Privacy Policy · Travel Tech Solution

Client Login Sign Up Request a Demo Demo

LegalLast updated 6 October 2026

What we collect through this website and the client portal, what we do with it, how long we keep it, and how to ask us about it. Eleven short sections, no legalese.

Start Reading

Who we are

The company behind this site, and the controller of the data it describes.

Travel Tech Solution builds and operates white-label travel booking platforms for online travel agencies. We are the controller of the personal information described in this policy. To ask us anything about it, reach us through the contact page.

What this policy covers

This website, the client portal and our back office. Not the storefronts our clients run.

This policy covers three things we run:

this public website, including the demo request form;
the client portal, where our clients' staff sign in to see their platforms, invoices and support tickets;
the back office our own team uses to run client accounts.

It does not cover the booking storefronts we build for our clients. Each storefront is operated by the agency whose brand it carries, under that agency's own privacy policy. If you booked travel on one of those sites, the agency is the controller of your booking data and the right place to send a request about it.

Information we collect

Demo requests, portal accounts, sign-in records, tickets, billing records and technical logs.

When you request a demo

Your company name, your name, your work email and, if you give them, your phone number, website, country, the products you are interested in, your expected booking volume and your message. We also record the IP address the request came from, to stop the form being abused.

When you use the client portal

Your name, email, phone number and role at the client, as entered by us or by your colleague who administers the account; a hashed password you set; and, if you turn it on, the settings for two-factor sign-in. Your authenticator secret is stored encrypted and never shown again once set up.

When you sign in

For each session we keep the date and time, the IP address, and a description of the browser and device, so that you can see the devices signed in to your account and end any you don't recognise. We keep the time of your last sign-in.

When you raise or reply to a support ticket

The messages you write, when you wrote them, and the platform or account the ticket is about.

Billing records

Invoices, payments and their dates and amounts are kept against your company's account. They name the company, not an individual, except where a contact is listed as the recipient.

Technical records

Standard server logs, and error reports when something goes wrong, which may include the page you were on and the account that was signed in. Every change made to a client account by our team or by a portal user is written to an audit trail with the account, the time and the IP address.

How we use it

To run your platform, keep your account safe, bill you and answer you. Nothing else.

to answer a demo request and, if you become a client, to set up and run your platform;
to let you and your colleagues sign in to the portal securely, and to protect your account from misuse;
to issue invoices, record payments and send reminders about bills that are due;
to answer your support tickets and tell you by email when there is a reply;
to find and fix faults in the service;
to keep the records we are required to keep by law, such as accounting records.

We send you email only about these things: your demo request, your account, your invoices and your tickets. We do not send marketing newsletters, and we never sell or rent personal information to anyone.

Cookies

A session cookie and one preference cookie. No advertising, no analytics, no tracking.

We set only the cookies the service needs to work:

a session cookie once you sign in, which identifies your session and expires when it ends;
a preference cookie that remembers whether you collapsed the side navigation, so the page renders the way you left it.

There are no advertising cookies, no third-party analytics and no tracking across other websites.

Who we share it with

Our hosting, database and email providers, each with only what it needs. Never sold.

We use a small number of providers to run the service, and share with each only what it needs to do its job:

a hosting provider that runs the application, and a database provider that stores its data;
an email delivery provider that sends the emails described above, which receives your address and the message.

Within a client account, the people your company has given portal access to can see that account's tickets, invoices and platforms, including messages written by their colleagues. We may also disclose information where the law requires it.

How long we keep it

Sessions for twelve hours, reset links for an hour, invitations for a week, invoices as long as the law says.

Demo requests are kept while we are in conversation and for a reasonable period afterwards, or until you ask us to delete them.
Portal accounts are kept while your company is a client. When access is withdrawn, every session for that account is ended at once.
Sign-in sessions expire after twelve hours. Password reset links expire after one hour and invitation links after one week; both can be used once.
Support tickets and the audit trail are kept for the life of the client account, so a question about an old change can still be answered.
Invoices and payments are kept for as long as accounting law requires.
Error reports are kept until the fault is fixed and the report is closed.

How we protect it

Hashed passwords, optional two-factor, encrypted credentials, a device list and an audit trail.

Passwords are stored only as salted hashes; we cannot read them.
Every account can turn on two-factor sign-in with an authenticator app. Authenticator secrets and one-time codes are stored encrypted or hashed, never in the clear.
Credentials for our clients' suppliers and payment gateways are encrypted at rest and decrypted only on an explicit, logged request.
Each account shows the devices signed in to it and can end any session from there. Changing a password ends every session.
Forms that can be submitted without signing in are rate-limited, and the change history of every account is kept in an audit trail.

Your rights

Ask for a copy, a correction or a deletion. We answer within a month.

Depending on where you live, you may have the right to:

ask for a copy of the personal information we hold about you;
have it corrected if it is wrong (portal users can edit their own profile at any time);
have it deleted, where we are not required to keep it;
object to, or ask us to restrict, a particular use of it;
complain to the data protection authority where you live.

To exercise any of these, reach us through the contact page. We will answer within one month.

Changes to this policy

The date at the top moves. Portal users hear by email before a change that affects them.

When we change this policy we update the date at the top of the page. If a change affects how we use information we already hold about portal users, we tell them by email before it takes effect.

Contact

One address for questions about this policy. The portal for questions about your account.

Questions about this policy or about your information: reach us through the contact page. For anything about your company's account, a support ticket from the portal reaches the person who looks after it.

Still have a question?

A person answers, within one working day. Clients can also raise a ticket from the portal.

Plainwordsaboutyourinformation.