Privacy Policy

Effective date: 11 July 2026 | Last updated: 17 July 2026

1. Introduction

Travel Bunny Pty Ltd (ABN 20700190521, "Travel Bunny", "we", "us", or "our") provides a virtual travel assistant web application (the "Service") that helps users research, plan, and organise trips through a conversational AI interface. We are committed to protecting your privacy and handling your personal information responsibly. This Privacy Policy explains what personal information we collect, how we use and share it, how we protect it, and the choices and rights available to you. It applies to all users of the Service, wherever they are located.

We are based in Australia and primarily regulated under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Because our users may be located in the European Economic Area (EEA), the UK, or California, we also describe below how we meet obligations under the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), where those laws apply to you.

2. Information We Collect

2.1 Information you provide directly

Account information: when you sign in with Google, we receive your name, email address, and profile picture from Google.
Travel preferences and planning details: destinations, travel dates, budget, traveller numbers, accommodation and activity preferences, dietary or accessibility needs, and any other trip-related details you choose to share.
Conversation content: the messages, questions, and files you exchange with the virtual travel assistant, including any personal details you volunteer during a conversation.
Communications: information you provide when you contact us for support or feedback.
Payment information (planned): if we introduce paid plans or in-app bookings, we will collect billing details via a third-party payment processor. We do not currently store full card numbers.

2.2 Information collected automatically

Usage data: pages and features used, queries submitted, session duration, click and navigation patterns.
Device and technical data: IP address, browser type, operating system, device identifiers, and general location inferred from your IP address.
Cookies and similar technologies: used for authentication, session management, analytics, and remembering preferences, as described in Section 8.

2.3 Information from third parties

Google: when you use "Sign in with Google," Google shares limited profile information with us as authorised by you during the OAuth consent process.
Service providers: our hosting, analytics, and infrastructure providers may provide us with technical and usage data, as described in Section 5.

3. How We Use Your Information

We use personal information to:

Provide, operate, and personalise the Service, including generating travel research and itinerary suggestions;
Authenticate you and maintain your account;
Improve, test, and develop new features and AI response quality;
Communicate with you about the Service, including updates and support requests;
Monitor usage, enforce API and rate limits, and prevent misuse, fraud, or abuse;
Comply with legal obligations and enforce our Terms of Service; and
With your consent, send marketing communications (you can opt out at any time).

4. How the AI Assistant Processes Your Data

The virtual travel assistant is powered by Claude, an AI model developed by Anthropic, PBC, a third-party AI provider based in the United States. When you send a message to the assistant, the content of that message (and relevant conversation context) is transmitted to Anthropic's API for processing so the assistant can generate a response.

Travel Bunny configures the guardrails, permitted topics, and response limits that govern this integration, but the underlying language processing is performed by Anthropic's infrastructure. We do not control, and are not responsible for, Anthropic's independent processing of data outside the scope of our API agreement with them. Anthropic acts as a service provider/processor for this purpose and is contractually restricted from using data you submit to train its models, except as permitted under our commercial agreement with Anthropic.

Avoid sharing sensitive information (such as passport numbers, financial account details, or health information) in your conversations with the assistant unless it is necessary for the travel planning assistance you're requesting.

5. How We Share Your Information

We do not sell your personal information. We share personal information only in the following circumstances:

Service providers: including Anthropic (AI processing), Google (authentication), cloud hosting providers, analytics providers, and customer support tools, each bound by contractual confidentiality and data protection obligations.
Legal and safety reasons: where required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Travel Bunny, our users, or the public.
Business transfers: in connection with a merger, acquisition, restructuring, or sale of assets, subject to standard confidentiality arrangements.
With your consent: for any other purpose disclosed to you at the time of collection.

6. International Data Transfers

Because our users, service providers, and Anthropic's infrastructure may be located outside Australia, including in the United States and the EU, your personal information may be transferred to and processed in countries with data protection laws that differ from those in your home jurisdiction.

Where we transfer personal information from the EEA/UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) or equivalent mechanisms.

7. Data Retention

We retain personal information for as long as necessary to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. Retention periods vary by data type:

Account information: retained while your account is active, and for 5 years after closure.
Conversation history: retained for 5 years to improve the Service, unless you delete it sooner by requesting deletion from Travel Bunny Pty Ltd.
Usage and log data: retained for 5 years for security and analytics purposes.

8. Cookies and Tracking Technologies

We use cookies and similar technologies for authentication (keeping you signed in), essential site functionality, and analytics (understanding how the Service is used). You can control cookies through your browser settings.

For further information visit aboutcookies.org or allaboutcookies.org. You can set your browser not to accept cookies, however some features of the Service may not function as a result.

9. Data Security

We use administrative, technical, and organisational safeguards designed to protect personal information from unauthorised access, disclosure, alteration, or destruction, including encryption in transit, access controls, and regular security review of our infrastructure and vendors. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Your Privacy Rights

10.1 Australia: Privacy Act 1988

Under the Australian Privacy Principles, you may request access to and correction of the personal information we hold about you, and lodge a complaint about how we handle your information. If you're not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

10.2 European Economic Area and UK: GDPR

If GDPR applies to you, you have the right to: access your personal information; correct inaccurate data; request erasure ("right to be forgotten"); restrict or object to processing; data portability; and withdraw consent at any time where processing is based on consent. You also have the right to lodge a complaint with your local supervisory authority.

10.3 California: CCPA/CPRA

If you are a California resident, you have the right to: know what personal information we collect, use, and disclose; request deletion; request correction; opt out of the "sale" or "sharing" of personal information (we do not currently sell or share personal information for cross-context behavioural advertising); limit use of sensitive personal information; and not be discriminated against for exercising these rights.

10.4 Exercising your rights

You can exercise these rights, or ask questions about this Policy, by contacting us at joshua.l.mertens@gmail.com. We may need to verify your identity before actioning a request, and will respond within the timeframe required by applicable law.

11. Children's Privacy

The Service is not directed at children and is not intended for use by individuals under 16. We do not knowingly collect personal information from children below this age. If you believe a child has provided us with personal information, please contact us at joshua.l.mertens@gmail.com so we can delete it.

12. Third-Party Links and Services

The Service may reference or link to third-party websites, travel providers, or booking platforms. We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies before providing personal information to them.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to our practices, the Service, or legal requirements. We will post the updated version with a new "Last updated" date, and where changes are material, we will provide additional notice (such as an in-app notification or email).

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our handling of your personal information, please contact:

Travel Bunny Pty Ltd

ABN: 20700190521

10 McClure Street, Drouin 3818, Australia

Email: joshua.l.mertens@gmail.com

If you are not satisfied with our response, Australian users may contact the OAIC (oaic.gov.au); EEA/UK users may contact their local data protection authority; California users may contact the California Attorney General's office.