Privacy Policy

1. Data collected

• Identity: last name, first name, title, ID document number and photos (national ID or driver’s license).
• Contact: email address, phone number.
• Bookings: trips, seats, transactions.
• Connection and device (including when you use the app without an account): IP address, city and network operator derived from it on our servers, device technical identifier, platform, session timestamps.

2. Use of data

• Account management and authentication.
• Processing and confirming your bookings.
• Sending notifications related to your trips.
• Improving our services and preventing fraud.
• Meeting our legal and regulatory obligations.
• No use for advertising purposes without explicit consent. Your data is never transferred to third parties for commercial purposes.

3. Security data

• For security and fraud-prevention purposes, we log your connections: IP address, city and network operator derived from it, device technical identifier and session timestamps.
• At boarding, your ticket scan is logged (time, station, company, agent); the agent’s device location may be recorded to verify the place of the check.
• This data is accessible only to authorized TravelBook staff and may be shared with competent authorities upon legal request, in accordance with Burkina Faso law.

4. Retention and security

• Your data is kept for the lifetime of your account; security data (connections, scans) is kept for a maximum of 12 months.
• Transactions are kept in accordance with legal obligations.
• All data is encrypted in transit (TLS) and at rest. Our servers are hosted in the European Union.
• Payments are handled by electronic money issuers licensed by the BCEAO and compliant with international standards (PCI-DSS); TravelBook stores no payment data.

5. Your rights

• Your data is processed under Law No. 001-2021/AN of 30 March 2021 (Burkina Faso) and, for EU users, the GDPR.
• Right of access: view your data from your profile.
• Right to rectification: update your information at any time.
• Right to erasure: request account deletion — see the Account deletion page.
• Right to portability: export your data on request.
• Right to object: refuse certain non-essential processing.
• To exercise your rights: support@gettravelbook.com. In case of difficulty, you may refer the matter to Burkina Faso’s Data Protection Authority (CIL).

6. Service providers

We never sell data. The providers below only receive what their service requires, under their terms of service. No IP address is sent to any geolocation service: the city and network operator of a connection are derived on our servers using the DB-IP database (CC BY 4.0 license).

• Supabase (database and file hosting, Ireland, European Union): all account and booking data.
• Vercel (website and company console hosting): technical connection data for the website.
• DeepSeek (Kora and Sira assistants): the text of your questions, after masking first and last names, phone numbers, email addresses and ID numbers. This provider processes data outside the European Union.
• Google: route calculation (your position and the destination station, only when you request a route) and push notifications (device identifier and notification content).
• Meta (WhatsApp) and Twilio (SMS): your phone number and the message content (verification code, departure reminder).
• Resend (email): your email address and the message content.
• LigdiCash and electronic money operators: phone number, amount and payment reference.
• Open-Meteo: city names only, to place trips in the assistants’ answers; no personal data.