Vayo Privacy Policy

Last updated: October 13, 2026

This Privacy Policy describes how Project Atlas AI, LLC d/b/a Vayo (“Vayo”, “we”, “us”, or “our”) collects and processes your personal information when you use Vayo (including our website, mobile app, AI assistants, and other AI-powered services), as well as other activities described in this Privacy Policy (together, the “Service”) for this Beta release. We may update this Privacy Policy from time to time, so we encourage you to check back occasionally. If we make updates to the Privacy Policy that could significantly impact our users, we will take steps to inform those users about such changes before they go into effect.

Vayo has other privacy policies for different websites and services. This one only covers the Service.

Table of Contents

Personal information we collect

Information you give us. Here's the kind of personal information you might share with us:

  • Contact information, such as your name, signature, title, email address, billing and mailing addresses, and phone number.
  • Demographic information, such as your city, state, country, and postal code.
  • Profile information, such as your waitlist join date and time, account name, bio, avatar or photo, date of birth, interests, travel preferences and history, whether you are traveling for work or personal purposes, travel profile information (e.g., government ID, passport number, loyalty program number), social media profile links, and anything else you add to your account.
  • Communications you have with us, such as when you reach out through the Service, including your chats in the Service, or get in touch by email, phone, chat, social media, or other channels.
  • Content you provide, such as your chats and inputs into the Service, emails, messages, posts, reviews, updates, documents, or other data that you share with, connect to, scan, permit access to or otherwise use with the Service. When you connect your email account(s) to the Service, we process your emails using a two-pass system: first, we retrieve message headers (such as subject lines, sender and recipient details, dates, and timestamps) to classify messages; second, for messages classified as travel-related, we retrieve the full message body to extract structured travel data (such as itineraries, confirmation numbers, and booking details). Raw message content is not retained after structured data has been extracted. Google accounts are connected to the Service through OAuth offered by Google.
  • Other information not listed here, which we'll use as described in this Privacy Policy or as explained when we collect it.
  • Information about others. When you connect a third-party account (such as email) to the Service or share communications with us, we may process personal information about other people in those communications — such as names, email addresses, travel plans, and other details of people you correspond or travel with. In addition, you may choose to provide to the Service the names, dates of birth, and travel profiles (e.g., passport or other government identification numbers, loyalty program memberships, dietary restrictions) of individuals you may travel with. Also, we may offer features that let you invite your contacts to use the Service. If you do, we may collect their contact details so we can send the invitation. We only use this information to provide and improve the Service as described in this Privacy Policy. Please don't share the information of anyone else with us unless you have their permission.

Third-party sources. We may combine the personal information you give us with personal information we get from other places, such as:

  • Affiliates, such as our parent company, subsidiaries, and affiliates.
  • Travel providers, such as airlines, hotels, global distribution system providers, and other travel-related providers.
  • Service providers that help us run the Service or our business.
  • Third-party service providers. If you connect your email or other Google account to the Service, we may receive personal information from those providers based on the permissions you grant and their terms of service and privacy policies.

Information we collect automatically. We and our service providers may automatically collect information about you, your device, and how you interact with the Service, our communications, and other online services over time, such as:

  • Device information, such as your operating system type and version, device manufacturer and model, browser type, screen resolution, memory and storage, CPU usage, device type (e.g., phone or tablet), IP address, unique identifiers (including those used for advertising), language settings, mobile carrier, network information (e.g., Wi-Fi, LTE, 3G), and general location info such as city, state, or region.
  • Location data, which may be approximate (for example, as inferred from network data or device settings) or precise (if and when you authorize the Service to access your device’s location).
  • Online activity information, such as the pages or screens you viewed, your search history, how long you spent on a page, the website you visited before coming to the Service, how you moved between pages, what you did on a page, when you visited and for how long, and whether you opened our emails or clicked links in them.

Tracking technologies. Some of the automatic collection described above uses the following technologies:

  • Cookies — small text files that websites store on your device. They let web servers track your browsing activity and remember things such as your preferences, form entries, and login status. Our sites use "session cookies” (deleted when you close your browser), “persistent cookies” (which last longer), “first-party cookies" (placed by us), and “third-party cookies" (placed by our service providers and other third parties).
  • Local storage technologies, like HTML5, which work similarly to cookies but can store more data on your device outside your browser.
  • Web beacons (also called pixel tags or clear GIFs), which help us confirm that a webpage or email was accessed or opened, or that certain content was viewed, clicked, or forwarded.
  • Session-replay technologies provided by third parties that record how you interact with the Service so we can watch video replays of user sessions. These replays capture clicks, taps, mouse movements, and scrolling. They help us find usability problems and make improvements.

