Privacy

Last updated 7 September 2026

Who we are

TripWallet is run by AMVEN Ltd, a company registered in England and Wales. We are the data controller for everything described here. Write to hello@tripwallet.uk about anything on this page.

What we hold, and why

Only what the product needs to do its job. We do not build a profile of you and we do not sell anything to anybody.

Your email and password

To sign you in. Passwords are stored as a bcrypt hash and cannot be read back, by us or anyone else.

Passkeys

A public key your device generated. The private half never leaves your device.

Trips, flights, hotels, packing lists

The product. You typed them, or forwarded a confirmation that produced them.

Passport numbers

For passport-validity checks. Encrypted at rest with a key held only on the server.

Uploaded documents

Tickets, insurance certificates, passport images. Every file is encrypted at rest.

Booking logins

Website passwords for your bookings, if you choose to store them. Encrypted at rest, and shown only to people you have explicitly granted access.

Payment records

What you bought, when, and how much. We never see or store your card details — Stripe handles those.

Email you forward to us

If you use the forwarding address, we receive the confirmation emails you send it and read them to extract flight numbers, dates and references. That is the whole purpose and the whole extent of it.

We do not connect to your inbox. We cannot see mail you have not forwarded, we have no access to your email account, and we never ask for its password.

Where artificial intelligence is used

Four features send content to Google's Gemini model: reading a forwarded booking, scanning a ticket you upload, ranking places near you, and searching for excursions. The document or email you supplied is sent to Google to be read, and the extracted fields come back to us.

The model is not trained on what you send. Nothing you store is used to improve any model, ours or Google's. A field the model cannot find is left empty and marked rather than guessed, which is why you are asked to check every import before saving it.

Where your data is kept

On servers in the United Kingdom, run by InstaHost — which is part of AMVEN Ltd, the same company that runs TripWallet. Hosting, the database and the mail server are ours rather than a third party's, so your trips and documents are not handed to another company simply to be stored.

Who else processes your data

These companies do specific jobs we cannot do ourselves. They act on our instructions and nothing more, and none of them receives more than the job needs.

Stripe

Payments. They receive your email and card details directly; we receive only a customer reference and what you bought.

Google (Gemini)

Reading forwarded bookings and scanned tickets, and the two search features described above.

Geoapify

Finding places near you. Receives a location, never your identity.

Who can see your trips

Only you, and people you invite. Sharing a trip is not all-or-nothing: someone you invite can see the plan, but your documents and your booking logins are separate permissions that are off until you turn them on.

When someone does not have access to your documents, those documents are not sent to their device at all. They are not hidden with styling or left out of a menu — the data never reaches the page.

How long we keep it

For as long as you have an account. Delete a trip and it goes, along with the files attached to it. Ask us to delete your account and everything is removed permanently — not archived, not flagged as deleted, actually removed.

We keep a record of payments for as long as tax law requires us to, which is currently six years. That record is what you bought and when; it holds no card details.

Your rights

Under UK GDPR you can ask for a copy of your data, ask us to correct it, ask us to delete it, or object to how we use it. Email hello@tripwallet.uk and we will respond within one month.

If you are unhappy with how we have handled it, you can complain to the Information Commissioner's Office at ico.org.uk.

Cookies

One cookie, to keep you signed in. No analytics, no advertising, no third-party tracking, and therefore no cookie banner asking you to accept things you did not want.

Changes

If we change how we use your data in a way that matters, we will email you rather than quietly updating the date at the top of this page.