Alfred Travel Privacy Policy

Effective date: 26 October 2026

This policy explains what personal information Alfred Travel Tech Pty Ltd (ABN 17 676 016 149) ("Alfred", "we", "us") collects through the Alfred app, web app and website, how we use and share it, and the choices you have.

We are an Australian company, and we handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. Who can use Alfred

You must be 18 or over to create an Alfred account. Adult account holders may add traveller profiles for other people, including children, and must have their permission (or, for a child, be their parent or guardian) to do so.

2. What we collect

Account and sign-in

• Email address and, for email sign-up, a password (stored as a hash).
• If you sign in with Apple: your name and email address. Apple may give us a private-relay email address instead of your real one.
• If you sign in with Google: your name, email address and profile photo URL.
• Sign-in provider and last sign-in time.

Traveller profiles (for you and anyone you add)

• First and last name, full date of birth, gender, and passport country or nationality.
• Children's dates of birth, where an adult account holder adds a child traveller.
• Likes, dislikes and travel preferences.

Trips and conversations

• Itineraries, destinations, dates, origin city, and the number and ages of travellers.
• What you type or say to Alfred, including chat and "Hey Alfred" prompts, and messages sent through WhatsApp.

Free text can include things like dietary needs or health and accessibility details (for example "vegetarian" or "wheelchair access"). Please share only what you need for your trip. If you do share this, we use it only to plan your trip, and it is processed by our AI providers (see section 5).

Location

• Website and web app: if you allow it, your browser shares your coordinates. We send them to OpenStreetMap Nominatim to work out your city. If you don't allow it, we look up an approximate city from your IP address using ipinfo.io. We use the city or nearest airport as your trip's starting point, and we store it with your itinerary. You can change it. We do not store your exact coordinates.
• Mobile app: we do not collect your device's GPS location.

Alfred Tokens and wallet

• Each user is allocated a custodial Solana wallet address for Alfred Tokens. The address is owned and controlled by Alfred, not by you. Withdrawals from it are not available. We record token transfers to and from it, including the addresses, network and transaction ID. Transactions on the Solana blockchain are public and cannot be erased.

Device, usage and technical data

• IP address, browser or device type, and user agent, including in a security audit log.
• App usage events, crash reports and diagnostics, linked to your user ID.
• On Android, the advertising ID (GAID). On iOS, we do not collect the advertising ID (IDFA).

Information we don't collect today

• We do not collect passport numbers or payment card details. Bookings are completed with our booking partners, and you enter your booking and payment details directly with them.

3. How we use it

• To create and run your account and sign you in.
• To plan, generate and refine itineraries and to show relevant travel offers.
• To hand you off to booking partners and measure whether those hand-offs work.
• To run Alfred Tokens.
• To keep Alfred secure, prevent fraud and fix problems.
• To understand how Alfred is used and improve it.
• To send service messages and, where you have agreed or the law allows, marketing. You can unsubscribe at any time.
• To meet legal obligations.

4. Cookies and similar technologies

Our website uses analytics cookies through Google Analytics 4. The web app uses Firebase Analytics, which is also Google Analytics. Our mobile apps use Firebase Analytics, Firebase Crashlytics and AppsFlyer for analytics, attribution and crash reporting. On our website and web app, Google Analytics and Firebase Analytics only load after you click Accept on our cookie banner. If you click Reject, they stay off, and the website does not record which campaign link brought you to us. We save your choice for 12 months in one first-party cookie (at_consent) that covers both the website and the web app, and you can change it at any time through the Cookie Settings link. If you withdraw consent, analytics stop and the Google Analytics cookies are deleted. The website and web app keep working if you reject analytics. In our mobile apps, the analytics, attribution and crash-reporting tools start when you open the app. You can also block or delete cookies in your browser settings, and on Android you can reset or limit your advertising ID in device settings.

5. Who we share it with

We do not sell your personal information.

Travel and booking partners. To find prices and packages we send trip details to partners: destinations, dates, departure airport, and the number and ages of travellers. These partners are Holiday Heroes and RateCore. We do not send them your name or email.

When you choose to book, Alfred hands you off to one of our booking partners: Holiday Heroes, LastMinute.com, Bravofly, Klook or Airalo. Some links go through affiliate networks and sites including Airalo, Klook, Booking.com, Expedia, Trip.com and Partnerize. The partner handles availability, price, checkout and servicing under its own privacy policy.

Service providers. They process data for us:

We may also disclose information where the law requires it, to protect people or our rights, or to a buyer as part of a business sale.

6. Overseas disclosure

Our main hosting is Amazon Web Services in Singapore (AWS region ap-southeast-1), so your information is mainly stored in Singapore, not Australia. It is also sent to the United States (including through Cloudflare's global network), the European Union (including France, Germany and the Netherlands), the United Kingdom and India, and to other overseas locations where some service providers' regions are not published. We take reasonable steps to make sure overseas recipients handle it in line with the APPs.

7. Security

We protect your information with access controls (including authenticated, rate-limited access to our systems) and security audit logging. Data in our databases, caches and file storage is encrypted at rest. Data is encrypted in transit using HTTPS/TLS between you and Alfred Travel, and between our services and our databases. We are continuing to strengthen our security. No system is completely secure. If a data breach is likely to cause serious harm, we will notify you and the OAIC as the Notifiable Data Breaches scheme requires.

8. How long we keep it

We keep your personal information while your account exists and for as long as we need it for the purposes in this policy, including legal, security and dispute purposes. Database backups are kept for 35 days. Blockchain records are permanent.

9. Deleting your account

You can delete your account in the app or web app under Settings. This disables your account and removes your login, so you can no longer sign in. It does not automatically erase the information linked to your account.

To have your personal information erased, email support@alfredtravel.io from your account email. We will handle your request manually and confirm when it's done, except for information we must keep by law and public blockchain records, which can't be erased. Copies in backups expire within 35 days.

10. Access and correction

You can ask to see or correct the personal information we hold about you by emailing support@alfredtravel.io. We will respond within a reasonable time and may need to verify your identity.

11. Complaints

Email support@alfredtravel.io. We will respond within 5 business days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or on 1300 363 992.

12. Changes

We will post any update here with a new effective date, and tell you about significant changes.

13. Contact

Alfred Travel Tech Pty Ltd, ABN 17 676 016 149
4/506 Doncaster Road, Doncaster VIC 3108, Australia
support@alfredtravel.io

This policy is governed by the laws of Victoria, Australia.