Privacy Policy

This Privacy Policy explains how Emunah AI ("Emunah AI", "we", "us", or "our"), operated by Emunah, collects, uses, shares, and protects information when you use our website and services at https://emunahtrips.com (the "Service"). By using the Service, you agree to the practices described here. If you do not agree, please do not use the Service.

1. Who We Are and What Emunah AI Does

Emunah AI is an AI-assisted travel search engine. You enter a travel-related query, and we use artificial intelligence to understand your request and return relevant travel options — such as stays, flights, activities, transport, and points of interest — together with links to third-party providers and merchants.

Important: Emunah AI is a search and referral tool only. We do not sell travel products, take bookings, or process payments for travel. When you choose to book or purchase, you do so directly with the relevant third-party merchant on that merchant's own website, under that merchant's own terms and privacy policy. (See our Terms of Use.)

2. Information We Collect

We collect only what is needed to run the Service securely. What applies to you depends on whether you use Emunah AI as a guest, a registered user, or a premium subscriber.

a. Account information. When you create an account, we collect your email address and a password. Passwords are handled by our authentication provider (Supabase Auth) and are stored only in hashed (irreversible) form — we never see or store your plaintext password.

b. Subscription and payment information. If you purchase a Premium subscription, payment is processed by our payment provider, PayMongo. Emunah AI does not collect or store your full card or financial-account details. We retain only the subscription status, plan, and billing dates needed to provide and manage your subscription.

c. Search information. We process the travel queries you submit. For registered users, we may store a limited search history and any searches you choose to save, so you can revisit them.

d. Usage, device, and technical information. To operate, secure, and rate-limit the Service, we process:

• a hashed version of your IP address (a one-way hash, not your raw IP, used for rate-limiting and abuse prevention);
• a device fingerprint (a non-identifying technical signal derived from your browser/device, used to prevent abuse and enforce fair-use limits — by itself it does not identify you);
• request and usage counts (e.g., how many searches you have made in a day, to enforce tier limits);
• standard technical data such as browser type, general device information, and approximate region.

e. Security information. Where we detect abuse or policy violations, we may record security signals (such as a hashed IP, a device fingerprint, and the nature of the activity) to protect the Service and other users.

f. Cookies and analytics. See Section 7 for exactly what we use and how consent works.

We do not intentionally collect sensitive personal information (such as government IDs, health, religious beliefs, or financial-account numbers), and we ask that you not include such information in your search queries.

3. How We Use Your Information

We use the information we collect to:

• provide the core Service — understand your query and return relevant travel results;
• create, authenticate, and secure your account;
• provide, manage, and renew your Premium subscription;
• enforce fair-use limits and prevent abuse, fraud, and automated misuse, and protect the security and integrity of the Service;
• send essential service communications (for example, email verification, payment receipts, and security alerts such as a new-device sign-in notice);
• maintain, debug, and improve the Service;
• comply with legal obligations and enforce our Terms of Use.

We do not sell your personal information.

4. AI Processing of Your Queries

To interpret your travel request, your search query text is sent to our AI provider, Anthropic (the Claude model), solely to classify your intent and help generate relevant results. We send only what is needed to perform the search. Please avoid including personal or sensitive details in your queries.

5. How We Share Information

We share information only as described below. We do not sell your personal information.

a. Service providers (processors). We use trusted third parties to operate the Service. They process information only on our instructions and only to perform their function:

• Supabase — database, authentication, and hosting;
• Lovable — hosting of the website;
• Anthropic — AI interpretation of search queries;
• PayMongo — processing of Premium subscription payments;
• Cloudflare — security, bot/abuse protection, and content delivery;
• Resend — sending transactional emails (e.g., receipts, security notices);
• Google Maps Platform and Foursquare — powering location and points-of-interest features;
• Google Analytics (GA4) and Google Tag Manager — analytics, only after you consent (see Section 7).

b. Affiliate and merchant links. Emunah AI participates in affiliate programs (including, for example, Travelpayouts, Stay22, Booking.com, Agoda, 12Go, and GetYourGuide). When you click a result or link, you are taken to that third-party merchant's own website, where your information is handled under their privacy policy and terms. We may receive a commission for qualifying actions, but we do not control and are not responsible for those third parties' data practices. Please review the privacy policy of any site you visit. Hotel searches can also show a map from Stay22 inside our page, but only after you tap "Show map"; Stay22 handles what the map collects under its own privacy policy.

c. Legal and protective disclosures. We may disclose information where required by law, regulation, or legal process, or where necessary to protect the rights, property, safety, or security of Emunah AI, our users, or the public, or to investigate fraud or abuse.

d. Business transfers. If Emunah AI is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this Policy.

