At TravelDesk, we are committed to protecting the privacy and security of the personal data of our users, connected companies, business partners, commission agents, authorized collaborators, administrators, and customers associated with our services.
This Privacy Notice explains how we collect, use, protect, and, when necessary to operate our services, share the information processed by TravelDesk, including the main platform, operational integrations, and the TravelDesk Connect mobile app.
TravelDesk Connect is a tool intended for business partners, commission agents, and authorized administrators for profile registration, document validation, reservation and commission tracking, operational notifications, and connection with Stripe Connect for payouts or commission payments. It is not intended for minors.
Information We Collect
Depending on the service used, TravelDesk may collect or process the following categories of personal data:
- Contact data: first name, last name, display name, email address, billing email address, telephone number, and country code.
- Reservation and operational data: data necessary to create, manage, confirm, modify, or track reservations, contracted services, dates, times, companies, customers, confirmations, and operational statuses.
- Identity and tax data: legal name, tax address, RFC or Tax ID, masked Tax ID, identification documents, tax certificates, and digital acceptance of agreements.
- Photos and files: profile photo, identification documents, tax documents, and files selected by the user from the camera, gallery, or document picker.
- Authentication and security data: session tokens, access codes, session status, internal identifiers, and data necessary to protect partner and administrator accounts.
- Device and notification data: generated device identifier, Expo Push token, native notification token, platform, app version, and notification routing data.
- Commercial activity: commissions, attributed reservations, commission statuses, reports, related companies, customer data visible in activity, payment or payout statuses, and operational metrics.
- Data related to payment providers: Stripe Connect account identifier, Stripe status, required actions, and ability to receive payments, where applicable.
Credit or debit card data is processed by external payment providers such as Stripe, as appropriate. TravelDesk does not store full bank card numbers within TravelDesk Connect.
Use of Information
Information is used for the following purposes:
- Creating, operating, and managing accounts, profiles, reservations, connected companies, and authorized users.
- Facilitating the management of reservations, confirmations, operational communications, and customer follow-up.
- Validating partner or commission agent profiles, reviewing documents, and preventing duplicate registrations, fraud, or misuse.
- Tracking attributed reservations, commissions, reports, payments, payouts, and commercial statuses.
- Sending notifications, emails, transactional messages, or operational notices related to reservations, services, commissions, companies, reports, support, and security.
- Enabling, where appropriate, Stripe Connect flows for payouts or commission payments to eligible partners.
- Providing support, resolving incidents, investigating attribution or commission issues, and improving service operation.
- Meeting legal, tax, accounting, contractual, regulatory, audit, and security obligations.
Data Protection
TravelDesk applies reasonable administrative, technical, and organizational measures to protect information against unauthorized access, loss, misuse, alteration, or disclosure.
- Access restricted to authorized personnel or users according to their role.
- Use of credentials, tokens, and session controls to protect accounts.
- Secure storage of certain session data on mobile devices through native mechanisms such as SecureStore, where applicable.
- Infrastructure, servers, and technical services used to operate the platform.
- Internal controls for support, document review, operations, and fraud prevention.
No system is completely infallible; therefore, TravelDesk maintains reviews and controls to reduce risks and protect the confidentiality, integrity, and availability of information.
Information Sharing
TravelDesk does not sell or trade personal data. Information may be shared only when necessary to operate the platform, provide the service, meet legal obligations, or protect the security of users and connected companies.
Data may be processed through providers or processors such as:
- TravelDesk API and internal systems: to operate accounts, reservations, companies, documents, commissions, reports, and support.
- Stripe and Stripe Connect: for payment processing, onboarding, validation, and the status of accounts related to payouts or commission payments.
- Expo Push Notification Service: to deliver operational notifications using notification tokens.
- Infrastructure, hosting, technical support, transactional messaging, email services, and operational tools: to maintain, protect, and provide the services.
