This policy explains what personal data ChiefOne26 ("we") collects, why, and the choices you have. It applies to the ChiefOne26 web application.
Data we collect
Account: your name, email address, and a securely hashed password. Optionally your passport nationality, used to check entry requirements.
Travel data: trips you create (destinations, dates, purpose, itinerary), expenses and receipts, and team memberships.
Documents: files you upload (boarding passes, bookings, invoices, and any passport pages you choose to add) and the structured data our AI extracts from them. These are stored in private storage and the extracted data is encrypted at rest.
Integrations: if you connect Google or Microsoft, we access calendar events and email metadata you authorize, to suggest trips. Access tokens are encrypted at rest; you can disconnect at any time.
Technical: push-notification subscriptions (if enabled) and an audit log of sensitive-document access, which may include your IP address.
How we use it
To provide the service: store and organize your trips, generate AI checklists, summaries, and entry-requirement research, process receipts, and send reminders you opt into. We do not sell your personal data.
Processors we rely on
We share data only with providers that process it on our behalf: Neon (database hosting, EU), Vercel (application hosting), Anthropic (AI processing of documents and text), Resend (email delivery), and Google/Microsoft (only if you connect those integrations). Some providers, including Anthropic, process data in the United States.
Retention and your rights
We keep your data while your account is active. You can export your trips or permanently delete your account at any time from Settings. Deletion removes your trips, documents, expenses, and account records. For a complete machine-readable copy of your personal data, or to exercise your rights of access, rectification, and erasure, contact us.
Security
Passwords are hashed, sensitive fields (extracted document data and OAuth tokens) are encrypted at rest, documents are served only to you and your team over authenticated requests, and access is transport-encrypted (HTTPS).
Contact
Questions or requests: privacy@chiefone26.com.