Privacy Policy

We collect information you provide directly when using Lettuce Travel:

• Account information: your display name, email address, and optional profile photo.
• Trip data: trip names, dates, destinations, itinerary segments, activities, and logistics details you create or contribute to.
• Decisions & votes: voting choices and comments you make on group decisions within a trip.
• Financial information: expense descriptions, amounts, categories, and split allocations you enter for group expense tracking. Lettuce does not process payments or store payment card details.
• Booking references: provider names, confirmation codes, and booking URLs you choose to add.
• Location data: city names, addresses, and map coordinates for trip destinations and activities.

We also automatically collect limited technical data: session tokens for authentication, timestamps of account and content creation, and server logs that may include your IP address.

• Provide the service: coordinate trip planning, display itineraries, tally votes, and calculate expense splits among group members.
• Authenticate your identity: verify your email via one-time passcode (OTP) when you join a trip, and manage your login sessions.
• Send transactional emails: deliver OTP codes for sign-in and account verification. We do not send marketing emails.
• Maintain security: enforce rate limits, detect abuse, and protect against unauthorized access.
• Improve the platform: understand usage patterns to fix bugs and develop new features.

We never sell your personal information.

Within your trips: other members of a trip can see your display name, profile photo, votes, comments, expense contributions, and itinerary participation. This shared visibility is core to how group trip planning works. Trip organizers may also see booking details and financial summaries.

Service providers: we use the following third-party services to operate Lettuce Travel:

• Supabase — database hosting and authentication infrastructure.
• Resend — transactional email delivery (OTP codes only).
• Google — place identifiers for location references (no direct user data is sent to Google by Lettuce).

Legal requirements: we may disclose information if required by law, legal process, or to protect the rights, safety, or property of Lettuce Travel, our users, or the public.

Lettuce Travel uses only essential cookies required for authentication and session management. These cookies keep you signed in and are strictly necessary for the service to function.

We do not use analytics cookies, advertising trackers, social media pixels, or any third-party tracking technologies. There is no cookie consent banner because we only use cookies that are essential to provide the service you requested.

We retain your account information and trip data for as long as your account is active. Trip data is retained as long as the trip exists and at least one member's account is active.

If you delete your account, we will remove your personal information from active systems. Some data may be retained in backups for a limited period or as required by law. Contributions to shared trip content (e.g., expenses, votes) may be anonymized rather than deleted to preserve the integrity of group records.

We protect your data through multiple layers:

• All data is transmitted over HTTPS with TLS encryption.
• Row-level security (RLS) policies ensure you can only access trips you are a member of.
• OTP codes expire after 10 minutes with a maximum of 5 verification attempts, and OTP requests are rate-limited to prevent abuse.
• Passwords are cryptographically hashed and never stored in plain text.
• Authentication tokens are stored as HTTP-only cookies to prevent client-side script access.

While we implement industry-standard security measures, no system is 100% secure. We encourage you to use a strong, unique password and to keep your email account secure, as it is used for account recovery.

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Correction: update or correct inaccurate information via your profile settings.
• Deletion: request deletion of your account and associated personal data.
• Portability: request your data in a structured, commonly used format.
• Objection: object to certain processing of your data where applicable under local law.

To exercise any of these rights, contact us at legal@beplurality.com. We will respond within 30 days.

Lettuce Travel is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us and we will promptly delete it.

Lettuce Travel is operated from the United States. If you access the service from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate. By using Lettuce Travel, you consent to the transfer of your information to these locations.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by updating the “Last updated” date at the top of this page. We encourage you to review this policy periodically. Your continued use of Lettuce Travel after changes are posted constitutes your acceptance of the updated policy.

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us:

Email: legal@beplurality.com
Support: help@beplurality.com
Website: https://lettucetravel.app
Company: Plurality LLC