Privacy Policy

Effective date: October 21, 2026 · Nomad Travel & Hospitality Inc., operating Visby (“we”, “us”)

Visby is a travel companion and a platform hotels use for their guests. This policy explains what we collect, why, and how you can exercise your rights. We do not sell personal information and we do not use data for cross-app advertising tracking. Related: Trust Center, Cookies, Subprocessors, DPA.

1. Controller identity

For the consumer Visby app and marketing site, Visby is the data controller. For hotel partner products, the hotel (Customer) is typically the controller of guest/staff data it connects to Visby, and Visby acts as a processor under our Data Processing Addendum. Visby is a controller in its own right for your Visby account, for the payment, payout and fraud-prevention records it keeps for what it sells at hotels and for paying hotels and their partners, and for drivers’ and partners’ accounts with Visby. Contact: hello@visbytravel.com (privacy). Until a dedicated DPO is appointed, that inbox handles data-protection inquiries.

2. Information we collect

• Account: email address and password (stored by our auth provider), display name / username, age band at signup.
• Profile & progress: Visby companion state, Aura, stamps, bites, lessons, houses, cosmetics, trips, and similar in-app progress.
• User content: photos you take or choose for stamps, food logs, chat attachments, and messages you send in place/room chat.
• Location (optional): when you grant permission, approximate or precise location to power nearby places, stamps, your trip route when you turn on “Track my route”, and optional Apple Watch area tips. You can deny or revoke access in system Settings.
• Health (optional, iPhone and Apple Watch / HealthKit): read-only steps, heart rate, active energy and walking distance, used only on your device for friendly wellness tips. Health data is never sent to AI providers and is not stored on our servers. Visby does not write to HealthKit and does not provide medical advice or diagnosis.
• Voice (optional): when you talk to your Visby companion, record a voice note, join house voice or video with friends, or call your hotel or driver in the app, we use your microphone for that moment only. Voice you send to the companion is turned into text by our AI provider (see below). Calls are not recorded.
• AI features: when you use AI features (the Visby companion chat and voice talk, questions about a photo, trip plans and suggestions, journal help, and a hotel’s concierge chat), we send what you share for that request to OpenAI, the AI provider that writes the answers: your messages, photos you add, voice recordings (turned into text), place or location context (such as the spot, area or city you ask about), and the trip, taste and memory details the companion needs to answer. The app asks your permission before anything is sent to OpenAI the first time, and you can turn AI answers off or on any time in Settings → Privacy & Health. If you say no, the rest of the app keeps working. Under OpenAI’s API terms this data is not used to train its models. You can report any AI reply from the chat (press and hold the reply).
• Device & notifications: push notification tokens if you enable notifications; basic device identifiers needed to operate the service.
• Purchases: subscription and Aura pack transactions are processed by Apple / Google. We receive entitlement status and transaction identifiers needed to unlock features — we never receive your full payment card number.
• Analytics & ads measurement: privacy-first product events (for example app screen views, marketing site page views, and feature use) without precise lat/lng in event properties. On the website we count visits without cookies: our server notes the page, the approximate city and country from your IP address, your device type, browser and operating system, and a visitor code that changes every day. Your IP address itself is never stored. A lasting analytics id and the Google Ads tag run only with your consent — see Cookies.
• Age: we ask for your birthday at signup to confirm you are 13 or older, and keep it with your account settings for birthday and age-based features. If the birthday shows you are under 13, no account is made and the birthday is not kept.
• Hotel partner data: property configuration, staff accounts/roles, guest messaging content, and integration metadata as configured by the hotel.
• Mobile number (text messages): if you stay at a hotel that uses Visby, the hotel may give us the mobile number from your booking so we can text you about your stay. Hotel staff and drivers give us their number to get verification codes and ride messages. We keep the texts you send us and whether you have opted out.
• Hotel stays: when you stay at a hotel that uses Visby, the hotel gives us your booking details (name, email, phone, dates, room type, number of guests, language). They come from the hotel’s team, its booking system, or booking confirmation emails it forwards to Visby, which our AI provider reads to pull out those details. We also keep the requests, bookings, orders and messages you make during the stay.
• Payments: when you buy something from Visby at a hotel (in the app or on a hotel’s booking page), Stripe collects your card details; we never receive your full card number. We receive and keep the amount, currency, what it was for, its status, refunds and disputes, and Stripe’s identifiers. When you split trip costs, we keep what each person added and what was marked paid; money between friends doesn’t go through Visby.
• Getting paid: if Visby pays you (a hotel, or a partner a hotel works with), you give your bank details, and for partners your identity, to our payout provider Wise (hotels) or Stripe (partners). We keep only a reference and a short label (for example “Bank ••4521”), plus what we paid you and when.
• Drivers: if you drive for a hotel, we keep your name, phone or WhatsApp number, photo, languages, vehicle and plate, your base area, the hotels you drive for, your ride offers and rides, and the prices you agree. When you turn on live location during a ride, we receive your position every few seconds until the ride ends or you turn it off, and keep only the latest point for that ride.
• Calls: for calls in the app we keep who called whom, when, how long it lasted and how it ended. Calls are not recorded, and phone numbers are not shown to the other person.
• Public recaps: if you publish a trip recap, it is visible to anyone with the link. When someone opens it, we record when, the country, and which photos and places they looked at, and show that to the recap’s owner. If the viewer is signed in to Visby, the owner sees their display name; other viewers appear as “Guest”. Viewers who decline analytics, or whose browser sends Do Not Track or Global Privacy Control, aren’t given a lasting identifier.

