Contents
- Who we are
- Two roles: controller and processor
- If you run an agency
- If you wrote to an agency on WhatsApp
- If you visit the website or write to us
- Artificial intelligence
- Who we share data with
- Data outside the EU
- How long we keep data
- How we protect data
- Your rights
- How to delete your data
- Minors
- Changes to this policy
What brings you here?
- If you run an agency that uses Tramoa or you are trying it out, your section is If you run an agency.
- If you wrote to an agency on WhatsApp and its AI assistant replied, your section is If you wrote to an agency on WhatsApp.
- If you visit tramoa.com or have written to us, your section is If you visit the website or write to us.
- If you want us to delete your data, go to How to delete your data.
The essentials
| Who the controller is | Sami Al Droubi Daghestani, who provides the service as Tramoa (Spanish tax ID: NIF 54191976C). Contact: contact@tramoa.com. For the messages of an agency's customers, the controller is the agency and Tramoa is its processor. |
|---|---|
| What we use the data for | To provide the service to agencies (account, dashboard, billing and support) and, on behalf of each agency, so that its AI assistant can reply to its customers on WhatsApp. Also to keep the service secure and to comply with the law. |
| Why we are allowed to | The contract with the agency, our legal obligations (such as invoicing) and our legitimate interest in security. For the data of its customers, the legal basis is the one the agency relies on: usually, dealing with what its customer asks it for. |
| Who we give it to | The providers that help us deliver the service (hosting, Meta's WhatsApp, Anthropic's AI, Speechmatics' transcription of voice notes and audio recordings, ElevenLabs' voice, Stripe's payments and email), always under a contract. We do not sell data to anyone. |
| If it leaves the EU | Some providers process it in the United States, with the safeguards required by the GDPR. The application and the database are in Ireland. |
| Your rights | To access your data, correct it, delete it, object, restrict it and take it with you, by writing to contact@tramoa.com. And to lodge a complaint with the Spanish Data Protection Agency (AEPD). |
| What we never do | Sell data, use it for advertising or train AI models on the conversations. |
Who we are
Tramoa is a service of Sami Al Droubi Daghestani, a self-employed professional with NIF (Spanish tax ID) 54191976C, whose address is Sector Embarcaciones 24, 3.º A, 28760 Tres Cantos (Madrid, Spain).
Tramoa gives travel agencies an artificial intelligence assistant that replies to their customers on WhatsApp, with a dashboard to set it up and follow the conversations.
For any privacy matter, write to us at contact@tramoa.com. We have not appointed a Data Protection Officer: privacy enquiries are handled directly by the business owner.
Two roles: controller and processor
Depending on whose data it is, Tramoa plays one role or the other. This matters, because it changes who you should contact.
Tramoa as controller: agency and website data
The accounts of agencies and their teams, billing, the WhatsApp connection, use of the dashboard and anything that visitors to tramoa.com write to us. We decide what this data is used for and we are accountable for it.
Tramoa as processor: the conversations of each agency's customers
When someone writes on WhatsApp to an agency that uses Tramoa, the controller is the agency: it decides what that data is used for. We only process it to provide the service to the agency, following its instructions.
The terms of this processing are set out in the Data Processing Agreement (DPA), which each agency accepts when it signs up (Article 28 of the GDPR).
If you run an agency
This section is for agencies that use Tramoa or are trying it out, and for the people on their team. Here Tramoa is the controller.
What data we process
- Your account: name, email, phone, language and password. We do not store the password as it is, but encrypted in a way that no one can read it.
- Your WhatsApp for notifications, if you turn it on: the number where you want to receive them and the identifier WhatsApp gives us, verified with a code that you send us. You can turn them off in Settings › Team or by writing “STOP”.
- Your team: name, email and role of the people you invite to the dashboard.
- Your agency and billing: trading name and legal name, tax identification number (NIF), address, country, plan and invoices. Your card details are collected and stored by Stripe: we only see the card brand and the last four digits.
- The WhatsApp connection: when you connect your number through Meta's sign-up process, we store the identifiers of your WhatsApp Business account and of your number, the name your customers see and the permission Meta gives us to send and receive messages on your behalf. That permission is stored encrypted. The connection is made with your Facebook account, so Meta also gives us the identifier and name of that account; nothing from your profile or your contacts.
- What you prepare for your assistant: trips, prices, brochures, terms and conditions, instructions and the documents, photos or audio files you upload.
- Use of the dashboard and security: sign-ins (date, IP address, browser and device), to alert you when someone signs in from a new device, and the change history (who changed what and when).
- What you discuss with us: support by email or WhatsApp, and the messages between you and your assistant that come from Tramoa's number: summaries, notifications and the questions you ask it.
