Privacy Policy

Last updated: October 5, 2026

1. Introduction

This Privacy Policy ("Policy") describes how Charlowtown Ltd. ("Company", "we", "us" or "our") collects, uses, stores and shares personal data through Triputary at triputary.com and its related services (the "Service"). Charlowtown Ltd. is responsible for the personal data it controls. Contact us at [email protected].

This Policy is a notice about our data practices, not a request for blanket consent. Where consent is the appropriate legal basis, we will ask for it separately and you may withdraw it subject to applicable law.

2. Information We Collect

We collect the categories below when needed for the purposes described in this Policy. Required account or feature information is identified when requested; if you do not provide it, we may be unable to create your account or complete that feature. Additional profile details, submitted sources, media and publication are optional. Avoid including sensitive information, credentials or personal information about others that you are not authorised to provide.

Account and Registration Data

Account data may include your email address, username, password verifier, public account identifier, verification status, account timestamps, and account status. We do not store your password in readable form.

User Profile Data

Profile data includes your username and, if you provide them, a biography and an avatar you upload or set in your account, plus language, appearance and onboarding preferences. Your username, chosen avatar and information you publish can be visible with your profile, public trips or collaboration activity. Identity-provider sign-in may supply an account identifier, verified email and available name or profile information. We do not use your provider email or provider avatar as your public profile identity.

Trip and Itinerary Data

Trip and planning data may include destinations, travel dates, accommodation, traveller counts, budget, interests and other preferences; itinerary text, notes, places, routes and schedules; cover media and tags; and visibility, sharing, versions, saves, collaboration, stars, clones and publication details. We use the information relevant to the planning, sharing or booking-search feature you request.

Media and Upload Data

Source and media data may include uploaded images or other supported files; links, text and instructions you submit; source titles and text, captions or audio-derived transcripts retrieved for a requested analysis; extracted places and generated results; and file details, processing status and safety or publication-review results. Source material can contain information about you or others even when it is publicly available.

Location and Geographic Data

We process place names, addresses, coordinates, routes, transport preferences and related planning inputs that you enter, select or submit in source material. Travel dates and locations can reveal personal information such as accommodation or movements. The current browser application does not request continuous real-time device location. Map and place providers may also receive search or map-view context and standard network information when their features load.

Usage and Activity Data

Activity data may include sign-ins, security events, trip and sharing actions, public-content interactions, TripPoints balances and ledger events, referral codes and claims, and the offer, source surface, and time of an affiliate-link click.

Device and Technical Data

Our systems and service providers may process standard request, device, network, security, and diagnostic information such as IP address, browser type, request details, referring page, timestamps, and error records.

Authentication Tokens

We process session credentials, verification and password-reset credentials, expiry information, and related security records. The browser application stores authentication credentials locally on your device so you can remain signed in.

3. How We Collect Information

We collect information through the following means:

Directly from you: when you register, complete a profile, create or edit trips, submit source material, upload media, share or interact with content, claim rewards, or contact us.

Automatically: when the Service records sign-ins, requests, errors, security events, feature usage and processing results, or exchanges information needed to load maps and other requested content.

From providers you choose or request: for example, an identity provider you select, external content you ask us to retrieve, or place, routing, and transport services needed to complete a feature.

4. How We Use Your Information

Where applicable law requires a legal basis, account management, saved trips, requested planning, collaboration and TripPoints administration rely on performing our contract with you. Security, fraud prevention, proportionate moderation, troubleshooting and service improvement rely on our legitimate interests in operating a reliable service, balanced against your rights. Records or disclosures required by law rely on legal obligations. Optional processing that requires consent relies on a separate choice, which you may withdraw; this Policy does not supply that consent.

Service Delivery: to create and manage your account, store and display your trips, process your itineraries, enable sharing and collaboration features, and deliver the core functionality of the Service.

Automated and Assisted Features: to organise inputs you submit, identify possible places, generate planning suggestions, calculate routes, and support safety or publication review.

Content Moderation: to automatically assess uploaded images for compliance with our content standards using automated content analysis, to assess content safety, and to enforce our content policies including restricting upload capabilities for repeat violators.

Security and Fraud Prevention: to detect and prevent unauthorised access, to monitor for suspicious activity through audit trails, to enforce account lockout policies after repeated failed login attempts, and to maintain the integrity and security of the Service.

Communication: to send you transactional emails such as email verification notices, password reset links, and important service announcements. We do not send marketing or promotional emails.

Service Measurement: to assess usage, diagnose technical issues, prevent abuse and make product decisions, including using aggregated or de-identified information. We do not currently provide your personal data to third-party advertising networks for behavioural advertising.

Service Improvement: to maintain, debug, and enhance the Service, to develop new features, and to optimise performance and user experience based on aggregated usage data.

