Privacy notice
What we collect
If you sign in: your email address and, from Google, your name and profile picture. The traveller details you choose to save (name as on your passport, phone, home city, date of birth, gender, currency, dietary needs and the things you love). Your search history (what you ask it). Your passport, if you add one: encrypted before it is stored, shown to you only masked, and shared only with the airline when it books a flight for you. A record of each trip it plans or books for you, and what it learns from them: the tastes you name, the cities you visit and the hotels you stay at. Your demo wallet's ledger and receipts. If you check your identity, the result of that check (not your document images, which stay with the identity provider). If you don't sign in, your details stay in your browser.
Why
To plan trips around what you like, to book flights, rooms and tables in your name, to keep your trips in one place and in your calendar, and to plan the next trip better. Our legal basis is providing the service you asked for, and your consent for the passport and identity check.
What we don't do
We don't sell your data or share it with advertisers, and there are no ads or tracking scripts. We never see your card details. Passwords aren't stored; you sign in with Google or a one-tap email link. Your personal details are never put into an AI model's prompt beyond what a booking or call needs.
Who processes it
Your account is stored with our database and sign-in provider (Supabase). The site runs on Vercel.
To plan, the words of your request (not your account details) go to the services that do the work: the AI model providers (Anthropic, Nebius, Groq), the taste data service (Qloo), web search (Tavily, Wikimedia), flight prices (Google Flights through SerpApi), hotel rates (LiteAPI), flights (Duffel), and maps (OpenStreetMap's geocoding and routing, Google's 3D map tiles). A voice note goes to the speech-to-text provider (Groq) and isn't stored.
When you approve a booking, the details it needs go to the airline or hotel booking provider (Duffel, LiteAPI). When you approve an email or a call, the business's address or number, your name and the message go to the email and calling providers (Resend, Vapi, Telnyx). Calls say they're from an AI assistant. An identity check runs with Persona. Each acts on our instructions or under its own terms for the booking.
Cookies and storage
Only what the site needs to work. If you sign in, three cookies keep you signed in (bl_at, bl_rt, bl_exp): secure, http-only and not readable by scripts. A short-lived cookie protects the Google sign-in step. Your browser also keeps your theme, your display currency and, when signed out, your saved details. No analytics or advertising cookies, so there's nothing to consent to beyond using the site.
Your calendar
If you subscribe your calendar to your trips, the calendar app fetches a private link that lists your planned days. The link is signed so it can't be guessed; anyone you share it with can read those days, so keep it to yourself.
How long we keep it
Until you remove it. You can edit your details, remove any saved preference, clear your search history, remove your passport and delete any trip from your account page at any time. To delete your whole account and everything in it, ask us (below) and it's done within 30 days.
Children
Backline is for adults. Trips can include children, but accounts are for people 18 and over, and we don't knowingly collect data from children beyond the ages you enter so rooms are priced right.
Your rights
You can ask to see, correct, export or delete your data, or withdraw consent, under the GDPR, the NDPA and similar laws. Email backline.trips@gmail.com and we'll act within 30 days.