3. Lawful bases (GDPR / UK GDPR)

Where those laws apply, we rely on:

• Contract: creating and operating your account, syncing progress, providing features you request.
• Legitimate interests: product improvement with privacy-first analytics (including cookieless website visit counts), security, fraud prevention, and moderating abuse — balanced against your rights.
• Consent: optional permissions (location, HealthKit, microphone, notifications), sending what you share with AI features to OpenAI, the lasting website analytics id and Google Ads measurement where required, and certain marketing emails.
• Legal obligation: tax, accounting, or lawful requests.

4. How we use information

• Provide and sync your Visby account across devices
• Power learning, collection, maps, chat, Watch, and hotel concierge features you enable
• Process in-app purchases and restore entitlements
• Run hotel stays: create your stay from the hotel’s booking, send you its link, and pass your requests and messages to the hotel
• Take payments for what Visby sells at hotels, make refunds, handle disputes, pay hotels and their partners, and keep the records tax and accounting laws require
• Verify hotels and people who receive money, and prevent fraud, money laundering and payments to sanctioned people or places
• Moderate user-generated content (reports / blocks) and keep the service safe
• Improve the product with aggregated, privacy-first analytics
• Meet legal obligations and enforce our Terms

5. Sharing

We share data with service providers that help us run Visby (cloud hosting, authentication, maps, push delivery, AI inference by OpenAI once you allow AI answers, messaging channels, and purchase validation). Those providers process data under contracts and only for our instructions. Named providers are listed at /subprocessors. We may disclose information if required by law. We do not sell personal data and we do not share it for cross-app tracking.

We also share personal data, only as far as each needs it, with:

• The hotel you stay at: your stay, requests, orders, payments and messages with its concierge.
• Partners and drivers of that hotel: when you book something they run, the details they need to deliver it (for example your name, language, date, time, number of people and your note; your phone only if the hotel chooses). Drivers see your first name and initial, and riders see the driver’s first name, photo, car and plate.
• Payment and payout providers: Stripe and Wise, which are also responsible for their own legal duties (for example fraud checks and anti-money-laundering rules), and banks.
• The people you choose: others on a trip or stay you invite, and anyone with the link to a recap you publish.

6. Text messages (SMS)

We text only about things you are part of: your hotel stay (your stay link, the hotel concierge’s answers when you write to it, and updates on rides you booked), verification codes you ask for, and ride offers for drivers. We do not send marketing texts.

We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. Nor do we share mobile numbers or text-message consent with affiliates for marketing or promotional purposes. The sharing described in section 5 excludes text-message opt-in data and consent. Your number is used only by the provider that delivers our texts and by the hotel you are staying with, to run the service.

Reply STOP to any text to stop receiving them and START to turn them back on. Full details: SMS Terms.

7. Children’s privacy

Visby is for people 13 and up, and accounts for anyone under 13 are not allowed. We ask for a birthday at signup and do not make an account when it shows someone is under 13. We do not knowingly collect personal information from children under 13. If we learn that an account belongs to someone under 13, we close it and delete its data. If you believe a child under 13 has given us information, contact us at the address below or through the privacy request form and we will delete it.

8. Device permissions

Every permission is optional and asked for only when you use the feature that needs it.