How we use your personal information

We may use your personal information for the following purposes, or as otherwise explained when we collect it:

Service delivery and operations. We may use your personal information to:

  • provide and run the Service (including scanning, analyzing, and processing your communications using AI and machine learning to understand context, find relevant information, and create suggested responses or other outputs for you);
  • process your requests;
  • connect your third-party accounts to the Service and access content from those accounts based on the permissions you grant;
  • enable security features of the Service;
  • personalize the Service, such as generating derived data from your information, including trip clusters, recurring-trip patterns, travel preferences, and other insights, and remembering the devices you have logged in from and your selections and preferences;
  • establish and maintain your user profile on the Service, including developing and maintaining: (a) a structured profile layer, which serves as the source of truth and contains verified facts extracted from your connected accounts and information you provide (such as travel history, preferences, and booking details); and (b) an AI-generated narrative layer, which is a cached summary derived and inferred from the structured profile layer and is used to personalize your experience with the Service as explained above;
  • keep you in the loop about the Service, including sending announcements, updates, security alerts, messages between users, and support and administrative messages;
  • understand your needs and interests, and tailor your experience with the Service and our communications;
  • provide support for the Service;
  • respond to your requests, questions and feedback;
  • analyze usage;
  • improve the Service;
  • help you invite contacts to join the Service;
  • collect and share user testimonials; and
  • help prevent fraud and keep things secure.

Research and development. We may use your personal information and data we derive from it (including aggregated, anonymized, de-identified, or synthetic data) for research and development and to improve our products and services, including training our AI models, to the extent allowed by this Privacy Policy and applicable rules for accessing third-party APIs. Notwithstanding the foregoing, Vayo's use and transfer to any other app of information received from Google APIs (“Google user data”), including data obtained from Gmail, adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: (i) Google user data is accessed and used only to provide and improve user-facing features that are prominent in the Service's user interface; (ii) Google user data is not used to serve advertisements; (iii) Google user data is not used to train generalized or third-party artificial intelligence or machine learning models; (iv) Google user data is not transferred to third parties unless (a) necessary to provide or improve user-facing features that are prominent in the Service's user interface, (b) you provide affirmative consent, (c) necessary for security purposes (e.g., investigating abuse), or (d) required to comply with applicable law; and (v) human access to Google user data is limited to the minimum necessary and only occurs (a) with your affirmative consent, (b) for security purposes, (c) to comply with applicable law, or (d) when the data has been aggregated and anonymized for internal operations. Personal information, including communications processed through the Service, may also be shared with third-party AI providers to help deliver the Service. However, we require those providers by contract not to use your personal information to train their own AI models. We may use and share aggregated, anonymized, de-identified, or synthetic data with third parties for any lawful business purpose. We do not attempt to reidentify de-identified information derived from personal information, except for the purpose of testing whether our de-identification processes comply with applicable law.

Compliance and protection. We may use your personal information to:

  • comply with applicable laws and legal process, such as to respond to subpoenas, court orders, investigations or requests from government authorities;
  • protect our, your, or others’ rights, privacy, safety, or property (including by making and defending legal claims);
  • audit our internal processes for compliance with legal and contractual requirements or our internal policies;
  • enforce the terms and conditions that govern the Service; and
  • prevent, identify, investigate and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks and identity theft.

With your consent. By connecting your third-party service account to the Service and enabling our AI features, you expressly consent to our access, collection, and processing of your third-party service account data, including communications, such as the content of messages sent and received, for the purposes described in this Privacy Policy, and confirm that you have all rights and permissions to permit our access, collection, and processing of your third-party service account data. You further understand and consent that such third-party service account data, specifically travel-related communications and associated content, may be viewed by Vayo personnel as necessary to provide the Service. You may withdraw your consent at any time by deleting your account or, as to each third-party service account, by disconnecting those third-party service accounts from the Service through your profile and settings, as further described in the Your choices section below. In addition, in some cases, we may specifically ask for your consent to collect, use, or share your personal information for further purposes, if those purposes are not compatible with the initial purpose for which that personal information was collected.

