Privacy Policy
Your trust is our priority. We believe in complete transparency about how your agency's data is managed, secured, and accessed.
This Privacy Policy describes how TravelOnClick collects, uses, protects, and handles your data when you use our platform. By using TravelOnClick, you agree to the collection and use of information in accordance with this policy.
1. Data Access & Management
To provide our services, manage system performance, and perform necessary technical maintenance, TravelOnClick administrators have direct, raw access to the centralized database. This database houses the data of all registered agencies on the platform.
Our Commitment: This access is strictly limited to authorized personnel for technical and administrative purposes only. We guarantee that your agency's data, customer details, financial records, and contracts will never be exposed, leaked, or sold to third parties. We treat your raw data with the highest level of strict confidentiality.
2. Account Security & Passwords
The security of your account is paramount. When you create an account or set a password, your password is layered and secured using modern, industry-standard cryptographic hashing algorithms (such as bcrypt) before being saved to our databases.
- Zero-Knowledge Passwords: TravelOnClick staff cannot view, reverse-engineer, or recover your password.
- No Unauthorized Login: Because we cannot see your password, we do not have the ability to log into your account using your credentials under any circumstances.
3. Information Collection
We collect information that you provide directly to us when you register for an account, modify your profile, or interact with the platform's features (such as generating contracts or recording transactions). This includes your name, agency details, contact information, and billing details.
4. Zero Session Replay & Wiretap Protection
TravelOnClick strictly values your privacy and operational confidentiality. We do not use session replay, keystroke recording, or screen recording software (such as FullStory, Hotjar, LogRocket, PostHog Session Recording, or Microsoft Clarity).
- No Keystroke Tracking: We never record your typing, password entries, customer data, or client correspondence in real-time.
- Input Masking: Sensitive form fields (passwords, payment inputs, contact forms) are built with defensive DOM masking attributes to protect data from any client-side interception.
- Compliance: Our architecture complies with state wiretapping statutes (including the California Invasion of Privacy Act - CIPA) and GDPR Article 5 principles of data minimization and purpose limitation.
5. Cookies & Tracking Consent
We only use strictly necessary cookies required for user authentication (NextAuth session tokens) and security rate limiting. We do not use third-party tracking or advertising cookies. Any non-essential analytics require your prior affirmative consent.
6. Updates to this Policy
We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes.