Concierra Privacy Policy (DRAFT)

⚠️ ATTORNEY REVIEW REQUIRED BEFORE USE — NOT LEGAL ADVICE

This is an AI-drafted starting point, prepared 2026-09-15 to save your attorney time, not a finished, publishable policy. It has not been reviewed by a lawyer. Every bracketed [placeholder] needs a real answer; several sections are written two ways because a real business decision (see §5 below) hasn't been made yet and materially changes what this policy has to say. See docs/reviews/legal-review-2026-09-14.md for the full legal issues-spotting review this draws on, and the "Known gaps this draft creates" section at the very end of this file before anyone reads this policy expecting it to be live.

Effective date: [DATE — do not publish until this is a real date] Last updated: 2026-09-15

1. Who we are

Concierra ("Concierra," "we," "us," "our") operates concierra.[ai/com — confirm domain] and the Concierra chat assistant (together, the "Service"), an AI-assisted vacation-planning tool currently focused on Universal Orlando, with Walt Disney World planned.

[COMPANY LEGAL NAME], a [STATE] [entity type — LLC/Corp], located at [BUSINESS ADDRESS]. If you have questions about this policy or your data, contact us at [PRIVACY EMAIL, e.g. privacy@concierra.ai].

2. Who this policy covers

This policy applies to anyone who uses the Service, whether or not you create an account: browsing the site, chatting with the Concierra assistant, or submitting a booking request. It does not apply to third-party sites or services we link to or recommend (hotels, airlines, ticket providers, our booking partners) — their own privacy practices govern data you give directly to them.

This Service is intended for adults (18 or older) planning trips for themselves and their families. It is not directed to children, and we do not knowingly collect personal information directly from a child under 13 through the Service. Section 8 explains this in more detail, including the difference between a parent telling us about their child and a child using the Service themselves.

3. Information we collect

3.1 Information you (or a parent/guardian in your travel party) give us

• Contact information: name, email address, phone number — collected when you save a trip, sign in, or submit a booking request.
• Family and travel-party details, shared naturally through conversation with the Concierra assistant: names, ages, home airport, budget, and — because it affects which rides and experiences we can responsibly recommend — heights, mobility needs, sensory needs, and dietary needs of every member of your travel party, including children. We treat this as sensitive information; see §3.3.
• Trip preferences: dates, destinations, pace preferences, and anything else you tell the assistant that helps plan your trip ("wants to ride Hagrid's first," "no early mornings," etc.).
• The content of your conversation with the Concierra assistant.
• If you sign in with Google, Facebook, or Apple: your name, email address, and profile photo (if available), as provided by that provider, subject to your privacy settings with them.

3.2 Information collected automatically

• A session identifier stored in a cookie on your device, used to recognize you across visits so you don't have to repeat information you've already given us.
• If you sign in, a separate, encrypted sign-in session cookie.
• Standard technical information (IP address, browser type, pages visited) collected by our hosting and security infrastructure.

We do not currently use third-party advertising trackers or sell advertising on the Service.

3.3 Sensitive information — heights, mobility, sensory, and dietary needs

Some of what we ask about — mobility needs, sensory needs, dietary needs — is treated as sensitive personal information under several U.S. state privacy laws when it relates to a health condition. We collect this only because it directly determines which attractions, accommodations, and plans we can safely and appropriately recommend for your family — for example, a height requirement for a ride, or a need for step-free access.

We ask for your affirmative agreement before recording this kind of detail about a specific person in your party (for example, the assistant will ask something like "Is it okay if I note that [name] uses a mobility device, so I only suggest attractions they can enjoy?" before saving it). You can decline to share this information, though it may limit how specific our recommendations can be. [GAP — see "Known gaps" at the end of this file: this consent flow does not exist in the product yet as of this draft and needs to be built before this section is accurate.]

4. How we use your information

We use the information above to:

• Research and recommend a vacation package tailored to your family — flights, hotel, tickets, and add-ons — with an honest, itemized, door-to-door total.
• Build and remember your family's profile so you don't have to repeat yourself in later conversations.
• Prepare a booking request for our booking team (or our fulfillment partner — see §5) to complete, once you approve a recommendation.
• Communicate with you about your trip, including price changes, rule changes, and day-of planning.
• Operate, maintain, and improve the Service, including troubleshooting and security.
• Comply with legal obligations, including those of a Seller of Travel registrant in the states where we're required to register (see §11).

We do not use your family's sensitive information (§3.3) for advertising, and we do not use it for any purpose beyond planning your trip and communicating with you about it.

5. How we share your information — [DECISION-DEPENDENT SECTION]

This section must be finalized once the fulfillment-model decision is made — see docs/reviews/legal-review-2026-09-14.md §8 for the tradeoffs. Both versions are drafted below; delete the one that doesn't apply.

