Vayo Privacy Policy

Last updated: May 13, 2026

This Privacy Policy describes how Project Atlas AI, LLC d/b/a Vayo (“Vayo”, “we”, “us”, or “our”) collects and processes your personal information when you use Vayo (including our website, mobile app, AI assistants, and other AI-powered services), as well as other activities described in this Privacy Policy (together, the “Service”) for this Beta release. We may update this Privacy Policy from time to time, so we encourage you to check back occasionally. If we make updates to the Privacy Policy that could significantly impact our users, we will take steps to inform those users about such changes before they go into effect.

Vayo has other privacy policies for different websites and services. This one only covers the Service.

Table of Contents

Personal information we collect

Information you give us. Here's the kind of personal information you might share with us:

  • Contact information, such as your name, signature, title, email address, billing and mailing addresses, and phone number.
  • Demographic information, such as your city, state, country, and postal code.
  • Profile information, such as your waitlist join date and time, account name, bio, avatar or photo, date of birth, interests, travel preferences and history, whether you are traveling for work or personal purposes, travel profile information (e.g., government ID, passport number, loyalty program number), social media profile links, and anything else you add to your account.
  • Communications you have with us, such as when you reach out through the Service, including your chats in the Service, or get in touch by email, phone, chat, social media, or other channels.
  • Content you provide, such as your chats and inputs into the Service, emails, messages, posts, reviews, updates, documents, or other data that you share with, connect to, scan, permit access to or otherwise use with the Service. When you connect your email account(s) to the Service, we process your emails using a two-pass system: first, we retrieve message headers (such as subject lines, sender and recipient details, dates, and timestamps) to classify messages; second, for messages classified as travel-related, we retrieve the full message body to extract structured travel data (such as itineraries, confirmation numbers, and booking details). Raw message content is not retained after structured data has been extracted. When you connect your Google account to the Service, we also collect Google Calendar data (such as event titles, dates, times, locations, and related metadata). Google accounts are connected to the Service through OAuth offered by Google.
  • Other information not listed here, which we'll use as described in this Privacy Policy or as explained when we collect it.
  • Information about others. When you connect a third-party account (such as email) to the Service or share communications with us, we may process personal information about other people in those communications — such as names, email addresses, travel plans, and other details of people you correspond or travel with. In addition, you may choose to provide to the Service the names, dates of birth, and travel profiles (e.g., passport or other government identification numbers, loyalty program memberships, dietary restrictions) of individuals you may travel with. Also, we may offer features that let you invite your contacts to use the Service. If you do, we may collect their contact details so we can send the invitation. We only use this information to provide and improve the Service as described in this Privacy Policy. Please don't share the information of anyone else with us unless you have their permission.

Third-party sources. We may combine the personal information you give us with personal information we get from other places, such as:

  • Affiliates, such as our parent company, subsidiaries, and affiliates.
  • Travel providers, such as airlines, hotels, global distribution system providers, and other travel-related providers.
  • Service providers that help us run the Service or our business.
  • Third-party service providers. If you connect your email, calendar, or other Google account to the Service, we may receive personal information from those providers based on the permissions you grant and their terms of service and privacy policies.

Information we collect automatically. We and our service providers may automatically collect information about you, your device, and how you interact with the Service, our communications, and other online services over time, such as:

  • Device information, such as your operating system type and version, device manufacturer and model, browser type, screen resolution, memory and storage, CPU usage, device type (e.g., phone or tablet), IP address, unique identifiers (including those used for advertising), language settings, mobile carrier, network information (e.g., Wi-Fi, LTE, 3G), and general location info such as city, state, or region.
  • Location data, which may be approximate (for example, as inferred from network data or device settings) or precise (if and when you authorize the Service to access your device’s location).
  • Online activity information, such as the pages or screens you viewed, your search history, how long you spent on a page, the website you visited before coming to the Service, how you moved between pages, what you did on a page, when you visited and for how long, and whether you opened our emails or clicked links in them.

