Privacy notice
This notice explains how TripClerk handles personal data, written with UK GDPR and the Data Protection Act 2018 in mind. Last updated: 2 November 2026.
Who is responsible
Each travel agency that uses TripClerk is the controller of the data it enters about its clients and travellers. TripClerk acts as the agency's processor: we store and process that data only to provide the service, on the agency's instructions. For the agency's own account details (login email, agency name) TripClerk is the controller.
What we store
- Agency account: agency name, contact email, login email and a securely hashed password.
- Client and traveller records entered by the agency: names, phone numbers, email addresses, booking stage, group, passport number, nationality, passport expiry date, visa status and visa expiry date.
- Passport and visa scans uploaded by the agency (JPEG, PNG, WebP or PDF, up to 10 MB each).
- Bookings and instalment amounts, due dates and whether they are paid.
- A log of which reminder emails were sent, so the same reminder is never sent twice.
Why we store it
To let agencies manage travel bookings: tracking progress, checking that passports and visas are valid for travel, and reminding the agency about upcoming and overdue payments. Our lawful basis is the contract with the agency. Agencies are responsible for having their own lawful basis (usually contract with the traveller) and for telling travellers how their data is used.
How passport and visa scans are protected
- Scans sit in private storage. They are never public and can only be opened through a link that expires after 60 seconds, issued to a signed-in member of the same agency.
- Database rules isolate each agency: one agency cannot read another agency's records or files.
- Data is encrypted in transit (HTTPS) and at rest by our hosting providers.
- We do not sell data, use it for advertising, or share it with anyone except the service providers below.
IP addresses and cookies
- We record the IP address and time when a traveller accepts their agency’s booking terms, when someone sends an enquiry through an agency page, and when a member of an agency opens a passport or visa scan. This is so the agency can show who agreed to what and who viewed sensitive files. Only that agency can see these records.
- We do not use advertising or analytics cookies, so we do not show a cookie banner. Your browser keeps your login session and a few settings (such as a dismissed tip) in local storage. These are needed for the app to work.
Service providers
Supabase (database, login and file storage), Cloudflare (website hosting) and Resend (reminder emails). They process data on our behalf under their data processing terms. Where data leaves the UK, transfers rely on the UK International Data Transfer Agreement or an adequacy decision.
Retention
- Traveller records and scans are kept until the agency deletes them or deletes its workspace. We recommend agencies delete scans once a trip is complete and any legal retention period they are subject to has passed.
- Deleting a traveller removes their record and their uploaded files immediately.
- Deleting a workspace (Settings → Delete workspace) permanently removes all of the agency's records, files and logins immediately. Encrypted backups held by our database provider roll off within their standard backup window.
Your rights
You have the right to access, correct, delete, restrict or object to the processing of your data, and to data portability. Travellers should contact their travel agency first, as the agency controls their records; we will help the agency respond. You can also complain to the Information Commissioner's Office (ico.org.uk).
Contact
Email hello@ahmadzunair.online for any privacy question or request.