What for and on what legal basis
| What for | Legal basis (GDPR) |
|---|---|
| Providing you with the account, the dashboard and the assistant; charging you for your plan; sending you service emails (sign-in, invoices, notifications) | The contract (Art. 6(1)(b)) |
| Notifying you on WhatsApp from Tramoa's number: summaries, alerts and answers to whatever you ask | The contract (Art. 6(1)(b)). They can be turned off in Settings › Team or by writing “STOP” |
| Providing you with support | The contract (Art. 6(1)(b)) |
| Protecting the service: detecting unusual sign-ins, stopping abuse and keeping the change history | Legitimate interest in security (Art. 6(1)(f)) |
| Issuing and keeping invoices | Legal obligation (Art. 6(1)(c)) |
| Improving Tramoa using aggregate figures (never looking at a specific individual) | Legitimate interest (Art. 6(1)(f)). You can object |
If you ask us for help, someone from Tramoa may access your dashboard to see the same as you. We only do this to resolve what you have asked us about or a security incident, and it is logged.
While you use Tramoa, we keep what is necessary to provide you with the service. If you cancel your plan, we keep it for 30 days from when your assistant stops replying, in case you come back, and then we delete it, except for invoices, which the law requires us to keep. The exact periods are in How long we keep data.
If you wrote to an agency on WhatsApp
This section is for you if you wrote to a travel agency on WhatsApp and its AI assistant replied. The agency decides what is done with your data: it is the controller. Tramoa provides the agency with the assistant and processes your messages only on its behalf. What follows explains what happens to them; the agency may give you further details in its own privacy policy.
What data is processed
- Your WhatsApp profile name and your phone number or, if you use a WhatsApp username and do not show your number, the identifier that WhatsApp gives the agency in its place.
- The messages in that conversation: text, voice notes, photos and documents.
- Whatever you share about your trip: dates, destination, how many of you are travelling and your ages, preferences and budget.
- If the agency has it switched on, the booking details (travellers' names, identity document or passport, date of birth) and the status of your payments. Your card details do not pass through Tramoa: they are collected by the payment gateway.
- The delivery data provided by WhatsApp: whether a message was sent, delivered or read.
What it is used for
- To reply to you on behalf of the agency: its trips, prices, availability and quotes. Prices are calculated by the system using the agency's rates; they are not made up by the AI.
- To hand your conversation over to a person at the agency when you ask for it or when the agency has set this up.
- So that the agency can see the conversation in its dashboard, receive notifications (in the dashboard, by email and, if it has turned this on, on WhatsApp from Tramoa's number: with your name, your trip and the reason, never the whole conversation) and prepare your booking.
- To give the agency aggregate figures: how many conversations there are and how many end in a booking. If the agency belongs to a group, the group's head office sees only those figures, never your conversation, your name or your number.
And for nothing else: we do not use your data for our own purposes, we do not send you advertising from Tramoa, we do not sell it and it is not used to train AI models.
You will always know you are talking to an AI
The assistant says so in its first message of every conversation, as required by the EU Artificial Intelligence Act (Article 50). You can ask to speak to a person at any time. When someone from the agency takes over the conversation, the assistant stays silent until the agency decides to hand it back.
If the agency sends you notifications or promotions on WhatsApp and you do not want them, say so in the same chat and it will stop sending them. You can also write “STOP”.
Who sees your messages
- The agency and the members of its team who have access to the dashboard.
- Tramoa, only when necessary for the service to work, to support the agency if it asks us to, or for security reasons.
- Meta, through WhatsApp, which carries the messages back and forth. In this service, Meta processes the messages as a processor and keeps them for at most 30 days, so that it can resend them if something goes wrong. What Meta does with data for WhatsApp's security is explained in its own policy.
- Anthropic, which drafts the assistant's replies. It does not use your messages to train its models and deletes them within 30 days at most (we explain the exceptions further below).
How long
The agency decides. If it does not change anything, the assistant deletes conversations 24 months after the last message, and passports and travel documents 30 days after the return from the trip. If the agency leaves Tramoa, everything is deleted 30 days after its assistant stops replying. WhatsApp and Anthropic keep their own copy for a maximum of 30 days, with the exceptions set out in How long we keep data.
Your rights
To see, correct or delete your data, contact the agency, as it is the one that decides about it: you can ask it in the same WhatsApp chat. If you write to us, we pass your request on to the agency without delay and help it reply to you. The steps are in How to delete your data.
If you visit the website or write to us
The website
On tramoa.com there are no analytics or advertising cookies, and no third-party measurement tools. We only use the cookies needed for the website and the dashboard to work: your language, your session when you sign in to the dashboard and your choice about cookies. Details are in the Cookie Policy.
