Privacy Policy

Last updated 2026-10-24 · Rio Travel LLC

1. Who we are

TravelForza is software for travel agencies, operated by Rio Travel LLC (1776 Kearns Boulevard, Park City, UT 84060, USA). This policy explains what personal information TravelForza handles, why, who receives it, how long we keep it and the choices you have. Contact: privacy@travelforza.com.

2. Our two roles

For the people who create TravelForza accounts (agencies, advisors and their team members) and for visitors to travelforza.com, we decide how the information is used — we are the controller ("business").
For the information agencies put into TravelForza about their own travelers — names, contacts, passports, trips, payments — the agency decides how it is used and is the controller. We process it on the agency's behalf, only to run the service (we are a "processor" or "service provider"). If you are a traveler, the agency you booked with is your first point of contact; we will pass your request to them and help them answer.

3. What we collect

Account information: name, email, phone/WhatsApp, country, username, password (stored only as a salted hash), agency profile, team members, the plan you are on, and when you accepted these policies.
Information agencies store about their travelers: names, emails, phone numbers, dates of birth, nationality, passport numbers, expiry dates and passport/ID images, tax IDs, emergency contacts, travel preferences, trips, quotes, itineraries, invoices, payments, notes and messages. This can include information about minors traveling with their families.
Card authorizations: when a traveler fills in a card authorization form, we receive their name, contact details, billing address, signature, and the card number, expiry and security code. The card number and security code are encrypted and automatically erased after 2 days; we keep only the card brand and last four digits. We also record the IP address, approximate location (looked up through ipapi.co), browser and time, as evidence of the authorization.
Pages we show to travelers: when a quote or itinerary link is opened we log the time, IP address, browser and approximate location (via ipinfo.io) so the agency knows it was seen. Travelers who join a shared itinerary can add their name, photo, chat messages, shared expenses with receipts, photos, and optional payment handles (Venmo, Cash App, Zelle, Pix).
Messages: the content of WhatsApp, SMS and email messages sent and received through TravelForza, including voice notes and their transcripts.
Technical information: IP address, device and browser type, pages visited inside the app, error logs and security logs. We do not use advertising or analytics trackers.

4. How we use it

To provide the service: accounts, quotes, itineraries, messaging, flight tracking, payments and support.
To keep it secure: sign-in verification (two-step codes by SMS, WhatsApp or email), fraud and abuse prevention, audit logs.
To send service messages: confirmations, security alerts, billing notices. We do not send marketing email today; if we start, it will only go to people who agreed and every one will have an unsubscribe link.
To improve TravelForza, using aggregated or de-identified information where we can.
To meet legal obligations and defend legal claims.

We do not sell personal information and do not share it for cross-context behavioral advertising.

5. Artificial intelligence

Some features send information to AI providers to work: the WhatsApp assistant reads incoming messages (and transcribes voice notes) to reply; passport images are read to fill in traveler details; itinerary, quote and translation features send trip content. Our main AI provider is Google (Gemini API); Anthropic is used as a backup. They process the data to return a result for us. Card numbers and passwords are never sent to AI, and we do not use your clients' information to train our own models. The WhatsApp assistant says it is a virtual assistant and passes the chat to a person on request. More in How we use AI (/ai).

6. Who receives it

We share personal information only with service providers that help run TravelForza, under contracts that limit their use of it, and when the law requires:

Hosting and storage: Railway (servers and database, United States); Cloudinary (files and our encrypted nightly backups).
Messaging: Meta (WhatsApp Business), Twilio (SMS and calls), Resend (email).
Payments: Stripe and Square (subscriptions and payments; each agency may use its own account).
AI: Google (Gemini), Anthropic.
Travel data: FlightAware, AirLabs, Duffel and other fare/flight data sources (flight numbers and routes, not traveler identities).
Location and maps: Mapbox, OpenStreetMap, ipinfo.io, ipapi.co.
Device features: Apple and Google push notifications and Wallet passes; Google Calendar, only if an agent connects it; Google Translate for message translation.
Fonts and code libraries load from Google Fonts and jsDelivr, which receive the visitor's IP address.
Professional advisers, and authorities where the law requires it. If TravelForza is sold or merged, information may transfer to the new owner under this policy.

7. How long we keep it

Card number and security code: erased automatically 2 days after the authorization.
Account and agency data: while the account is open. After you close it, you can ask for an export for 30 days; we then delete it within 90 days, except what we must keep by law (for example billing records).
Items an agency deletes go to a trash, where they can be restored or permanently deleted.
Backups: encrypted nightly backups are kept for 14 days and then overwritten.
Logs: security and server logs are kept for as long as needed to investigate problems, normally a few months.

8. Security

We use encryption in transit (HTTPS), encryption at rest for card and other sensitive fields, two-step sign-in, per-agency access controls, rate limits and audit logs. No system is perfectly secure; if a breach affects you we will notify you and the authorities as the law requires.

9. Your choices and rights

Depending on where you live (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other U.S. states, and Brazil), you may have the right to: know and access the personal information we hold about you; get a portable copy; correct it; delete it; opt out of sale, sharing or targeted advertising (we do none); limit the use of sensitive information; not be treated differently for using these rights; and appeal our answer.

To use them, go to Your privacy choices (/privacy/request) or email privacy@travelforza.com. We verify requests through the email address on file. An authorized agent may act for you with your written permission. We answer within 45 days (15 days for LGPD requests), and tell you if we need more time. If we deny a request you can appeal by replying to our answer; if you are unhappy with the appeal you may contact your state Attorney General or, in Brazil, the ANPD.

Opt-outs: unsubscribe links in marketing email; reply STOP to SMS or WhatsApp marketing. We honor Global Privacy Control signals as an opt-out of sale and sharing.

10. Brazil (LGPD)

For users and travelers in Brazil: we process personal data to perform the contract with agencies (art. 7, V), to meet legal obligations (art. 7, II), for legitimate interests such as security and fraud prevention (art. 7, IX), and with consent where it is required (art. 7, I). Data is transferred to and processed in the United States with safeguards described here. You have the rights in art. 18 of the LGPD. Our data protection contact (encarregado): Rio Travel LLC, privacy@travelforza.com.

11. Children

TravelForza is not directed to children and we do not knowingly collect information directly from children under 13. Agencies may store information about minors provided by their parents or guardians to arrange travel; the agency is responsible for that consent. If you believe a child gave us information directly, contact us and we will delete it.

12. International use

TravelForza is operated from the United States and data is stored there. By using it from another country you understand your information is transferred to the United States.

13. Changes

If we change this policy materially we will tell account holders by email or in the app before it takes effect, and update the date above.

14. Contact

Rio Travel LLC · 1776 Kearns Boulevard, Park City, UT 84060, USA · privacy@travelforza.com · +1 (435) 214-6939

Ask to see, correct or delete your data →