# TRIPDOCKET PRIVACY POLICY **Status:** ACTIVE **Effective Date:** 24 July 2026 **Privacy Policy Version:** 1.0 **Language:** English controlling version Lucky Byte Limited operates TripDocket and is responsible for the personal data described in this Privacy Policy. **Lucky Byte Limited** Company Number: 79234565 Registered Office: Flat A, 20/F, ZJ 300, 300 Lockhart Road, Wan Chai, Hong Kong Privacy Requests: support@tripdocket.co ## 1. Scope This Privacy Policy applies to TripDocket websites, authenticated accounts, document-upload workflows, paid audit orders, Decision Briefs, support communications, and related beta operations. It does not govern independent travel suppliers, Stripe, or other third parties acting under their own privacy policies. ## 2. Personal data we may collect Depending on use, TripDocket may collect: ### Account and identity information - name; - email address; - account and authentication identifiers; - organization or household association; - communication preferences. ### Travel-party information - traveler count; - adult and child age bands; - room or occupancy needs; - dietary, accessibility, allergy, or preference information voluntarily supplied; - travel dates and destination information. Do not submit health information or other sensitive information unless necessary and expressly requested. ### Submitted travel materials - quotations; - screenshots; - emails or supplier correspondence; - itinerary details; - room types; - prices; - fees; - cancellation terms; - transfer arrangements; - other content within submitted documents. Submitted materials may contain information about other travelers. The submitting adult must have authority to provide it. ### Payment and transaction information - order and case references; - amount and currency; - payment status; - Stripe identifiers; - refund and dispute status; - billing metadata provided by the payment processor. Lucky Byte does not receive or store complete payment-card numbers. ### Service-generated information - file inspection results; - extraction and normalization records; - rule-engine results; - Decision Briefs; - operational status; - manual-review records; - access and download events; - customer feedback. ### Technical and security information - IP address; - browser and device information; - timestamps; - session and authentication events; - diagnostic and security logs; - fraud-prevention signals. ### Support information - messages sent to support@tripdocket.co; - refund requests; - complaints; - troubleshooting information; - other correspondence. ## 3. Sources We collect information directly from you, from documents and materials you submit, automatically from your browser and use of the Service, from payment, authentication, hosting, storage, and security providers, and from authorized representatives acting for a traveler or client. ## 4. Purposes We process personal data to create and authenticate accounts, inspect files before payment, process paid audit orders, generate and deliver Decision Briefs, conduct limited manual review, process payments and refunds, provide support, maintain order and consent evidence, secure the Service, detect fraud or misuse, diagnose and improve reliability, comply with law, and enforce agreements. We will not use personal data for materially incompatible purposes without appropriate notice or consent. ## 5. AI-assisted processing Submitted documents may be processed using automated and AI-assisted tools to extract, classify, normalize, and present travel-quotation information. Automated output may be reviewed by deterministic systems and, in exceptional cases, by authorized personnel. TripDocket does not authorize submitted customer documents to be used to train public or general-purpose AI models. AI-assisted processing is limited to providing, securing, supporting, and improving the reliability of the purchased Service under the applicable provider and account settings. ## 6. Service providers and disclosures We may disclose personal data to service providers supporting cloud hosting and deployment, database and authentication, file storage, payment processing, AI-assisted document processing, security and fraud prevention, support, and professional advice. The launch configuration uses the following principal service providers: - **Supabase** — authentication, Postgres database, and private file storage. The primary TripDocket project region is Singapore. - **Vercel** — website and application hosting, deployment, network delivery, and operational request logs. Processing may occur through Vercel’s configured global infrastructure. - **Stripe** — payment processing, refunds, payment-dispute handling, and payment-related fraud prevention. Lucky Byte does not receive or store complete payment-card numbers. - **OpenAI** — AI-assisted extraction and classification used within the TripDocket processing workflow. TripDocket may also use professional advisers or security and support providers where reasonably necessary. The provider list may be updated when the production