis for Processing
We process personal data on the following legal bases: contract performance (providing the companion-matching service), legal obligation (identity verification, anti-fraud), consent (location sharing, optional cookies, marketing), and legitimate interests (platform security, service improvement). Users may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.
4. Data Retention
We retain personal data only as long as necessary for the purposes described: active account data is retained while the account is active; booking records are retained for 2 years after completion for dispute resolution and legal compliance, then automatically deleted; identity verification documents are retained while the account is active and deleted immediately upon account deletion; location data is cleared within 24 hours after a booking ends; all associated personal data is removed immediately upon account deletion, except where retention is required by law.
5. Sub-Processors
We use the following sub-processors: Stripe (payment processing), cloud hosting providers (infrastructure), and background check providers (identity verification). A current list of sub-processors is available upon request. We enter into written agreements with all sub-processors requiring equivalent data protection standards.
6. International Data Transfers
As a global platform, personal data may be transferred across borders. We implement appropriate safeguards for international transfers, including Standard Contractual Clauses (SCCs) where required. Users are informed of potential cross-border transfers when using the platform.
7. Your Rights
Depending on your jurisdiction, you may have the right to access, rectify, erase, restrict, or object to the processing of your personal data, as well as the right to data portability. To exercise these rights, use the Privacy & Trust Dashboard or submit a privacy request. We respond to verified requests within 30 days.