Privacy Policy

Safuno (“we”, “us”) operates this travel platform and is the controller of the personal data described in this policy.

For any privacy question or request, use the Help centre (topic “Account & sign-in”).

We collect only what we need to arrange your travel and run your account:

• Account details — name, email address, mobile number, country of residence, and a password (stored only as a salted hash; we can never see it).
• Booking and traveller details — names of travellers, dates, destinations, preferences, and where required by the supplier or authority, date of birth and passport or ID numbers.
• Visa documents — copies you give our team for visa applications.
• Payment records — amounts, currency, method and references. We do not store full card numbers.
• Communications — messages you send us through the Help centre or by email.
• Security and technical data — sign-in times, IP address, browser type and security events (for example failed sign-ins), used to protect your account.

We share personal data only as needed to deliver what you booked or when the law requires it:

• Travel suppliers — hotels, airlines, tour and transfer operators and insurers — for the bookings you make.
• Embassies, consulates and visa centres, for visa applications you ask us to submit.
• Service providers that host our systems, send email and process payments, under contracts that require confidentiality and security.
• Authorities, when we are legally required to.

We never sell your personal data.

Travel is international, so data may be sent to suppliers in the countries you visit. Where we transfer data to service providers in other countries, we use contractual safeguards (such as standard contractual clauses) and check that the provider protects it appropriately.

• Account data — while your account is open.
• Bookings, invoices and payment records — for the period required by accounting and tax law (typically 5–10 years).
• Visa document copies — only until the application is complete, unless you ask us to keep them for future trips.
• Security logs — up to 12 months.
• Booking-form drafts kept in your browser while you sign in — deleted after 2 hours or when the booking is placed.

We follow information-security practices aligned with ISO/IEC 27001 and ISO/IEC 27701, including: encrypted connections (TLS); passwords stored with a slow, salted hash; optional two-step verification; sessions held in secure, http-only cookies; account lock-out after repeated failed sign-ins; encryption of sensitive secrets at rest; role-based staff access; and audit logging of security events.

We will never ask for your password or two-step codes. If you suspect misuse of your account, change your password, use “Sign out everywhere” in your account, and contact us.

Depending on where you live, you can:

• Access and portability — download a copy of your data from Account → Privacy & data.
• Correction — update your profile in your account, or ask us to correct anything else.
• Erasure — request deletion of your account from the same page. We erase or anonymise your data except records the law requires us to keep.
• Objection and restriction — object to processing based on legitimate interests, or ask us to restrict it.
• Withdraw consent — unsubscribe from marketing at any time.
• Complain — to your local data-protection authority.

We answer requests within 30 days. To protect you, we may need to confirm your identity first.

We use only what is necessary to run the service:

We do not use advertising or cross-site tracking cookies.

Accounts are for adults aged 18 or over. Parents or guardians may book for children and provide their details.

If we make significant changes we will tell you by email or in your account before they take effect.