Legal

Privacy Policy

Data Controller: SC Power Global Trade SRL · Effective: March 2026

1. Who We Are

This Privacy Policy applies to TravelMaster AI / Marco, operated by SC Power Global Trade SRL, a company registered in Romania with VAT number RO36307490.

Registered address: Str. Arad nr. 42, Cod Postal 550131, Sibiu, Romania
Legal representative: Mateescu Dan
Contact: daniel@travelmasterai.com | +40741784547

We are the Data Controller for personal data collected through travelmasterai.com and the Marco AI concierge service.

2. What Data We Collect

2.1 Data You Provide Directly

Full name and email address (when creating an account)
Password (stored in hashed form via Supabase — we never store plaintext passwords)
Country of residence (optional, provided during onboarding)
Payment information (processed by Stripe — we do not store card data)

2.2 Data Generated Automatically

Conversation content you submit to Marco (processed in real-time, not permanently stored for training without consent)
IP address and browser/device type (collected via Vercel infrastructure)
Session duration and pages visited (analytics)
Preferred language (detected automatically from your messages)

2.3 Data We Do NOT Collect

We do not collect biometric data, health data, or special category data under GDPR Article 9
We do not perform profiling for automated decision-making with legal effects
We do not sell your data to third parties
We do not use your conversations to train AI models without your explicit consent

3. Legal Basis for Processing (GDPR Article 6)

Contract performance (Art. 6(1)(b)): Processing your name, email, and account data to provide the service you signed up for.

Legitimate interest (Art. 6(1)(f)): Processing usage data and conversation logs for security, fraud prevention, and service improvement.

Consent (Art. 6(1)(a)): Where we send marketing communications or use optional cookies. You may withdraw consent at any time.

Legal obligation (Art. 6(1)(c)): Processing required for tax compliance (ANAF Romania) and accounting records.

4. How We Use Your Data

To create and manage your account
To provide Marco AI concierge responses to your travel queries
To enforce daily usage limits (Explorer: 5 conversations/day)
To process subscription payments via Stripe
To send transactional emails (account confirmation, password reset)
To detect and prevent abuse, fraud, or unauthorized access
To comply with Romanian and EU legal obligations

5. Third-Party Processors

We share data with the following processors under Data Processing Agreements (DPAs):

Processor	Purpose	Data Transferred
Anthropic (USA)	AI response generation	Conversation messages (not linked to identity)
Supabase (USA/EU)	Authentication & database	Name, email, account data, usage counters
Vercel (USA)	Hosting & serverless functions	IP address, request logs
Stripe (USA)	Payment processing	Email, billing address, payment intent

All US-based processors participate in the EU–US Data Privacy Framework or operate under Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring lawful cross-border data transfer under GDPR Chapter V.

6. Your Rights Under GDPR

As a data subject, you have the following rights, exercisable by contacting us at daniel@travelmasterai.com:

Right of access (Art. 15): Request a copy of all data we hold about you
Right to rectification (Art. 16): Correct inaccurate or incomplete data
Right to erasure (Art. 17): Request deletion of your account and associated data
Right to restriction (Art. 18): Limit how we process your data in certain circumstances
Right to data portability (Art. 20): Receive your data in a structured, machine-readable format
Right to object (Art. 21): Object to processing based on legitimate interest
Right to withdraw consent: At any time, without affecting prior processing

We will respond to all requests within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with the Romanian supervisory authority:

ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal)
Website: www.dataprotection.ro
Address: B-dul G-ral Gheorghe Magheru 28-30, Sector 1, 010336, Bucharest, Romania

7. Data Retention

Account data: Retained for the duration of your account, plus 3 years for legal/accounting purposes (ANAF requirement)
Conversation logs: Retained for maximum 90 days for abuse prevention, then deleted
Payment records: Retained for 10 years (Romanian accounting law)
Security logs (IP, access): Retained for 12 months

8. Cookies

We use only strictly necessary cookies for authentication (session tokens via Supabase). We do not use advertising or tracking cookies. No cookie consent banner is required for strictly necessary cookies under ePrivacy Directive and Romanian Law 506/2004.

If we introduce analytics or optional cookies in the future, we will update this policy and implement a cookie consent mechanism.

9. Children’s Data

Our service is not directed at children under 16. We do not knowingly collect personal data from persons under 16. If you believe a child has provided us with personal data, please contact us immediately at daniel@travelmasterai.com.

10. Security Measures

All data transmitted over HTTPS/TLS encryption
Passwords stored as bcrypt hashes via Supabase Auth
API keys stored exclusively as server-side environment variables — never exposed to client browsers
Row-level security (RLS) enforced in Supabase database
Regular security reviews of third-party dependencies

11. Changes to This Policy

We will notify registered users by email of any material changes to this Privacy Policy at least 14 days before they take effect. Continued use of the service after changes constitutes acceptance of the updated policy.

12. Contact

Data Controller: SC Power Global Trade SRL
Address: Str. Arad nr. 42, Cod Postal 550131, Sibiu, Romania
Email: daniel@travelmasterai.com
Phone: +40741784547
Legal representative: Mateescu Dan

Last updated: March 2026