We share information with the following categories of recipients:

• AI service providers. Your conversation with the Concierra assistant is processed by OpenRouter and the underlying AI model provider it routes requests to, in order to generate responses. [Confirm the specific provider(s)' data-retention/training policy before publishing — see legal review §6.]
• Booking and travel-supplier platforms. To search and price real hotel and flight options, we send trip details (dates, party size, ages) — but not your family's sensitive information from §3.3 — to LiteAPI, our hotel and flight search/booking platform.
• [IF THIRD-PARTY FULFILLMENT MODEL] A registered, authorized travel-booking partner who completes your booking on our behalf once you approve a recommendation. We share the information necessary for them to complete your booking, including guest names, approximate dates of birth, and contact information. We do not sell your information — we do not exchange your personal information for money or other valuable consideration for any purpose other than completing your travel booking. [This sentence is doing real legal work — see legal review §2.3 and §7 on why a commission-compensated lead handoff can look like a "sale" of personal information under state law, and confirm the actual commercial arrangement with counsel before publishing this claim.]
• [IF DIRECT API-BOOKING MODEL] Airlines, hotels, and other travel suppliers, and the payment processor we use to collect payment, as necessary to complete a booking you've approved. For flights specifically, this includes travel-document details (passport number, nationality, document expiry) for each traveler, collected separately at the time of booking.
• Our booking operations team, to review and complete approved booking requests. [Currently implemented as an internal notification system — confirm the actual production destination before publishing; see "Known gaps" below.]
• Service providers who help us operate the Service (hosting, analytics, customer support tools), under contractual obligations to protect your information and use it only as we direct.
• Legal and safety reasons: if required by law, or to protect the rights, property, or safety of Concierra, our users, or others.
• Business transfers: if Concierra is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

We do not sell your personal information to third parties for their own marketing purposes, and we do not share your family's sensitive information (§3.3) with anyone except as necessary to plan and complete your trip.

6. Your privacy rights

Depending on where you live, you may have some or all of the following rights regarding your personal information:

• Right to know / access what personal information we have about you.
• Right to delete your personal information, subject to certain exceptions (for example, information we need to retain for a completed booking or to comply with the law).
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of your personal information, and the right to limit use of sensitive personal information, where applicable.
• Right to non-discrimination for exercising any of these rights.

To exercise these rights, contact us at [PRIVACY EMAIL]. We will verify your request before acting on it. [GAP — see "Known gaps": there is currently no automated way to fulfill a deletion request; this needs to be built, and a response-time commitment (e.g., "within 45 days") added here once it is, per CCPA-style requirements.]

If you're a California resident, our "Do Not Sell or Share My Personal Information" mechanism is [LINK/DESCRIPTION — required if §5's third-party-fulfillment sharing is legally a "sale" or "share"]. If any member of your travel party is under 16, we do not sell or share their personal information without opt-in consent, and we do not sell or share a Maryland resident's sensitive personal information or a known minor's personal information under any circumstances.

7. Children's privacy

The Service is intended for use by adults planning trips for their families, and is not directed to children. We understand that as part of planning a family trip, a parent or guardian will tell us details about their children — this is information collected about a child from a parent or guardian, not information collected directly from a child using the Service. By sharing information about a minor in your travel party, you represent that you are that child's parent or legal guardian, or are otherwise authorized to share this information on their behalf.

If we become aware that a child has been directly interacting with the Service on their own (for example, typing into the chat without a parent present), we will stop collecting further information in that conversation and ask that a parent or guardian take over. If you believe a child has provided us information directly, contact us at [PRIVACY EMAIL] so we can address it.

8. AI disclosure

The Concierra assistant you chat with is an AI system, not a human being, and is never the human concierge assigned to your trip. Recommendations and prices the assistant gives you are checked against our rules engine before being shown, but the assistant's phrasing and explanations are AI-generated. A named human concierge reviews your recommendation before you approve it, and completes your actual booking.

9. Cookies

We use strictly necessary cookies to keep you recognized across visits (a random session identifier) and, if you sign in, to keep you signed in securely. We do not currently use advertising or cross-site tracking cookies. [If this changes, this section and a cookie consent banner need to be added.]

10. Data retention and security

We retain your information for as long as needed to plan and complete your trip, respond to you, and comply with our legal obligations. [GAP — see "Known gaps": a specific retention schedule needs to be set and documented here; none currently exists.]

We use reasonable technical and organizational measures to protect your information. [GAP — see "Known gaps": data is currently stored unencrypted; this needs to be fixed, or this sentence needs to be made more specific/limited, before publishing.]

11. Seller of Travel disclosures

[STATE-SPECIFIC DISCLOSURES REQUIRED — see legal review §1. Once registered:]

• Florida Seller of Travel Registration No. [NUMBER].
• California Seller of Travel Registration No. [NUMBER], if applicable.
• California residents: transactions with Concierra are not covered by the California Travel Consumer Restitution Fund, which is available only for transactions with California-located sellers of travel. [Required disclosure if Concierra is not California-located — confirm.]

12. Changes to this policy

We may update this policy from time to time. If we make material changes, we'll notify you (for example, by posting a notice on the Service or emailing you) before the change takes effect.

13. Contact us

[COMPANY LEGAL NAME] [BUSINESS ADDRESS] [PRIVACY EMAIL]