Tracking technologies. Some of the automatic collection described above uses the following technologies:

  • Cookies — small text files that websites store on your device. They let web servers track your browsing activity and remember things such as your preferences, form entries, and login status. Our sites use "session cookies” (deleted when you close your browser), “persistent cookies” (which last longer), “first-party cookies" (placed by us), and “third-party cookies" (placed by our service providers and other third parties).
  • Local storage technologies, like HTML5, which work similarly to cookies but can store more data on your device outside your browser.
  • Web beacons (also called pixel tags or clear GIFs), which help us confirm that a webpage or email was accessed or opened, or that certain content was viewed, clicked, or forwarded.
  • Session-replay technologies provided by third parties that record how you interact with the Service so we can watch video replays of user sessions. These replays capture clicks, taps, mouse movements, and scrolling. They help us find usability problems and make improvements.

How we use your personal information

We may use your personal information for the following purposes, or as otherwise explained when we collect it:

Service delivery and operations. We may use your personal information to:

  • provide and run the Service (including scanning, analyzing, and processing your communications using AI and machine learning to understand context, find relevant information, and create suggested responses or other outputs for you);
  • process your requests;
  • connect your third-party accounts to the Service and access content from those accounts based on the permissions you grant;
  • enable security features of the Service;
  • personalize the Service, such as generating derived data from your information, including trip clusters, recurring-trip patterns, travel preferences, and other insights, and remembering the devices you have logged in from and your selections and preferences;
  • establish and maintain your user profile on the Service, including developing and maintaining: (a) a structured profile layer, which serves as the source of truth and contains verified facts extracted from your connected accounts and information you provide (such as travel history, preferences, and booking details); and (b) an AI-generated narrative layer, which is a cached summary derived and inferred from the structured profile layer and is used to personalize your experience with the Service as explained above;
  • keep you in the loop about the Service, including sending announcements, updates, security alerts, messages between users, and support and administrative messages;
  • understand your needs and interests, and tailor your experience with the Service and our communications;
  • provide support for the Service;
  • respond to your requests, questions and feedback;
  • analyze usage;
  • improve the Service;
  • help you invite contacts to join the Service;
  • collect and share user testimonials; and
  • help prevent fraud and keep things secure.

Research and development. We may use your personal information and data we derive from it (including aggregated, anonymized, de-identified, or synthetic data) for research and development and to improve our products and services, including training our AI models, to the extent allowed by this Privacy Policy and applicable rules for accessing third-party APIs. Notwithstanding the foregoing, Vayo's use and transfer to any other app of information received from Google APIs (“Google user data”), including data obtained from Gmail and Google Calendar, adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: (i) Google user data is accessed and used only to provide and improve user-facing features that are prominent in the Service's user interface; (ii) Google user data is not used to serve advertisements; (iii) Google user data is not used to train generalized or third-party artificial intelligence or machine learning models; (iv) Google user data is not transferred to third parties unless (a) necessary to provide or improve user-facing features that are prominent in the Service's user interface, (b) you provide affirmative consent, (c) necessary for security purposes (e.g., investigating abuse), or (d) required to comply with applicable law; and (v) human access to Google user data is limited to the minimum necessary and only occurs (a) with your affirmative consent, (b) for security purposes, (c) to comply with applicable law, or (d) when the data has been aggregated and anonymized for internal operations. Personal information, including communications processed through the Service, may also be shared with third-party AI providers to help deliver the Service. However, we require those providers by contract not to use your personal information to train their own AI models. We may use and share aggregated, anonymized, de-identified, or synthetic data with third parties for any lawful business purpose. We do not attempt to reidentify de-identified information derived from personal information, except for the purpose of testing whether our de-identification processes comply with applicable law.