The website is served by Vercel, which protects it from attacks and receives your IP address in order to do so. When you sign in to the dashboard or create an account, Cloudflare Turnstile checks that you are not an automated program, based on technical data from your browser.
If you write to us
If you write to us on our WhatsApp, our own AI assistant may reply (it tells you so at the start), and you can always ask to speak to a person. We process your number, your profile name and the conversation in order to reply to you and, if you are interested in Tramoa, to prepare your sign-up: it is what you are asking us for (Art. 6(1)(b) GDPR). The same applies if you write to us by email.
If you do not go on to become a customer, we delete the conversation 12 months after your last message.
Artificial intelligence
Each agency's assistant, and our own, use Claude, an artificial intelligence model made by Anthropic, to understand messages and draft replies using the information the agency has given it.
- What we send it: only what is needed to reply: the conversation, the information about the agency's trips and its instructions.
- Anthropic's role here: a provider that processes the data on our behalf (Anthropic Ireland, Limited), under a contract that includes the European Commission's Standard Contractual Clauses.
- It does not train on the data: Anthropic does not use what we send it to train its models. Nor do we.
- It deletes the data within 30 days at most. It only keeps it for longer if its automated systems flag a conversation for possible prohibited use (up to 2 years) or if a law requires it to.
- Where: Anthropic may process the data in the United States, Europe, Asia and Australia, and stores it in the United States.
- Prices are not decided by the AI: they are calculated by the system using the agency's rates.
- No automated decisions that affect you: the assistant provides information and prepares quotes, but it does not make decisions with legal effects on you, nor does it profile you for that purpose (Article 22 of the GDPR). What matters (accepting a booking, taking payment, cancelling) remains in the hands of the agency and its terms and conditions.
- It can make mistakes. If something does not seem right to you, ask to speak to a person.
Who we share data with
We do not sell data to anyone. To provide the service, we use providers that process data on our behalf (and, in the case of conversations, on behalf of the agency), under a contract that requires them to protect it and not to use it for anything else.
| Provider | What for | Where |
|---|---|---|
| Supabase | Database and files | Ireland (EU) |
| Vercel | The application's servers and the network that delivers the website and protects it against attacks | Ireland (EU); the network, worldwide |
| Cloudflare | DNS, forwarding of email sent to tramoa.com and the anti-bot check on sign-in (Turnstile) | Global network |
| Meta (WhatsApp) | Carrying WhatsApp messages between the customer and the assistant, and Tramoa's notifications and summaries to the people at each agency (Meta Platforms Ireland) | EU and United States |
| Anthropic | The AI that drafts the assistant's replies (Anthropic Ireland) | United States and other countries |
| Speechmatics | Turning the voice notes a customer sends into text, so the assistant can understand them, and the audio recordings in which an agency explains its trips (Cantab Research Limited). It does so on its EU servers, we delete the audio and the text from its servers as soon as it finishes, and it does not use them for training | EU (a UK company) |
| ElevenLabs | Giving a voice to the assistant's replies when the customer writes to it with voice notes (Eleven Labs Inc.). We delete the audio and the text from its servers as soon as it finishes, and it does not use them for training | United States |
| Stripe | Collecting payment for plans (Stripe Payments Europe, Ireland). To prevent fraud and comply with anti-money laundering laws, Stripe makes its own decisions and is responsible for them | EU and United States |
| Resend | Service emails (sent from Ireland) | United States |
| Sentry | Logging technical errors | Germany (EU) |
| Upstash | The request limits that curb abuse | Germany (EU) |
| GitHub | Daily backups, encrypted before they leave our database | United States |
We will also disclose data to the authorities when a law requires us to. If we change a provider or add a new one, we update this list and notify the agencies, as provided in the Data Processing Agreement.
Data outside the EU
The application and the database are in Ireland, and several providers process data in the EU. Others also process it in the United States or other countries (as shown in the table above). In that case the law requires a safeguard, and there always is one:
- The EU-U.S. Data Privacy Framework, the European Commission decision that recognises the protection provided by participating companies as adequate. It is used by Cloudflare, Stripe, Resend, GitHub and ElevenLabs, among others.
- The Standard Contractual Clauses of the European Commission, included in the contract. They are Anthropic's safeguard and the fallback safeguard for the others should the Framework cease to be valid.
- The adequacy decision for the United Kingdom (Commission Implementing Decision (EU) 2025/2574): Speechmatics is a British company, although it transcribes on its EU servers.
- Meta uses the transfer mechanisms permitted by the GDPR for WhatsApp.
If you would like a copy of these safeguards, ask us at contact@tramoa.com.