• Location (While Using): nearby places, stamps, maps and your position on trip and hotel maps.
• Location (Always / background, iPhone only): used only when you turn on Track my route on a trip (to draw the route while the app is closed) or Background Watch tips in Settings → Devices. Both are off by default. Turn them off from the trip map, in Visby Settings or in iOS Settings.
• Microphone: talking to your Visby companion on iPhone or by dictation on Apple Watch, voice notes and journal entries, the music studio, house voice and video with friends, and calls to your hotel or driver in the app.
• Background audio: keeps an in-app call (house voice, hotel or driver call) connected, and lets audio you started keep playing, when you switch apps or lock your phone.
• Camera and photos: photos you choose or take for stamps, trips, chats and your profile, QR codes, and video in house hangouts and calls.
• Health (HealthKit, read only): steps, heart rate, active energy and walking distance for wellness tips, on your device only. Never sent to AI and never used for medical advice.
• Notifications: trip, stay and companion reminders you can turn off in Settings.

Core app features work with While Using location or without location.

9. Google Calendar (optional)

On a trip you can connect a Google account so the trip planner knows when you are busy and can add the plan to your calendar. When you connect one, we ask Google for three narrow permissions only: the free/busy times of the calendars you pick (never the titles, guests, places or notes of your events), the list of your calendars so you can choose which ones count, and the right to create and edit a separate “Visby trips” calendar that Visby makes in your account. Visby reads busy ranges for the trip’s dates, shows them to the trip as “busy” without details, and writes the trip’s plan to that Visby trips calendar. It never changes your other calendars.

Google gives Visby OAuth tokens for this. They are stored in our Supabase database, encrypted at rest, in a table only our server can read, and are used only to call Google for the trips you sync. They are deleted when you disconnect the account (we also ask Google to revoke them) or when you delete your Visby account. We do not use Google Calendar data for advertising, do not sell it, and no person reads it except to run or fix this feature. Visby’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

To disconnect: open the trip’s Crew tab → Calendars, choose your Google account and tap Disconnect, or remove Visby under your Google account’s Third-party apps & services.

10. Retention

• Account & profile data: kept while your account is active; deleted when you delete your account, subject to limited legal/fraud retention.
• Product analytics events: typically up to 24 months.
• Security audit logs: typically up to 24 months.
• Purchase / entitlement records: as needed for fraud prevention, refunds, and legal obligations.
• Payment and payout records: for as long as tax, accounting and anti-money-laundering laws require (generally 6 to 7 years), even if you delete your account.
• Hotel stay data: kept for the hotel under its instructions and our DPA, and deleted or returned when the hotel asks or stops using Visby, subject to the records above.
• Recap view statistics: kept while the recap exists; deleted with it.

11. Your rights (GDPR / UK GDPR)

If you are in the EEA, UK, or a similar jurisdiction, you may have rights to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase data (“right to be forgotten”) where applicable
• Restrict or object to certain processing
• Data portability (machine-readable export)
• Withdraw consent where processing is consent-based
• Lodge a complaint with your local supervisory authority

In the app: Settings → Export my data and Settings → Delete account. Or use our privacy request form / email hello@visbytravel.com.

Canada: under PIPEDA and provincial privacy laws you can ask to see and correct the personal information we hold about you and withdraw consent (which may mean we can’t provide some features). If you’re not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada. People elsewhere have the rights their local law gives them, and can use the same form or email.

12. California (CCPA / CPRA)

We do not sell or share personal information for cross-context behavioral advertising. California residents may request know, delete, and correct rights via the privacy request form or email above. We will not discriminate for exercising privacy rights. If we offer a financial incentive in the future, we will describe it clearly at that time.

13. International transfers

Visby is based in Canada. Our main systems are in the United States, and our providers process data in other countries too. Data about a hotel stay moves between the hotel’s country, Canada and the United States, and payouts to a hotel go through the payment providers’ systems to the hotel’s bank. We may process data in the United States and other countries where our providers operate. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses with subprocessors. Details: Subprocessors and DPA.

14. Security

We use industry-standard measures including encrypted transport (HTTPS/TLS), row-level database security, and secure token storage on device. See Security. No method of transmission or storage is 100% secure.

15. Your choices

• Revoke camera, photos, location, microphone, notifications, or Health access in system Settings
• Opt out of product analytics in app Settings (Privacy preferences)
• Turn AI answers (sharing with OpenAI) on or off in app Settings → Privacy & Health
• Reject the lasting website analytics id and Google Ads via the cookie banner (see Cookies)
• Restore or manage subscriptions in Apple ID / Google Play settings
• Export or delete your account in-app as described above

16. Contact

Nomad Travel & Hospitality Inc. (Visby), Ontario, Canada
Email: hello@visbytravel.com
Form: Privacy request
Web: https://www.visbytravel.com

17. Changes

We may update this policy. We will post the new effective date here and, when changes are material, provide additional notice in the app or by email when appropriate.