Home › Privacy policy
Privacy policy
Last updated 12 November 2026
This policy covers aitravelcraft.com, the diagnostic form, the demo widget and the trip engine at api.aitravelcraft.com. AITravelCraft is a service of Highland Travel Group Ltd (“we”).
1. Two different roles
- Our own website and sales. When you browse this site or book a diagnostic, we decide how your data is used: we are the controller.
- Services we run for operators. When we run an enquiry desk, widget or website for a tour operator, that operator is the controller of their customers’ data and we are their processor, acting on their instructions under a data processing agreement. See Data processing.
2. What we collect on this site
- Diagnostic form: your name, business name, email, and anything else you choose to tell us (phone, WeChat, website, team size, how you work today). We use it to reply and prepare for the call. Lawful basis: steps at your request before a contract, and our legitimate interest in replying to business enquiries.
- Demo widget: the text you type is sent to our trip engine to produce suggestions. We do not ask for your name or contact details in the widget. To prevent abuse, the engine keeps a daily counter keyed to a one-way hash of your IP address and the date, which cannot be turned back into your IP and changes every day.
- Server logs: our hosting provider records technical data (such as IP address and browser) to keep the site secure.
- We do not use advertising cookies or third-party trackers on this site.
3. Who we share it with
We use these providers to run the site and the services. Some are outside the UK; where they are, we rely on adequacy regulations or standard contractual clauses (the UK International Data Transfer Addendum).
| Provider | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Website hosting, CDN and the trip engine (Workers) | Global edge network; US company |
| Contabo GmbH | Virtual server hosting the enquiry database and inbox (form.highland-travel.com) | United Kingdom (server location) |
| DeepSeek | AI model used to draft itineraries and replies | China |
| Agnes AI | Back-up AI model used if the primary model is unavailable | Outside the UK |
| Resend | Sending notification emails | US |
| Telegram | Internal notification of new enquiries to the operator | Outside the UK |
| Stripe | Deposit and balance payments, contracted directly by each operator under their own Stripe account | Ireland / US |
We do not sell personal data.
4. How long we keep it
Diagnostic requests: up to 24 months after our last contact, unless you become a client, in which case we keep business records for as long as the law requires. Engine counters: a few days.
5. Your rights
You can ask for a copy of your data, ask us to correct or delete it, object to or restrict how we use it, and ask for it in a portable format. To do so, reply to any email we have sent you or use the form and say what you need. You can also complain to the UK Information Commissioner’s Office (ico.org.uk).
6. Changes
We will update this page if anything changes and show the new date at the top.