Privacy Policy

VAYULOR ("we", "the Platform") respects your privacy and is committed to protecting your personal data. This policy explains what we collect, how we use it, with whom we share it and your rights. It is drafted in line with the Israeli Privacy Protection Law, 1981 and its regulations, and aims to follow the principles of the EU GDPR where applicable.

1. Data controller & contact

The data controller is VAYULOR. For any privacy question, request or rights exercise, contact our Privacy Officer at privacy@vayulor.com.

2. Information we collect

Account & registration: name, email, phone, hashed password, language/currency preferences, profile photo (if provided, including via Google/Apple sign-in).
Booking & travel: passenger details, dates, destinations, passport/ID details where required for a booking, special requests and travel documents.
Payment: we use external payment processors; full card details are handled by them and not stored by us. We may retain references, last four digits and transaction status.
Usage & technical: IP address, device/browser type, OS, pages viewed, platform actions, device identifiers and cookie data.
Communications & content: agent chat messages, support requests, reviews and content you upload.
AI conversations: prompts and responses with "Maya" and the AI Vacation Builder, to provide, improve and quality-control the service.

3. How we use information & legal basis

Service delivery (contract): account management, executing and intermediating bookings, communication with agents and suppliers.
Legitimate interest: improving the platform, security, fraud prevention, operational analytics and content personalization.
Consent: marketing, optional cookies and personalization — subject to your consent and right to withdraw.
Legal obligation: compliance with law, tax, accounting and authority requests.

4. Sharing with third parties

Because VAYULOR acts as an intermediary, completing a booking requires transferring relevant information to the Supplier (airline, hotel, insurer, agent, etc.) to provide the service. We may also share data with:

Payment processors, to process payment.
Infrastructure and technology providers (cloud hosting, analytics, email, support, AI providers) acting on our behalf under confidentiality and security commitments.
Competent authorities, as required by law or order, or to protect VAYULOR's rights, user safety and prevent fraud.
In a merger, acquisition or transfer of business — subject to the principles of this policy.

We do not sell personal data to third parties.

5. International transfers

Some Suppliers and service providers operate outside Israel. When booking or using infrastructure services, data may be transferred and stored in other countries. We take reasonable measures to ensure an adequate level of protection subject to applicable law.

6. Data retention

We retain personal data as long as needed for the purposes collected, to meet legal obligations (including tax and accounting), resolve disputes and enforce agreements. Afterwards, data is deleted or anonymized. A deleted account is kept temporarily (≈30 days) for recovery and fraud prevention, then deleted subject to law.

7. Data security

We apply reasonable technical and organizational safeguards, including encryption in transit, access control and least-privilege. No system is fully secure, however, and we cannot guarantee absolute security. We will notify of a material security incident subject to law.

8. Your rights

Access: review your personal data held by us.
Rectification: request correction of incorrect or outdated data.
Erasure: request deletion, subject to legal retention duties.
Objection & restriction: object to and restrict certain processing, and withdraw marketing consent.
Portability: receive a copy in a structured format, where applicable.

To exercise rights, contact privacy@vayulor.com. We will respond within a reasonable time, subject to law.

9. Marketing

We send marketing only with your consent or as permitted by law. Every message includes an unsubscribe option, and you can opt out anytime in account settings.

10. Minors

The Platform is not intended for minors under 18, and we do not knowingly collect their data. If we learn of such data, we will act to delete it.

11. AI & automated processing

Our AI tools process your input to suggest itineraries and recommendations. We do not make decisions with significant legal effect on you solely automatically; any final booking is subject to your confirmation.

12. Cookies

We use cookies and similar technologies. See our Cookie Policy for details and preference management.

13. Changes

We may update this policy from time to time. Material changes will be posted and the "Last updated" date revised.

14. Contact

Privacy Officer: privacy@vayulor.com.