Privacy Policy

The controller of the personal data of user accounts is:

• Entity — [RAZÓN SOCIAL / TITULAR]
• Tax ID (CUIT) — [CUIT]
• Address — [DOMICILIO LEGAL]
• Privacy contact — [EMAIL DE PRIVACIDAD]

Hereinafter, “Tripwise”, “we” or “the controller”.

Tripwise acts in two distinct capacities depending on the type of data:

• As controller — for the data of user accounts (the agency's employees or owners who register and use the platform) and the agency's own data. The purposes, legal bases and rights described in this Policy fully apply to that data.
• As processor — for the data of passengers and clients that each agency loads to manage its bookings. In that case the agency is the controller of that data, and Tripwise processes it on the agency's behalf and per its instructions, under the Data Processing Agreement included in the Terms and Conditions.

User account data (agency employees/owners):

• First and last name, identity document, email address and phone number.
• Password, stored encrypted (hashed) by the authentication service; Tripwise never accesses the plaintext password.
• Profile photo, if the user chooses to upload one.
• Device push-notification token and platform (web/Android/iOS), to deliver alerts.
• Technical and error-diagnostics data (user identifier, email, role, error traces and navigation events) used for service stability and security.

Agency (company) data:

• Legal name, Tax ID (CUIT), tax address, VAT condition, gross-income registration number and activity start date.
• Branches and their associated information.

Passenger and client data (loaded by the agency, processed by Tripwise as processor):

• First and last name, date of birth, email address, phone number, address and country.
• Client tax data where applicable: Tax ID (CUIT) and VAT condition.
• Document type and number (for example, national ID or passport) and its expiration date.
• Attachments uploaded by the agency (for example, images or scans of documents, visas or certificates).
• Booking data: flights, accommodations, transfers, insurance, destinations and travel dates.
• Payment and billing data: amounts, currency, exchange rate, issued invoices and the tax data required for electronic invoicing.

Tripwise does not collect or store full credit or debit card details: the subscription charge is processed through an external payment provider (see Processors and third parties).

• To provide and operate the platform: managing bookings, passengers, operators, finances and commissions.
• To issue electronic tax invoices through the tax authority.
• To handle the sign-up, charging and administration of the service subscription.
• To provide support, send operational notices and answer enquiries.
• To ensure security, prevent fraud and abuse, and diagnose and fix errors.
• To comply with legal, tax and accounting obligations.

The processing of user account data is based on the informed consent given at registration (Section 5 of Ley 25.326) and on the need to perform the service's contractual relationship.

Certain processing is carried out without additional consent where a law allows or requires it, such as issuing invoices and retaining tax and accounting information.

For passenger data, the legal basis and obtaining the consent of the data subjects is the responsibility of the agency, in its capacity as controller.

To provide the service we rely on providers that process data on Tripwise's behalf, or to whom the law requires us to transfer certain information. We do not sell personal data. The main ones are:

• Supabase — infrastructure provider that hosts the database, authentication and file storage. The platform's data resides on its infrastructure.
• Mercado Pago — processes the service subscription charge. It receives the data needed for recurring billing (payer and subscription identifiers, amounts and currency).
• ARCA / AFIP — Argentina's tax authority. Transferring data to issue electronic invoices (CUIT, amounts and invoice data) is required by law.
• Resend — transactional email provider (invitations, invoices and notices). It receives the recipient's email address and the message content.
• Sentry — error-monitoring service. It receives user identifiers and technical traces to diagnose failures.
• Firebase Cloud Messaging (Google) — push-notification service. It receives the device token to deliver alerts.

We may also share data when required by a competent authority within the law, or to defend rights in administrative or judicial proceedings.

Some of the providers listed above may store or process data outside Argentina. In those cases we seek to ensure adequate protection safeguards, in line with Section 12 of Ley 25.326. By accepting this Policy you consent to such transfers to the extent necessary to provide the service.

We keep data while the account remains active and for as long as necessary to fulfil the purposes described.

Tax information and invoices are retained for the periods required by tax and accounting regulations, even after the account is closed.

For security and audit purposes we keep historical change logs for certain tables. Once the legal periods elapse, data is deleted or anonymized.

We apply reasonable technical and organizational measures to protect data, including:

• Isolation of each agency's information through database-level access rules (multi-tenant).
• Encryption of communications in transit.
• Password storage using hashing functions.
• Safeguarding of sensitive credentials (for example, invoicing certificates) in an encrypted secrets store.
• Access control by roles and per-user permissions.

No system is completely infallible; we work continuously to maintain and improve these measures.

You may exercise the rights of access, rectification, updating and deletion of your personal data (Sections 14 to 16 of Ley 25.326) by writing to [EMAIL DE PRIVACIDAD]. The right of access may be exercised free of charge at intervals of no less than six months, unless a legitimate interest applies, and will be answered within the legal timeframes.

Argentina's Agency for Access to Public Information (AAIP), the supervisory authority for Ley 25.326, is empowered to handle complaints and claims regarding non-compliance with personal data protection rules.

Where Tripwise acts as a processor, passengers and clients should direct the exercise of their rights to the agency that loaded their data, which is the controller. If we receive a request from a passenger, we will forward it to the relevant agency or assist according to its instructions.

The service is aimed at travel agencies and their professional users; it is not intended to be used by minors as account holders. Any loading of minors' passenger data is done under the agency's responsibility, which must hold the appropriate authorization.

We may update this Policy to reflect changes in the service or in applicable regulations. We will publish the current version on this page, indicating the last-updated date. Material changes may be notified through the platform.

For questions about this Policy or the processing of your personal data, write to us at [EMAIL DE PRIVACIDAD].