6. How We Protect Your Information

We apply technical and organizational measures appropriate to the data, including:

• encryption in transit (HTTPS) and encryption at rest for sensitive fields;
• storing passwords only as irreversible hashes (handled by Supabase Auth);
• row-level security and strict access controls, so records are accessible only to the account that owns them and to authorized server-side processes;
• token-based authentication with secure session handling, and an additional verification factor for administrative access;
• continuous rate-limiting and abuse detection.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Cookies & Storage Statement

We keep this statement accurate to how the Service actually works. Our Cookie Policy lists every cookie and storage item the Service uses, what each one does, and how long it lasts.

We use your browser's sessionStorage to keep you signed in during a visit (cleared when you close the tab). If you tick "Remember me" at sign-in, we instead store your session in localStorage so you stay signed in across visits until you sign out or the session expires — you can turn this off at any time by unticking "Remember me."

Analytics (Google Analytics 4, loaded through Google Tag Manager) runs only after you press OK on our cookie banner. Until then it stays off, and declining does not affect your ability to search or use the Service. Once you press OK, Google Analytics sets two cookies on our site, each lasting up to two years. You can change your choice at any time via "Cookie Settings" at the bottom of every page.

Authentication tokens are not stored in cookies. Declining analytics does not stop essential security logging, and (because affiliate tracking happens on the merchant's own site after you click) it does not affect affiliate links.

To help protect the Service from automated abuse, sign-up, sign-in, password reset, verification emails and our contact form use Cloudflare Turnstile, an invisible verification check that runs in your browser without requiring you to solve a puzzle. Turnstile's own data practices are described in Cloudflare's Turnstile Privacy Addendum.

8. Data Retention

We keep information only as long as needed for the purposes in this Policy:

• Security and rate-limiting counters (such as hashed-IP request counts and anonymous activity records) are short-lived and automatically purged on a recurring schedule (within days).
• Account information is retained while your account is active.
• Search history and saved searches are retained while your account is active and are deleted when your account is deleted.
• Security records relating to abuse or policy violations may be retained for a longer period, and certain security signals may be kept on a de-identified basis (with your account identifier removed) to protect the Service.
• Subscription and transaction records may be retained as needed for legal, tax, and accounting purposes.

When you delete your account (see Section 9), your profile, search history, saved searches, and device records are removed; de-identified security records may be retained as described above.

9. Your Rights and Choices

Subject to applicable law, including the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), you have the right to:

• access the personal information we hold about you;
• correct inaccurate information (you can update your account details in your profile);
• delete your account and associated personal data — you can do this yourself from your Account page using the account-deletion option, which permanently removes your profile and related data;
• withdraw consent for analytics at any time via "Cookie Settings";
• object to or restrict certain processing, and lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

To exercise any right you cannot complete from within the Service, contact us at support@emunahtrips.com.

10. Children's Privacy

Emunah AI is not intended for children. You must be at least 18 years old (or the age of majority in your jurisdiction) to create an account or purchase a subscription. We do not knowingly collect personal information from children under 18. If you believe a child has provided us information, contact us and we will delete it.

11. Service Location and International Use

Emunah AI is operated for users in the Philippines, and our infrastructure is hosted in a data region near the Philippines (Southeast Asia). Access from certain regions may be restricted. If you access the Service from outside the Philippines, you understand your information will be processed as described in this Policy.

12. Changes to This Policy

We may update this Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

13. Contact Us

If you have questions or requests regarding this Policy or your personal information, contact us at:

Emunah Email: support@emunahtrips.com