Cookies and similar technologies. On top of the uses described above, we may use cookies and similar technologies for the following:

  • Technical operation. To keep the Service running smoothly, such as remembering your selections as you navigate the site and whether you're logged in.
  • Functionality. To make the Service work better for you.
  • Analytics. To help us understand how people use the Service, including how many users visit, which pages are most and least popular, how users move around the Service, and how they interact with our emails.

How we share your personal information

We may share your personal information with the following parties, as well as in other ways described in this Privacy Policy, in other notices, or when we collect the information.

Affiliates. Our parent company, Booking Holdings Inc. (BHI), subsidiaries, and affiliates might have access to personal information. Visit https://www.bookingholdings.com/ for more information about these companies.

Service providers. Third parties that help us run the Service or our business, such as those providing hosting, authentication, internet services, IT, customer support, chat features, email delivery, consumer research, and website or data analytics.

Artificial intelligence platforms. We use third-party AI providers to power certain features of the Service, including analyzing communications from accounts you have connected. To do this, your communications content and related personal information — including data we derive from those communications — may be sent to and processed by these AI providers. We require these providers by contract to process your personal information only as needed to provide services to us, not to retain it longer than necessary, and not to use it to train their own AI models.

Third parties you choose. We may share your personal information with other third parties when you ask us to or give us permission.

Linked third-party services. If you log into the Service with, or link your account to, a social media or other third-party service (such as Google), we may share your personal information with that service. How they use the shared information is governed by their privacy policy and your account settings with them.

Professional advisors. Lawyers, auditors, bankers, insurers, and similar professionals, when needed for the services they provide to us.

Authorities and others. Law enforcement, government authorities, and private parties in legal disputes, when we believe in good faith it's necessary for the compliance and protection purposes described above.

Corporate transactions. We may share personal information in connection with actual or potential business transactions (e.g., investments, financings, public offerings, or the sale, transfer, or merger of all or part of our business, assets, or shares), as well as in the event of insolvency, bankruptcy, or receivership. For example, we may need to share certain personal information with potential buyers or partners and their advisors. In these situations, personal information may be transferred to one or more third parties as part of our business assets.

We make commercially reasonable efforts to verify that the parties with whom our mobile application shares personal information provide a level of protection of personal information consistent with the practices described in this Privacy Policy, except that all such parties described above other than service providers and affiliates may, to the extent permitted by law, use personal information as described in their own privacy policies.

Your choices

This section explains the choices you have.

Access or update your information. If you have an account with us, you can review and update your account information by logging in and going to your profile and settings. For example, you may correct your profile information in the following ways: (a) fact corrections, which overwrite incorrect data with corrected data (a history of the correction is retained); (b) inference corrections, which annotate an AI-generated inference as inaccurate without erasing the underlying source data; and (c) narrative dismissals, which suppress a particular AI-generated framing or characterization without deleting the underlying facts. You may withdraw your consent at any time by deleting your account or, as to each third-party service account, by disconnecting those third-party service accounts from the Service through your profile and settings.

Opt out of communications. You may opt out of non-essential service communications (such as product announcements and feature updates) by adjusting your notification preferences in your profile and settings or by contacting us. You will continue to receive transactional and security-related communications necessary for the operation of your account.

Cookies. Most browsers let you remove or block cookies. Check your browser settings for instructions. Many browsers accept cookies by default until you change your settings. If you disable cookies, the Service may not work properly. For more information about cookies, including how to see and manage them, visit http://www.allaboutcookies.org.

Blocking images/clear GIFs. Most browsers and devices let you prevent images from loading, which stops the sender from knowing you viewed a page. Check your browser or device settings for instructions.

Do Not Track. Some browsers can send “Do Not Track” signals to websites you visit. We currently don't respond to these signals. To learn more, visit http://www.allaboutdnt.com.

Training data. As explained in the How We Use Personal Information section, we may use your personal information to train our AI models and for other machine learning purposes; however, Google user data is not used for this purpose. You have the option to opt out of the use of your personal information for training our AI models by contacting us.

Declining to provide information. We need certain personal information to provide some of our services. If you don't provide the information we mark as required, we may not be able to offer those services to you.