We may use aggregated or de-identified information to improve and support the Service. We do not sell or rent personal data for third-party advertising. We may earn commission when you choose an affiliate link; the click record is used for attribution, operations, fraud prevention, and accounting.

5. Automated Processing and Assistance

When you request AI planning, source analysis or another assisted feature, relevant text, links, images, extracted source material, language, trip dates, places and planning preferences may be sent to external processing providers to produce the requested result. Inputs, results and processing records may be stored to provide and recover the request, support your saved plans, diagnose failures and prevent misuse. Avoid submitting personal or confidential information that is not needed.

Uploaded media and content proposed for public sharing may undergo automated safety or publication review. Review may occur in our systems or through an external processing provider, and relevant content, media, and review results may be retained for enforcement, security, and appeals.

Place and route features may send the locations, travel mode, and other necessary request context to providers that return place, map, route, or transport information.

You may request human review of an automated restriction or decision where available. Rights concerning solely automated decisions apply where the processing produces legal or similarly significant effects and applicable law grants those rights.

6. Third-Party Service Providers

We use the following categories of providers and recipients for requested features. Some process data on our instructions; others, including certain identity, map and booking providers, independently determine some processing purposes under their own privacy notices. The data they receive depends on the feature you use:

Automated processing providers: receive submitted text, links, media, locale, or trip context to return requested analysis, suggestions, or safety and publication review.

Place-information providers: receive search terms, place names, addresses, coordinates or other relevant context to return place information. Directly loaded provider features may also receive your IP address and device or request information.

Identity providers: when you choose one, they authenticate you and provide an account identifier, email address, and available profile details under your provider settings.

Map and geocoding providers: receive addresses or coordinates to find locations, display maps, and convert between location descriptions and coordinates.

Routing and transport providers: receive locations, travel mode, timing, and request context to return route or public-transport information.

Source retrieval and transcription providers: receive a source reference, language and relevant text, media or audio when you request retrieval or analysis. Information in that material may also be processed to extract places and suggestions.

Transactional communication providers: receive contact details and action-specific information needed to deliver verification, security, password-reset, and important service messages.

Hosting, delivery, and security providers: process service content and standard request, network, device, and security information to operate, protect, and deliver the Service.

Media-storage providers: store and deliver uploaded media and related access and processing information on our instructions.

We select providers for defined functions. Providers acting on our instructions must have protections appropriate to their role. Providers acting independently may use information under their own notices; their processing is not always limited to our instructions. Review the applicable provider notice when using an external account, map feature or booking link.

Google Maps features may send search terms, coordinates, IP addresses and request or device information to Google. Google may use and retain that information for its own purposes, including providing and improving its services, as described in the Google Privacy Policy linked below. That policy is incorporated here for Google Maps features and content.

External geographic information may be incomplete, disputed, or outdated. Place names and boundaries shown by the Service reflect source data and do not state a political position or guarantee accuracy.

7. Content Moderation and Safety

We use automated checks and, where appropriate, human review to help detect unlawful, unsafe, infringing, or policy-violating media and public content. Processing may use external providers as described in Section 6.

We may record the review outcome and reason needed to restrict, reject, investigate, or reconsider content. We do not publish internal risk signals, and we retain review data only for the purposes and periods described in this Policy.

We track the number of content policy violations per user account. Users who repeatedly upload content that violates our standards may have their upload capabilities suspended. Suspension records, including the reason for suspension and applicable dates, are maintained as part of the user's moderation history. If you believe a moderation decision was made in error, you may contact us to request a manual review.

8. Data Sharing and Disclosure

We may disclose your personal data in the following limited circumstances:

Service providers: recipients in Section 6 receive data reasonably necessary to perform defined functions for us or complete a feature you request.

Legal Requirements: we may disclose your data where required to do so by law, regulation, legal process, or enforceable governmental request, including but not limited to compliance with a court order, subpoena, or request from law enforcement or regulatory authorities in any applicable jurisdiction.

Business changes: data may transfer as part of a merger, financing, reorganisation, sale, or insolvency, subject to confidentiality, applicable notice, and continued protection requirements.

Public profiles and shared content: usernames, account avatars, public profile information and published trips can be visible to others. Collaborators can see shared trip content and participation according to their permissions. Shared or invitation links can be forwarded; public content may be indexed or copied. Recipients may retain independent copies after you change visibility, revoke access or close your account. Keep private details out of content you publish or share.

With Your Consent: we may share your information in other circumstances where you have provided explicit consent for such sharing.

We do not sell or rent personal data for third-party advertising. Following an affiliate or booking link sends you to an external provider, which may receive link-attribution information and standard browser or network information and use cookies under its own notice. We may receive attribution or transaction confirmation needed to calculate a commission. Booking and payment information you give that provider is handled under its own privacy policy.

9. Data Storage and Security

We store account, trip, activity, media, and security data in systems operated by us and our hosting or storage providers. Location and duration may vary by data category, operational need, and provider arrangement.