- Meta's WhatsApp Business Cloud API: when a connected company enables transactional communications through WhatsApp.
Where there is a legal obligation, a request from a competent authority, fraud prevention, or the defense of rights, TravelDesk may retain or share information in accordance with applicable regulations.
Data Retention
TravelDesk retains data for as long as necessary to operate the services, maintain accounts, manage reservations, process commissions, handle support, and meet legal, tax, accounting, contractual, regulatory, audit, security, and fraud prevention obligations.
Some data related to identity, tax documentation, payments, payouts, commissions, reports, reservations, or audits may be retained for additional periods where there is a legal obligation or an applicable legitimate interest.
When information is no longer necessary for the purposes described and there is no obligation to retain it, TravelDesk may delete, anonymize, or block it in accordance with its internal processes.
User Rights and Account Deletion
Users may request access, rectification, cancellation, objection, restriction of use, or deletion of their personal data by writing to support@traveldesk.mx or using the support channels available in the app or platform.
In TravelDesk Connect, the app includes a support option to request account deletion. To protect account security, TravelDesk may request additional information to verify the applicant's identity before processing the request.
TravelDesk will respond to these requests within an estimated period of up to 15 business days, subject to identity verification and applicable legal or contractual obligations.
Some requests may be subject to exceptions related to legal, tax, accounting, payment, fraud prevention, contractual compliance, dispute resolution, or audit matters. In such cases, TravelDesk may retain only the information necessary for the required period.
Connected companies may manage requests related to their own customers in accordance with their contractual relationship and applicable responsibilities.
Communications and Notifications
TravelDesk may send operational communications by email, push notifications, WhatsApp, or other enabled channels, only when necessary to operate the service or follow up on a user interaction.
- Confirmations, reminders, or changes related to reservations.
- Support, security, or account administration messages.
- Notifications about commissions, payments, payouts, reports, available companies, or commercial activity.
- Review requests or follow-up after a service.
We do not send promotional communications without consent when such consent is required by applicable regulations. Push notifications can be managed through the device settings.
Use of WhatsApp Business
TravelDesk may integrate with Meta's WhatsApp Business Cloud API to allow companies using the platform to send transactional communications related to their services.
When a company activates this integration, TravelDesk may process and use data such as name, telephone number, email address, reservation details, date, time, contracted service, confirmation number, and operational data necessary to send automated reservation confirmation, update, or follow-up messages.
TravelDesk does not use WhatsApp to send promotional messages without consent when required. WhatsApp communications are limited to messages related to reservations, requested services, confirmations, reminders, operational changes, or post-service review requests.
Each connected company retains responsibility for its WhatsApp Business account and for the authorization granted to TravelDesk to operate that integration. Users may ask the corresponding company to stop sending them WhatsApp communications.
Data Sharing with Meta
To operate the WhatsApp Business integration, certain data may be sent to Meta Platforms, Inc. and its affiliated companies in accordance with the applicable WhatsApp Business Platform policies.
This data may include the recipient's telephone number, the content of the transactional message, technical identifiers of the WhatsApp Business account, message identifiers, delivery status, and metadata necessary for the communication to function.
TravelDesk does not sell or trade personal data derived from the use of WhatsApp Business.
Purpose of Processing in WhatsApp Business
Data processed through WhatsApp Business is used to:
- Send automated reservation confirmations.
- Send updates related to a reservation or service.
- Notify users of important operational changes.
- Follow up on an experience or request a review.
- Record message sending, delivery, or error status.
These purposes are operational and transactional. Any promotional use will require the corresponding legal bases and consents where applicable.
Changes to This Privacy Notice
TravelDesk may update this Privacy Notice to reflect legal, technical, operational, product, or provider changes. When changes are significant, an updated version will be published on the website or through TravelDesk's official channels.
Continued use of the services after an update is published implies awareness of the current version, without prejudice to the rights of each user under applicable regulations.
Last updated: 15 June 2026