Privacy & Data
CCPA & US State Privacy
Rights and disclosures for California, Virginia, Colorado, Connecticut, Texas, and other US state privacy laws, including opt-out and Global Privacy Control.
Template notice. Confirm the categories and disclosures below against your production data flows with counsel.
This notice supplements our Privacy Policy for residents of US states with comprehensive privacy laws, including California (CCPA as amended by CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana.
Notice at collection
| Category of personal information | Collected | Purpose | Disclosed to |
|---|---|---|---|
| Identifiers (name, email, account ID, IP) | Yes | Account creation, authentication, support | Hosting, email, analytics vendors |
| Commercial information (subscription, transactions) | Yes | Billing, subscription management | Payment processor |
| Internet activity (pages, events, referrer) | Yes | Product analytics, service improvement | Analytics vendors |
| Geolocation (approximate, from IP) | Yes | Security, localisation | Hosting, analytics vendors |
| Professional information (role, company) | Yes | Account provisioning, sales | CRM, sales tooling |
| Inferences (product engagement scoring) | Limited | Onboarding and support prioritisation | None |
| Sensitive personal information | No | Not collected for inferring characteristics | — |
| Biometric or genetic data | No | — | — |
Traveller records inside an operator's workspace are handled by Tripistic as a service provider (California) or processor (other states) on that operator's behalf, under the Data Processing Agreement.
We do not sell or share
Tripistic does not sell personal information, and does not share personal information for cross-context behavioural advertising, as those terms are defined by the CCPA. We do not use or disclose sensitive personal information for purposes requiring a right to limit.
Consent-gated advertising measurement pixels (Meta, LinkedIn) may constitute "sharing" under some interpretations. For that reason these tags load only with your consent, and rejecting them — or sending a Global Privacy Control signal — prevents them from loading at all.
Your rights
| Right | Description |
|---|---|
| Know / access | Request the categories and specific pieces of personal information we hold |
| Delete | Request deletion, subject to legal retention exceptions |
| Correct | Request correction of inaccurate personal information |
| Portability | Receive a copy in a readily usable format |
| Opt out of sale / sharing | Prevent advertising measurement tags from loading |
| Limit use of sensitive information | Not applicable — we do not use SPI for inference |
| Non-discrimination | We will not deny service or change pricing for exercising a right |
| Appeal | Where your state provides it, appeal a denied request |
How to exercise a right
- Opt out of sale/sharing: use the Cookie preferences link in the site footer, or send a Global Privacy Control signal — we honour it automatically.
- Access, delete, correct, portability: email privacy@tripistic.com from your account address, or use the in-product export tools.
- Authorised agents: may submit requests with written permission and proof of identity.
We verify requests by matching the requesting email to an account record and, for sensitive requests, by confirming recent account activity. We respond within 45 days and may extend once by a further 45 days with notice. If we deny a request, we explain why and, where your state provides an appeal right, how to appeal — appeals are reviewed within 45 days.
Retention
We retain personal information for the periods in the retention schedule of our Privacy Policy. We do not retain personal information longer than reasonably necessary for the disclosed purpose.
Financial incentives
We do not offer financial incentives or price differences in exchange for personal information.
Requests concerning traveller data
If your personal information is held inside a tour operator's Tripistic workspace, the operator is the business or controller. Contact them directly, or contact us and we will identify and route the request to the responsible operator.
Contact
privacy@tripistic.com or the contact form.
Questions about this document?
Email legal@tripistic.com or use the contact form. Enterprise teams can request countersigned copies and completed security questionnaires.