How long we keep data
| Data | How long |
|---|---|
| The agency's account, settings and content | For as long as it uses Tramoa, and for 30 days after its assistant stops replying. After that, they are deleted. |
| Conversations of an agency's customers | Whatever the agency decides. If it does not change anything, 24 months from the last message. If the agency leaves Tramoa, 30 days from when its assistant stops replying. |
| Passports and travel documents | 30 days after the return from the trip, or sooner if the agency deletes them. |
| Invoices and tax data | 6 years, as required by law (Article 30 of the Spanish Commercial Code). |
| Sign-ins and change history | 2 years, for security. If the agency cancels its plan, they are deleted along with everything else. |
| Messages between Tramoa and the people at an agency on WhatsApp | While the agency uses Tramoa, and 30 days from when its assistant stops replying. |
| Conversations with Tramoa of people who do not go on to become customers | 12 months from the last message. |
| Backups | Each daily backup, which is encrypted, is deleted automatically after 90 days. This is why something that has been deleted may remain in a backup for up to 90 days, without anyone using it except to restore the service. |
| The copy of messages on WhatsApp (Meta) | Up to 30 days, so that a message can be resent if something goes wrong. |
| The copy at Anthropic | Up to 30 days. Up to 2 years if its systems flag a conversation for possible prohibited use, or whatever a law requires. |
How we protect data
- Encryption of everything in transit (HTTPS) and of what is stored in the database.
- Each agency is isolated: none can see anything belonging to another, either through the dashboard or through a coding error.
- Protected access: an optional security code at sign-in, an alert when someone signs in from a new device, roles for each person and a limit on open sessions.
- WhatsApp permissions and keys, encrypted.
- Daily, encrypted backups, and a change history.
- Limits that curb abuse attempts and automated programs.
Have you found a security flaw? Write to us at contact@tramoa.com: we will look into it straight away and tell you what we have done.
No measure is infallible. If a personal data breach posing a risk to people were to occur, we would notify the Spanish Data Protection Agency (AEPD) within 72 hours and, if the risk is high, the people affected. If it affects the conversations of an agency's customers, we notify the agency without delay so that it can do the same.
Your rights
At any time, you can ask us for:
- Access: to know what data about you we process and to receive a copy.
- Rectification: to correct any data that is wrong.
- Erasure: for us to delete it, except for what the law requires us to keep.
- Objection: to what we do on the basis of legitimate interest.
- Restriction: for us to stop using it while we deal with your request.
- Portability: to receive it in a format that can be taken to another service.
Write to us at contact@tramoa.com (if you run an agency, preferably from your account email). We will reply within one month at most; if the request is complex, we may extend this by two further months, and we would let you know. We may ask you for something to check that it is really you.
If you wrote to an agency on WhatsApp, it is the agency that decides about your data: see your section.
If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es, C/ Jorge Juan 6, 28001 Madrid).
How to delete your data
The route depends on who you are. In every case, if something does not work, write to us at contact@tramoa.com.
If you run an agency
- Disconnect WhatsApp: in your dashboard, Settings → WhatsApp → Disconnect. We immediately delete the permission Meta gave us and the assistant stops replying. You can also remove the permission from your Facebook account settings, in the Business integrations section.
- Cancel your plan: Settings → Plan → Cancel. Your data is deleted 30 days after the assistant stops replying, except for invoices.
- Want it sooner? Write to us from your account email and we will delete it as soon as we have verified your request, within one month at most.
If you wrote to an agency on WhatsApp
- Ask the agency in the same chat (“I want you to delete my data”): the assistant passes your request on to a person at the agency, who deletes your data from the agency's dashboard.
- Or write to us at contact@tramoa.com with your phone number and the name of the agency. We pass your request on to the agency that same day and help it delete your data.
- Whatever is on your own phone, you delete yourself in WhatsApp (by deleting the chat).
If you wrote to Tramoa or visited the website
- Write to us at contact@tramoa.com, or say so in the same WhatsApp chat. We delete it within one month at most; usually, much sooner.
- You delete cookies yourself, from your browser.
Minors
Tramoa is a service for businesses, and the assistant is designed to serve the agencies' adult customers. If a trip includes minors, any data the agency requests about them (for example, their passport) is processed on behalf of the agency and with the same protections. If you believe a minor has given us data without permission, write to us and we will delete it.
Changes to this policy
We may change this policy when the law, our providers or the service change. The version in force is always the one on this page, with its date at the top. If the change is significant, we notify agencies at least 30 days in advance, by email and in the dashboard. We keep previous versions: if you would like one, ask us for it.
This policy is governed by Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights, and other Spanish law.