YouCanDo Travel
Privacy Policy
Last updated:
Plain-language summary; the final text is pending legal review.
This policy explains what personal information YouCanDo Travel collects when you search for and book flights, how we use it, when we share it with airlines, and the choices and rights you have under US law, including the California Consumer Privacy Act (CCPA/CPRA). We do not sell your personal information.
On this page
1. Who we are
You Can Do Inc. ([to be confirmed]) operates YouCanDo Travel and is responsible for the personal information described here. For privacy questions or requests, write to privacy@travelycd.com.
2. Information we collect
- Contact details: the name, email address and phone number of the person booking.
- Traveler details, for each passenger: title, full name, gender and date of birth, and passport or ID details when the airline requires them.
- Booking details: your searches, itinerary, fare, extras such as bags, booking reference and booking status.
- Payments: Stripe processes your card. We receive limited details, such as the card brand, the last four digits and the status of payments and refunds.
- Account details, if you create an account: your name, email address and password (stored only in hashed form by our sign-in service).
- Device and usage data: IP address, browser and device type, pages visited, and logs needed to run and secure the service.
- Communications: emails you send us and your support conversations.
If you book for other people, please make sure they know you are sharing their details with us and point them to this policy.
3. How we use it
- To search for flights and to book, ticket, change and cancel them.
- To take payments and issue refunds.
- To send your booking confirmation, receipts and updates about your trip by email, through our email provider, Resend. We do not send text messages.
- To meet the requirements of airlines and governments. For example, the US Transportation Security Administration’s Secure Flight program requires airlines to collect each traveler’s full name, date of birth and gender for flights within, to, from or over the United States.
- To give support, prevent fraud and keep the service secure.
- To meet our legal, tax and accounting obligations and enforce our Terms of Service.
- To understand and improve the service, using analytics cookies only if you allow them.
We do not use your information for targeted advertising. If we ever send marketing emails, we will ask for your consent first, and every such email will have an unsubscribe link.
5. Travel outside the United States
When you book a flight to or from another country, your information is sent to airlines and authorities there, whose data protection laws may differ from US law. We share only what is needed for your trip.
6. Your Privacy Choices / Do Not Sell or Share My Personal Information
We do not sell your personal information or share it for cross-context behavioral advertising, as those terms are defined in the CCPA, and we have not done so in the past 12 months. Passing your details to an airline to book the flight you asked for is not a sale.
- Opt out anyway: email privacy@travelycd.com with the subject “Do Not Sell or Share”. You do not need an account. We will record your request and honor it for the future.
- Global Privacy Control: if your browser sends the Global Privacy Control (GPC) signal, we treat it as a valid request to opt out of the sale and sharing of your personal information, and we keep optional marketing cookies off in that browser. You do not need to do anything else.
- Cookies: choose which optional cookies we may use on our Cookie Preferences page.
- Sensitive personal information: we use passport and ID details, and your account login, only to book your travel and keep your account secure, as the law permits, and not to infer anything about you.
7. Your privacy rights
Depending on where you live, including California and the other US states with consumer privacy laws, you may have the right to:
- know what personal information we collect, use and disclose, and access it;
- get a copy of it in a portable format;
- correct inaccurate information;
- delete your information;
- opt out of the sale or sharing of your information, targeted advertising and profiling;
- limit the use of sensitive personal information;
- appeal if we decline your request.
We will not discriminate against you for using these rights.
8. How to make a request
Email privacy@travelycd.com from the address you booked or signed up with, and include your booking reference if you have one. We verify your identity before we act, usually by confirming that you control that email address, and we may ask for more information for sensitive requests.
We respond within 45 days. If we need more time, we may extend this by another 45 days where the law allows, and we will tell you why.
An authorized agent can make a request for you with your signed permission; we may ask you to confirm your identity with us directly.
If we decline your request, we will explain why. You can appeal by replying with “Appeal” in the subject line. We will answer in writing within the time your state’s law requires and, if you still disagree, tell you how to contact your state attorney general.
We cannot delete information that an airline or authority already holds; we will tell you whom to contact. We may also keep booking and payment records the law requires us to keep.
9. How long we keep it
We keep personal information only as long as we need it for the purposes above. Booking, payment and tax records are kept as long as the law requires, generally up to 7 years. Passport and ID details are kept only as long as needed for the booking and any change, refund or claim about it. When your account is deleted, we delete or de-identify the rest, except what the law requires us to keep.
10. Security
We protect personal information with encryption in transit, access controls and monitoring. Card numbers are handled by Stripe and never stored on our servers. No system is perfectly secure; if a data breach affects you, we will notify you as the law requires.
11. Children
You must be 18 or older to book or to create an account, and YouCanDo Travel is not directed at children under 13. Children can travel on a booking made by a parent, guardian or other adult: we then collect only the details the airline requires about the child, from that adult. We do not knowingly collect personal information directly from children under 13. If you believe a child has given us personal information, contact privacy@travelycd.com and we will delete it.
13. Categories of personal information (California)
In the past 12 months we have collected these categories of personal information, from you, from the people who booked for you, from airlines through our partner (such as booking and schedule updates), from Stripe and from your device:
- identifiers (name, email address, phone number, IP address, booking reference);
- characteristics of protected classifications (gender and date of birth, as airlines require);
- customer records and commercial information (itineraries, bookings, payments and refunds);
- internet or network activity (searches, usage and log data);
- sensitive personal information (passport or ID details when required, account login).
We disclose each category to airlines and our airline-content partner to provide the flights you book, and to our service providers for the business purposes described above. We do not sell or share any of it.
14. Changes to this policy
We will post any changes on this page and update the date at the top. If a change is material, we will tell account holders by email before it takes effect.
15. Contact
You Can Do Inc., [to be confirmed]. Email: privacy@travelycd.com.