How long we keep your personal information. We generally keep personal information for as long as we need it for the purposes we collected it, including to meet any legal, accounting, or reporting requirements, to establish or defend legal claims, and to prevent fraud. When deciding how long to keep personal information, we consider things like: how long we have a relationship with you and provide services to you; the type and sensitivity of the information; the risk of harm from unauthorized use or disclosure; whether we can achieve our purposes another way; any legal obligations we have (for example, some laws require us to keep transaction records for a set period); and our legal position regarding things like statutes of limitations, litigation, or regulatory investigations. For example, we will keep your account and profile information for as long as your account is active, and will delete it from our production database within thirty (30) days of an account deletion request, subject to any requirements or needs related to legal, accounting, or reporting requirements, legal claims, or fraud. When we no longer need your personal information, we will either delete it or de-identify it.

Other sites and services

The Service may contain links to websites, apps, and other online services run by third parties. Our content may also appear on websites or services that aren't connected to us. The Service also lets you connect third-party accounts (such as Google, Microsoft, Yahoo, or other providers) to use our AI-powered features. Your use of those third-party services is subject to their own terms and privacy policies, and we encourage you to review them. These links and integrations don't mean we endorse or are affiliated with any third party. We don't control third-party websites, apps, or online services, and we're not responsible for how they operate. We encourage you to read the privacy policies of other websites, apps, and online services you use.

Security

We use technical, organizational, and physical safeguards designed to protect the personal information we collect. That said, no internet or information technology system is completely secure, and we cannot guarantee the security of your personal information.

International data transfers

We are based in the United States and may use service providers in other countries. The Service is intended only for individuals in the United States. If you are located outside of the United States, your personal information may be transferred to, stored in, and processed in the United States or other jurisdictions where privacy laws may not offer the same level of protection as in your home country. Where required by applicable law, we will implement appropriate safeguards (such as standard contractual clauses or other lawful transfer mechanisms) to protect your personal information in connection with such transfers. By using the Service, you acknowledge and consent to such transfers to the extent permitted by applicable law. If you are located in the United Kingdom or the European Economic Area, please also see the "Notice to European Users" section below for additional information about these transfers and your rights.

Children and Teens

The Service is not meant for anyone under 18 years old. If you are a parent or guardian and believe we have collected personal information from or about a minor in a way that is not allowed by law, or if information was provided on your behalf when you were under 18, please contact us. If we find out that we have collected personal information from a minor through the Service without proper parental or guardian consent as required by law, we will comply with applicable legal requirements to delete the information.

Notice to European Users

Where this notice applies. The information in this "Notice to European Users" section applies only to individuals in the United Kingdom and the European Economic Area (together, "Europe").

References to "personal information" in this Privacy Policy should be understood to include a reference to "personal data" (as defined in the GDPR) — that is, information about an individual who is either directly identified or identifiable from that information.

Controller. Vayo is the controller in respect of the processing of your personal information covered by this Privacy Policy for purposes of European data protection legislation (i.e., the EU General Data Protection Regulation and the UK General Data Protection Regulation, together with the UK Data Protection Act 2018, as and where applicable, the "GDPR"). See the "How to contact us" section below for our contact details.

Our legal bases for processing

In respect of each of the purposes for which we use your personal information, the GDPR requires us to ensure that we have a "legal basis" for that use. Our legal bases are:

  • Where we need to perform a contract we are about to enter into or have entered into with you ("Contractual Necessity").
  • Where it is necessary for our legitimate interests and your interests and fundamental rights do not override those interests ("Legitimate Interests").
  • Where we need to comply with a legal or regulatory obligation ("Compliance with Law").
  • Where we have your specific consent to carry out the processing for the purpose in question ("Consent").

The list below sets out the legal bases we rely on for each purpose. For more information on these purposes and the data types involved, see "How we use your personal information" above.

  • Service delivery and operations. Contractual Necessity. Categories involved: contact information, demographic information, profile information, communications, content you provide, information about others, device information, location data, and online activity information.
  • Security. Compliance with Law and Legitimate Interests. We have a legitimate interest in ensuring the ongoing security and proper operation of the Service and associated IT services, systems, and networks. Categories involved: the same as for service delivery and operations.
  • Personalization, profile building, and service improvement (including the structured profile layer and AI-generated narrative layer). Consent, where required by applicable law, and Legitimate Interests. We have a legitimate interest in providing you with a good service that is personalized to you and that remembers your selections and preferences. Categories involved: the same as for service delivery and operations.
  • Research and development, including training our AI models. Legitimate Interests. We have a legitimate interest in improving the Service, and believe doing so is also in your interest. Categories involved: content you provide, profile information, communications, and aggregated, anonymized, de-identified, or synthetic data derived from them.
  • Compliance and protection. Compliance with Law and Legitimate Interests. Where Compliance with Law is not applicable, we have a legitimate interest in participating in, supporting, and following legal process and requests, including through co-operation with authorities, and in ensuring the protection, maintenance, and enforcement of our and others' rights, property, and safety. Categories involved: the same as for service delivery and operations.