system changes. We may also disclose information where required by law, to protect customers or Lucky Byte, in connection with a corporate transaction, or with your direction or consent. ## 7. Sale and advertising sharing TripDocket does not sell personal data and does not share personal data for cross-context behavioral advertising. The invite-only beta does not use advertising trackers or non-essential advertising cookies. ## 8. International transfers Lucky Byte is incorporated in Hong Kong, and service providers may process data in other countries. Personal data may therefore be transferred to and processed in jurisdictions whose laws differ from those in your location. Lucky Byte uses contractual, technical, and organizational safeguards appropriate to applicable legal requirements. The primary TripDocket database and private-storage region is Singapore; other providers may process data in jurisdictions where they operate. ## 9. Retention TripDocket applies the following launch retention schedule, subject to legal holds and mandatory recordkeeping: - rejected or abandoned unpaid upload objects: normally deleted within 7 days; - paid source documents, extracted source material, and internal processing records: retained for up to 120 days after completion of the audit; - Decision Briefs: retained while needed to provide account access and transaction history, and may be retained for up to 7 years where reasonably necessary for records, disputes, or legal obligations; - order, consent, payment, refund, chargeback, dispute, and related transaction records: retained for at least 7 years; - routine technical and application logs: normally retained for up to 90 days, unless a longer period is required for security investigation or legal hold; - account and profile information: retained while the account remains active and then deleted or anonymized when reasonably practicable, except for information that must be retained under the periods above. TripDocket may delete or anonymize information earlier when it is no longer needed. A legal hold, active dispute, fraud investigation, security incident, or mandatory legal obligation may extend an applicable period. ## 10. Security Lucky Byte uses reasonable administrative, technical, and organizational measures intended to protect personal data. Measures may include authentication, access controls, row-level and role-based database restrictions, encrypted transmission, private storage, secrets management, logging, and restricted service-role access. No system is completely secure. ## 11. Your rights Depending on your location and applicable law, you may have rights to request access, correction, deletion, restriction, information about processing, withdrawal of consent where applicable, or complaint to a regulator. Rights may be subject to verification and legal exceptions. Send requests to **support@tripdocket.co**. ## 12. Hong Kong data rights Individuals may request access to and correction of personal data in accordance with applicable Hong Kong data-protection law. Requests should be sent to support@tripdocket.co and identify the relevant account or order. ## 13. California privacy rights If the California Consumer Privacy Act applies to Lucky Byte and the relevant processing, California residents may have rights concerning access, correction, deletion, information about collection and disclosure, and non-discrimination. An online-only business with a direct consumer relationship may accept qualifying requests through the stated email channel, subject to applicable law. TripDocket provides a point-of-collection notice identifying categories, purposes, sale or sharing status, and retention periods or criteria. The rights described in this section apply only where the California Consumer Privacy Act applies to Lucky Byte and the relevant processing. ## 14. Children TripDocket is not directed to persons under 18. Adults may submit limited information concerning child travelers where necessary for a family audit and where the adult has authority. Do not create a TripDocket account or purchase the Service if you are under 18. ## 15. Cookies and similar technologies The invite-only beta uses only first-party or essential storage needed to operate the Service: - authentication and session cookies used by Supabase Auth; - security and transaction-state storage required for account and Checkout flows; and - a first-party locale-preference cookie used to remember the selected interface language. The launch configuration does not use advertising cookies or non-essential analytics cookies. If TripDocket later enables analytics or other non-essential tracking, this Policy and the consent configuration will be updated before activation. ## 16. Changes We may update this Privacy Policy. Material changes will be communicated through the website, account, email, or another reasonable method where required. ## 17. Contact Lucky Byte Limited Company Number: 79234565 Flat A, 20/F, ZJ 300 300 Lockhart Road Wan Chai, Hong Kong Privacy Requests: support@tripdocket.co ---