Compliance and protection. We may use your personal information to:

  • comply with applicable laws and legal process, such as to respond to subpoenas, court orders, investigations or requests from government authorities;
  • protect our, your, or others’ rights, privacy, safety, or property (including by making and defending legal claims);
  • audit our internal processes for compliance with legal and contractual requirements or our internal policies;
  • enforce the terms and conditions that govern the Service; and
  • prevent, identify, investigate and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks and identity theft.

With your consent. By connecting your third-party service account to the Service and enabling our AI features, you expressly consent to our access, collection, and processing of your third-party service account data, including communications, such as the content of messages sent and received, for the purposes described in this Privacy Policy, and confirm that you have all rights and permissions to permit our access, collection, and processing of your third-party service account data. You may withdraw your consent at any time by deleting your account or, as to each third-party service account, by disconnecting those third-party service accounts from the Service through your profile and settings, as further described in the Your choices section below. In addition, in some cases, we may specifically ask for your consent to collect, use, or share your personal information for further purposes, if those purposes are not compatible with the initial purpose for which that personal information was collected.

Cookies and similar technologies. On top of the uses described above, we may use cookies and similar technologies for the following:

  • Technical operation. To keep the Service running smoothly, such as remembering your selections as you navigate the site and whether you're logged in.
  • Functionality. To make the Service work better for you.
  • Analytics. To help us understand how people use the Service, including how many users visit, which pages are most and least popular, how users move around the Service, and how they interact with our emails.

How we share your personal information

We may share your personal information with the following parties, as well as in other ways described in this Privacy Policy, in other notices, or when we collect the information.

Affiliates. Our parent company, Booking Holdings Inc. (BHI), subsidiaries, and affiliates might have access to personal information. Visit https://www.bookingholdings.com/ for more information about these companies.

Service providers. Third parties that help us run the Service or our business, such as those providing hosting, authentication, internet services, IT, customer support, chat features, email delivery, consumer research, and website or data analytics.

Artificial intelligence platforms. We use third-party AI providers to power certain features of the Service, including analyzing communications from accounts you have connected. To do this, your communications content and related personal information — including data we derive from those communications — may be sent to and processed by these AI providers. We require these providers by contract to process your personal information only as needed to provide services to us, not to retain it longer than necessary, and not to use it to train their own AI models.

Third parties you choose. We may share your personal information with other third parties when you ask us to or give us permission.

Linked third-party services. If you log into the Service with, or link your account to, a social media or other third-party service (such as Google), we may share your personal information with that service. How they use the shared information is governed by their privacy policy and your account settings with them.

Professional advisors. Lawyers, auditors, bankers, insurers, and similar professionals, when needed for the services they provide to us.

Authorities and others. Law enforcement, government authorities, and private parties in legal disputes, when we believe in good faith it's necessary for the compliance and protection purposes described above.

Corporate transactions. We may share personal information in connection with actual or potential business transactions (e.g., investments, financings, public offerings, or the sale, transfer, or merger of all or part of our business, assets, or shares), as well as in the event of insolvency, bankruptcy, or receivership. For example, we may need to share certain personal information with potential buyers or partners and their advisors. In these situations, personal information may be transferred to one or more third parties as part of our business assets.

We make commercially reasonable efforts to verify that the parties with whom our mobile application shares personal information provide a level of protection of personal information consistent with the practices described in this Privacy Policy, except that all such parties described above other than service providers and affiliates may, to the extent permitted by law, use personal information as described in their own privacy policies.

Your choices

This section explains the choices you have.

Access or update your information. If you have an account with us, you can review and update your account information by logging in and going to your profile and settings. For example, you may correct your profile information in the following ways: (a) fact corrections, which overwrite incorrect data with corrected data (a history of the correction is retained); (b) inference corrections, which annotate an AI-generated inference as inaccurate without erasing the underlying source data; and (c) narrative dismissals, which suppress a particular AI-generated framing or characterization without deleting the underlying facts. You may withdraw your consent at any time by deleting your account or, as to each third-party service account, by disconnecting those third-party service accounts from the Service through your profile and settings.