Other information

Sharing with third-party AI providers. As described in the "How we use your personal information" and "How we share your personal information" sections above, we share personal information with third-party AI providers to help deliver the Service. We require these providers by contract to process your personal information only as needed to provide services to us, not to retain it longer than necessary, and not to use it to train their own AI models.

No automated decision-making and profiling. As part of the Service, we do not engage in automated decision-making and/or profiling which produces legal or similarly significant effects concerning you.

Your rights

General. European data protection laws give you certain rights regarding your personal information. If you are located in Europe, you may ask us to take the following actions in relation to your personal information that we hold:

  • Access. Provide you with information about our processing of your personal information and give you access to your personal information.
  • Correct. Update or correct inaccuracies in your personal information.
  • Delete. Delete your personal information where there is no good reason for us continuing to process it — you also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
  • Transfer. Transfer a machine-readable copy of your personal information to you or a third party of your choice.
  • Restrict. Restrict the processing of your personal information, for example if you want us to establish its accuracy or the reason for processing it.
  • Object. Object to our processing of your personal information where we are relying on Legitimate Interests — you also have the right to object where we are processing your personal information for direct marketing purposes.
  • Withdraw consent. When we use your personal information based on your consent, you have the right to withdraw that consent at any time.

Exercising these rights. You may submit these requests by emailing support@vayo.com or by using the contact details provided in the "How to contact us" section below. We may request specific information from you to help us confirm your identity and process your request. Whether we are required to fulfill any request you make will depend on a number of factors (e.g., why and how we are processing your personal information); if we reject any request (in whole or in part), we will let you know our grounds for doing so, subject to any legal restrictions.

Your right to complain. Depending on where you are located, you may also have a right to complain to us if you are not satisfied with our handling of your personal information. You can submit a complaint to us by emailing support@vayo.com. We will reply to your request as soon as we can.

Your right to lodge a complaint with your supervisory authority. In addition to your rights outlined above, if you are not satisfied with our response to a request you make, or how we process your personal information, you can make a complaint to the data protection regulator in your habitual place of residence.

Data processing outside Europe

We are a U.S.-based company, and many of our service providers, advisors, partners, or other recipients of data are also based in the U.S. This means that, if you use the Service, your personal information will necessarily be accessed and processed in the U.S. It may also be provided to recipients in other countries outside Europe.

It is important to note that the U.S. is not the subject of an "adequacy decision" under the GDPR — in other words, the U.S. legal regime is not considered by relevant European bodies to provide a level of protection for personal information equivalent to that provided by relevant European laws.

Where we share your personal information with third parties based outside Europe, we try to ensure a similar degree of protection is afforded to it by making sure one of the following mechanisms is implemented:

  • Transfers to territories with an adequacy decision. We may transfer your personal information to countries or territories whose laws have been deemed to provide an adequate level of protection for personal information by the European Commission or UK Government (as and where applicable), from time to time.
  • Transfers to territories without an adequacy decision. We may transfer your personal information to countries or territories whose laws have not been deemed to provide such an adequate level of protection (e.g., the U.S., see above). However, in these cases, we may use specific appropriate safeguards designed to give personal information effectively the same protection it has in Europe — for example, standard contractual clauses approved by the relevant authorities for this purpose — or, in limited circumstances, we may rely on an exception, or "derogation," which permits us to transfer your personal information to such a country despite the absence of an adequacy decision or appropriate safeguards, for example, reliance on your explicit consent to that transfer.

You may contact us if you want further information on the specific mechanism we use when transferring your personal information out of Europe. You may have the right to receive a copy of the appropriate safeguards under which your personal information is transferred by emailing support@vayo.com.

Changes to this Privacy Policy

The "Last updated" date at the top of this Privacy Policy shows when it was last revised. We may update this Privacy Policy at any time. When we do, we will change the “Last updated" date. Depending on the type of change, we may also notify you directly or ask for your consent. Any changes take effect when we post the updated version, unless we say otherwise.

How to contact us