Privacy Policy

At Nextdestinationai.com (“we”, “us”, or “our”) we respect the privacy of our users and are committed to protecting your personal information. This Privacy Policy describes how we collect, use, share, and protect data when you use our website and AI travel planning services.

Please read this policy carefully. If you do not agree, please discontinue use of our services. We will notify you of material changes by updating the “Last updated” date above and, where required by law, by email.

We collect the following categories of information:

• Account Information

  Name, email address, password (hashed), gender, and age — provided when you create an account.

• Travel Preferences

  Destinations, trip dates, budget preferences, and traveller count — provided when using our AI planner.

• Device & Technical Information

  Device type, operating system, browser type, IP address, and unique device identifiers collected automatically.

• Usage Information

  Pages visited, features used, clicks, session duration, and interaction patterns collected via analytics tools.

• Location Information

  Approximate location derived from your IP address. Precise location only with your explicit consent.

• Cookies & Tracking Technologies

  Browsing behaviour, session data, and preferences collected via cookies and similar technologies (see section 06).

• Consent Record

  Timestamp, IP address, and version of Terms & Privacy Policy accepted at signup — retained for legal compliance.

• Communications

  Messages you send to our support team or via our contact form.

If you are located in the European Economic Area (EEA), United Kingdom, or another jurisdiction with data protection laws, we process your personal data under the following legal bases:

• Consent (Art. 6(1)(a) GDPR)

  You explicitly accept this Privacy Policy at signup, and you provide cookie consent via our cookie banner. You may withdraw consent at any time.

• Contract (Art. 6(1)(b) GDPR)

  Processing necessary to provide our AI travel planning services you signed up for, including processing subscription payments.

• Legitimate Interests (Art. 6(1)(f) GDPR)

  Improving our services, preventing fraud, ensuring security, and analytics — where these interests are not overridden by your rights.

• Legal Obligation (Art. 6(1)(c) GDPR)

  Retaining consent records and transaction logs as required by applicable law.

Depending on your location, you may have the following rights regarding your personal data. To exercise any of these rights, contact us at info@nextdestinationai.com.

We offer paid subscription plans (Starter, Pro, and Unlimited). All payment processing is handled by Stripe, Inc., a PCI-DSS Level 1 certified payment processor. We do not store your full card number, CVV, or other sensitive payment details on our servers.

When you subscribe, Stripe creates a customer record linked to your account. We receive and store:

• Your Stripe Customer ID and Subscription ID
• Your subscription plan, status, and renewal date
• Whether a payment succeeded or failed (no card details)
• Billing email address used for receipts

Stripe's privacy practices are governed by the Stripe Privacy Policy. Subscriptions renew automatically at the end of each billing period, monthly or yearly depending on the billing you choose, until you cancel. You can cancel at any time on the Pricing page or in your profile, or by contacting us.

We use cookies and similar technologies to operate our services, analyse usage, and (with your consent) for marketing purposes. We obtain your consent before placing non-essential cookies via our cookie banner.

Third-party services we use:

• Google Analytics (GA4)

  analytics

  Tracks page views, user behaviour, and session data. Data is processed in the USA under Google's EU-US Data Privacy Framework certification. Privacy Policy ↗

• Google Tag Manager

  marketing

  Manages and deploys marketing and analytics tags. Governed by Google's Privacy Policy. Privacy Policy ↗

• Microsoft Clarity

  analytics

  Session recording and heatmap analytics. Data is processed under Microsoft's privacy terms. Privacy Policy ↗

• Facebook Pixel

  marketing

  Tracks conversions from Facebook ads. Data may be shared with Meta Platforms, Inc. for ad targeting. Privacy Policy ↗

• Vercel Analytics

  analytics

  Privacy-friendly usage analytics with no personal data collection. Governed by Vercel's Privacy Policy. Privacy Policy ↗

You can control your cookie preferences at any time using our cookie banner (shown on first visit) or by adjusting your browser settings. Non-essential cookies (analytics and marketing) are only activated after you give your consent.

Most browsers allow you to refuse or delete cookies. You can also opt out of specific services:

• Google Analytics opt-out
• Facebook ad preferences
• Microsoft Clarity opt-out

Our website may link to third-party websites. We are not responsible for their privacy practices and encourage you to review their policies before engaging with them.

We use the following third-party providers to operate our service. Each processes data under their own privacy policy:

• Stripe — payment processing
• Google Maps Platform — interactive trip maps and place data
• Anthropic (Claude AI) — AI-generated travel itineraries
• HostGator / cPanel — file and media hosting
• Vercel — website hosting and edge delivery

We implement industry-standard security measures to protect your personal information, including:

• HTTPS/TLS encryption for all data in transit
• Bcrypt hashing for all stored passwords (never stored in plain text)
• Email verification required before account activation
• Payment data handled exclusively by PCI-DSS certified Stripe (we never see raw card data)
• Access controls limiting which team members can access production data

While we take significant precautions, no method of electronic transmission or storage is 100% secure. In the event of a data breach affecting your rights, we will notify you in accordance with applicable law.

We retain your personal information only as long as necessary for the purposes described in this policy or as required by law:

• Account data — retained while your account is active and for up to 3 years after deletion
• Consent records (signup timestamp, IP, ToS version) — retained for 7 years for legal compliance
• Payment records — retained for 7 years as required by financial regulations
• Analytics data — retained per the terms of each analytics provider (typically 14–26 months)
• Support communications — retained for up to 3 years

You may request deletion of your account and data at any time by contacting us. We will action deletion requests within 30 days unless a legal retention obligation applies.

Our services are not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. Our signup form requires users to confirm they are at least 13 years old.

If you are a parent or guardian and believe your child under 13 has provided us with personal information, please contact us immediately at info@nextdestinationai.com. We will delete such information promptly.

This Privacy Policy is governed by applicable data protection laws, including the General Data Protection Regulation (GDPR) for users in the EEA and UK, and equivalent laws in other jurisdictions where required.

Any disputes arising under this Privacy Policy shall be resolved in accordance with the governing law specified in our Terms & Conditions. If you are an EEA or UK resident and believe we have violated your data protection rights, you have the right to lodge a complaint with your national supervisory authority.

For any privacy-related questions, data access requests, deletion requests, or complaints, please contact us. We aim to respond within 30 days.