Opt out of communications. You may opt out of non-essential service communications (such as product announcements and feature updates) by adjusting your notification preferences in your profile and settings or by contacting us. You will continue to receive transactional and security-related communications necessary for the operation of your account.

Cookies. Most browsers let you remove or block cookies. Check your browser settings for instructions. Many browsers accept cookies by default until you change your settings. If you disable cookies, the Service may not work properly. For more information about cookies, including how to see and manage them, visit http://www.allaboutcookies.org.

Blocking images/clear GIFs. Most browsers and devices let you prevent images from loading, which stops the sender from knowing you viewed a page. Check your browser or device settings for instructions.

Do Not Track. Some browsers can send “Do Not Track” signals to websites you visit. We currently don't respond to these signals. To learn more, visit http://www.allaboutdnt.com.

Training data. As explained in the How We Use Personal Information section, we may use your personal information to train our AI models and for other machine learning purposes; however, Google user data is not used for this purpose. You have the option to opt out of the use of your personal information for training our AI models by contacting us.

Declining to provide information. We need certain personal information to provide some of our services. If you don't provide the information we mark as required, we may not be able to offer those services to you.

How long we keep your personal information. We generally keep personal information for as long as we need it for the purposes we collected it, including to meet any legal, accounting, or reporting requirements, to establish or defend legal claims, and to prevent fraud. When deciding how long to keep personal information, we consider things like: how long we have a relationship with you and provide services to you; the type and sensitivity of the information; the risk of harm from unauthorized use or disclosure; whether we can achieve our purposes another way; any legal obligations we have (for example, some laws require us to keep transaction records for a set period); and our legal position regarding things like statutes of limitations, litigation, or regulatory investigations. For example, we will keep your account and profile information for as long as your account is active, and will delete it from our production database within thirty (30) days of an account deletion request, subject to any requirements or needs related to legal, accounting, or reporting requirements, legal claims, or fraud. When we no longer need your personal information, we will either delete it or de-identify it.

Other sites and services

The Service may contain links to websites, apps, and other online services run by third parties. Our content may also appear on websites or services that aren't connected to us. The Service also lets you connect third-party accounts (such as Google, Microsoft, Yahoo, or other providers) to use our AI-powered features. Your use of those third-party services is subject to their own terms and privacy policies, and we encourage you to review them. These links and integrations don't mean we endorse or are affiliated with any third party. We don't control third-party websites, apps, or online services, and we're not responsible for how they operate. We encourage you to read the privacy policies of other websites, apps, and online services you use.

Security

We use technical, organizational, and physical safeguards designed to protect the personal information we collect. That said, no internet or information technology system is completely secure, and we cannot guarantee the security of your personal information.

International data transfers

We are based in the United States and may use service providers in other countries. The Service is intended only for individuals in the United States. If you are located outside of the United States, your personal information may be transferred to, stored in, and processed in the United States or other jurisdictions where privacy laws may not offer the same level of protection as in your home country. Where required by applicable law, we will implement appropriate safeguards (such as standard contractual clauses or other lawful transfer mechanisms) to protect your personal information in connection with such transfers. By using the Service, you acknowledge and consent to such transfers to the extent permitted by applicable law.

Children and Teens

The Service is not meant for anyone under 18 years old. If you are a parent or guardian and believe we have collected personal information from or about a minor in a way that is not allowed by law, or if information was provided on your behalf when you were under 18, please contact us. If we find out that we have collected personal information from a minor through the Service without proper parental or guardian consent as required by law, we will comply with applicable legal requirements to delete the information.

Changes to this Privacy Policy

The "Last updated" date at the top of this Privacy Policy shows when it was last revised. We may update this Privacy Policy at any time. When we do, we will change the “Last updated" date. Depending on the type of change, we may also notify you directly or ask for your consent. Any changes take effect when we post the updated version, unless we say otherwise.

How to contact us

Privacy Policy — Vayo