We use technical and organisational measures designed for the nature and risk of the data, including access controls, credential protection, secure transmission, logging, monitoring, and incident response.

No Internet transmission or storage method is completely secure. We cannot promise absolute security, but we will investigate suspected incidents and provide notice where applicable law requires it.

10. Data Retention

We keep personal data only as long as reasonably needed for the purposes described here, including providing the Service, security, fraud prevention, legal compliance, accounting, disputes, and enforcement. Periods differ by category and context.

Account deletion starts deactivation: we block account access, revoke refresh credentials and queue removal of your owned trips from public and collaborative access. This does not immediately erase every server-side record, and related updates can take time to complete. Account and trip records, versions and other records may remain for the purposes described in this section; copies already obtained by others may remain independently. Contact [email protected] for a personal-data deletion request, including if you need more than account deactivation. We assess what must be deleted or anonymised when the retention purposes no longer apply, subject to applicable law.

Account and trip information is kept while needed to provide saved content, handle account requests and meet continuing obligations. Trip versions and source-processing records may be kept for recovery, integrity and troubleshooting. Security, moderation, TripPoints, referral and affiliate records are kept according to the relevant fraud risk, accounting or legal requirement and any active dispute. These criteria apply by data category; account closure is not a fixed erasure deadline for every record.

Temporary data and expired credentials are cleared or invalidated according to operational schedules. Backup copies may remain until overwritten or aged out, and we isolate them from ordinary use where practicable.

11. International Data Transfers

We and our providers may process personal data in countries other than the country where you live. Processing locations depend on the feature and provider involved, and the protections available under local law may differ.

Where transfer restrictions apply, the transfer must be covered by a valid legal mechanism and any required safeguards. Depending on the arrangement, this may involve an adequacy decision, contractual safeguards or another exception recognised by applicable law. Contact [email protected] for information about the relevant destination and safeguards, and how to obtain a copy where applicable. We do not rely on your mere use of the Service as blanket transfer consent.

12. Your Rights

Your rights depend on the law that applies to the processing and may include the following. Some rights have conditions, exceptions, identity-verification requirements, or limits where we must retain data or protect others:

Right of Access: you have the right to request confirmation of whether we process your personal data and, if so, to request access to that data together with certain supplementary information about how it is processed.

Right of Correction: you have the right to request that we correct any inaccurate personal data we hold about you, and to have incomplete data completed.

Right of Deletion: you have the right to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (if processing was based on consent), or where the data has been unlawfully processed. This right is subject to our legal obligations to retain certain data.

Right of Data Portability: where technically feasible, you have the right to request that we provide your personal data in a structured, commonly used, and machine-readable format, or that we transmit it directly to another controller.

Right to Restrict Processing: you have the right to request that we restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or where the processing is unlawful but you oppose deletion.

Right to Object: you have the right to object to the processing of your personal data where such processing is based on our legitimate interests, on grounds relating to your particular situation.

Right Regarding Automated Decisions: you have the right not to be subject to a decision based solely on automated processing (including content moderation) that produces significant effects concerning you, and to request human review of any such decision.

Send a rights request or withdraw consent by contacting [email protected]. We may reasonably verify your identity and clarify the request. We will respond within the period required by applicable law and explain any permitted extension, refusal or fee; otherwise requests are free of charge. Withdrawing consent does not affect earlier lawful processing or processing on another valid basis. You may also complain to the competent privacy or data-protection authority.

13. Children's Privacy

The Service is not intended for anyone under sixteen. We do not knowingly collect personal data from a child under sixteen. A parent or guardian who believes a child provided data should contact [email protected] so we can investigate and take the action required by applicable law.

14. Cookies and Local Storage

The browser application uses local storage and may use strictly necessary browser storage to keep you signed in, protect sessions, remember settings, and preserve selected planning state. Authentication credentials stored on your device are transmitted when needed to make authorised requests.

We do not currently run cross-site behavioural advertising trackers in our own advertising features or sell browser activity for behavioural advertising. Embedded maps and other external features may process device or request information under their own notices, and external booking sites may use cookies after you follow a link. Optional tracking that requires consent must wait for that consent; any future advertising changes will require updated disclosures and the choices required by law.

You can clear browser storage through the Service or your browser. Doing so may sign you out, reset preferences, or remove locally saved planning state, but it does not by itself delete server-side account data.

15. Changes to This Policy

We may update this Policy as our practices or legal obligations change. We will update the date and provide reasonable notice of material changes before they take effect where practicable. We will seek consent if a new use requires it rather than treating continued use as blanket consent.

16. Contact Information

For privacy questions, rights requests or concerns about this Policy, contact Charlowtown Ltd. at [email protected]. You may also contact the privacy or data-protection authority competent to consider your complaint.