TrippBit Privacy Policy

This Privacy Policy explains how vibeIT labs ltd (referred to in this Privacy Policy as “TrippBit”, “we”, “us” or “our”) collects, uses, shares and otherwise processes personal data when you:

• visit trippbit.com (the “Website”); and/or
• use TrippBit through Telegram (the “Telegram Bot” / “Service”).

By accessing or using the Website or Service, you acknowledge the practices described in this Privacy Policy.

1) Who we are (Controller)

Data Controller: vibeIT labs ltd
Product/Service name: TrippBit
Website:https://trippbit.com

2) What data we collect

We collect personal data in three main ways: (a) data you provide, (b) data generated through your use of the Service, and (c) data collected automatically (e.g., analytics).

2.1 Data you provide to us

Depending on how you interact with TrippBit, you may provide:

• Account / contact details: such as your email address (if you provide it) and other information you choose to share.
• Support communications: information you submit when you contact support.

When you make or manage travel bookings, you may also provide details required by suppliers, such as:

• Passenger or guest name (as on travel documents), contact phone, and date of birth where required
• Travel document details for international bookings where applicable
• Travel preferences, special requests, and related booking correspondence

2.2 Data we receive and process via Telegram

When you use TrippBit in Telegram, Telegram provides certain data to us and/or we process data you send through Telegram. This can include:

• Telegram identifiers and profile data: e.g., your Telegram user ID, username, display name, language, and other metadata made available through Telegram’s APIs.
• Messages and commands: content you send to the bot (including text you type, and information included in those messages).
• Optional information you choose to share: e.g., location (if you share it in Telegram), travel preferences, etc.

2.3 Website analytics (Vercel Analytics)

We use Vercel Analytics to understand how visitors use our Website and to improve performance and user experience. Vercel Analytics may collect:

• Device and browser information (e.g., user agent),
• IP address (typically processed in a limited form depending on configuration),
• Pages viewed, referring URLs, and interaction events, and
• Approximate location derived from IP (country/region level).

Payments

Important: We do not store your payment card details. Card and cryptocurrency payments are handled by third-party payment providers. We may retain limited transaction references for accounting, support, and legal purposes.

3) How we use your data (purposes)

We use personal data to:

• Provide and operate the Service (e.g., respond to your bot commands, manage your requests).
• Provide customer support and troubleshoot issues.
• Maintain safety and prevent abuse (fraud, spam, unauthorized access).
• Improve the Website and Service (including via analytics such as Vercel Analytics).
• Process and manage bookings made through the Service and communicate confirmations or updates.
• Comply with legal obligations and respond to lawful requests.

4) Legal bases for processing (GDPR)

Where the GDPR applies, we process personal data based on one or more of the following legal bases:

• Contract / steps prior to entering a contract (Art. 6(1)(b)) — to provide the Service you request through Telegram and/or the Website.
• Legitimate interests (Art. 6(1)(f)) — e.g., securing our services, preventing abuse, and improving the Website via analytics, where such interests are not overridden by your rights.
• Consent (Art. 6(1)(a)) — where required (for example, if we implement consent-based analytics or optional features).
• Legal obligation (Art. 6(1)(c)) — to meet applicable legal requirements.

Where UK GDPR applies, the same categories of lawful basis are used in a materially equivalent way.

5) How we share your data

We may share personal data with:

• Service providers / processors that help us run the Website and Service (including Vercel for hosting/analytics).
• Telegram (as the platform through which you interact with the Service; Telegram also processes your data independently as a controller).
• MobiMatter (as an eSIM service provider) — we may share necessary user information with MobiMatter to facilitate the provisioning and activation of eSIM services.
• Authorities / regulators when required by law, or to protect rights, safety, and security.

We do not sell your personal data.

6) International data transfers

Your data may be processed in countries other than the one you live in. Where required by law (including GDPR), we use appropriate safeguards for international transfers (such as Standard Contractual Clauses or equivalent mechanisms) when data is transferred to countries that do not provide an adequate level of protection.

7) Data retention

We keep personal data only for as long as necessary for the purposes described in this Privacy Policy, including for legal, accounting, or reporting obligations and to resolve disputes and enforce agreements. Retention periods vary depending on the nature of the data and why it is processed.

Examples (non-exhaustive):

• Booking and payment records: up to 7 years where required for tax, accounting, or similar obligations
• Support and bot interaction records: typically for a limited period needed to operate and improve the Service, unless a longer period is required by law or dispute resolution

8) Security

We implement appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. No method of transmission or storage is 100% secure, but we work to maintain safeguards appropriate to the risk.

Examples of measures include:

• Encryption of data in transit and, where appropriate, at rest
• Access controls and secure infrastructure
• Review and updates to our security practices

9) Your rights (GDPR)

If the GDPR applies to you, you have the right to:

• Access your personal data;
• Rectify inaccurate or incomplete data;
• Erase your data (“right to be forgotten”), in certain circumstances;
• Restrict processing, in certain circumstances;
• Data portability, where applicable;
• Object to processing based on legitimate interests, in certain circumstances;
• Withdraw consent at any time (where processing is based on consent);
• Lodge a complaint with your local data protection authority.

To exercise your rights, contact us (see Contact). We may need to verify your identity before responding.

You may also lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk (if applicable).

10) Children

Our Website and Service are not directed to children, and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us via the Contact section.

11) Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will post the updated version on this page and update the “Effective Date”.

12) Contact

For questions, requests, or privacy inquiries, contact: