Privacy Policy

Baha Buddy — operated by Novio Group
Effective Date: June 14, 2026 | Last Updated: June 14, 2026

1. Introduction

Welcome to Baha Buddy (“we,” “our,” or “us”), a travel planning application for the Bahamas operated by Novio Group. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use the Baha Buddy mobile application and related services (collectively, the “Service”).

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy.

2. Information We Collect

2.1 Information You Provide

• Account Information: Email address, password (hashed), display name, and profile photo (optional)
• Travel Preferences: Trip destination, travel dates, party type (couple, family, solo, group), travel interests, budget preferences
• Chat History: Conversations with the Baha Buddy AI assistant, including trip queries and planning requests
• Payment Information: Billing details processed through Stripe (we do not store full card numbers)
• Voice Input: Audio transcribed via OpenAI Whisper when you use voice search features

2.2 Information Collected Automatically

• Usage Data: Features used, screens viewed, session duration, button taps, and in-app navigation patterns
• Device Information: Device type, operating system version, unique device identifiers, app version
• Crash Reports: Error logs and crash data collected via Firebase Crashlytics
• Push Notification Tokens: Device tokens for sending trip reminders and updates (via Firebase Cloud Messaging)
• IP Address: Used for security, fraud prevention, and approximate location-based features

2.3 Information from Third Parties

• Flight Data: Search queries and results via Duffel API
• Place Data: Location details retrieved from Google Places API based on your search queries
• Restaurant Data: Availability and reservation data from our restaurant data providers

3. How We Use Your Information

We use your information to:

• Provide the Service: Process trip searches, generate AI-powered recommendations, and facilitate bookings
• Personalize Your Experience: Tailor recommendations based on your interests, party type, and past interactions
• Process Payments: Charge for subscription plans and booking commissions via Stripe
• Send Communications: Deliver trip reminders, booking confirmations, and service announcements via ZeptoMail
• Push Notifications: Send personalized travel updates via Firebase Cloud Messaging
• Improve the Service: Analyze usage patterns (via Mixpanel) to enhance features and fix bugs
• Safety & Security: Detect fraud, prevent abuse, and enforce our Terms of Service
• Legal Compliance: Meet our obligations under applicable laws

4. AI Processing Disclosure

Baha Buddy uses artificial intelligence services to power the travel planning chat feature:

• Anthropic Claude: Your chat messages are processed by Anthropic’s Claude AI models to generate travel recommendations and responses. Messages are sent to Anthropic’s API in real time.
• OpenAI Whisper: When using voice input, your audio is sent to OpenAI for transcription.

AI conversations are stored in your account history to provide continuity across sessions. You may delete your chat history at any time through account settings.

5. Third-Party Services

Each third party maintains their own privacy policies governing their use of your data.

6. Data Retention

• Account Data: Retained for the life of your account plus 90 days after deletion
• Chat History: Retained for 12 months; you may delete at any time
• Payment Records: Retained for 7 years as required by financial regulations
• Crash Logs: Retained for 90 days
• Analytics Data: Retained for 24 months in anonymized/aggregated form

7. Your Rights & Choices

All Users

• Access: Request a copy of your personal data
• Correction: Update inaccurate information through account settings
• Deletion: Delete your account and data (Settings → Account → Delete Account)
• Opt-Out: Unsubscribe from marketing emails via the unsubscribe link
• Push Notifications: Disable via device notification settings

California Residents (CCPA/CPRA)

• Right to Know what personal information is collected
• Right to Delete your personal information
• Right to Opt-Out: We do not sell personal information
• Right to Non-Discrimination
• Right to Correct inaccurate personal information
• Contact: privacy@noviogroup.com (subject: “CCPA Privacy Request”)

GDPR (EEA Residents)

Lawful basis for processing: (a) contract performance, (b) legitimate interests, (c) consent for marketing. Contact privacy@noviogroup.com to exercise your rights.

8. Children’s Privacy (COPPA)

Baha Buddy is not directed to children under 13. We do not knowingly collect personal information from children under 13. Users must be at least 13 years of age to create an account.

9. Data Security

• Encrypted data transmission (TLS 1.2+)
• Encrypted data storage via Supabase with Row-Level Security (RLS)
• API keys stored server-side only (never exposed to clients)
• Regular security reviews

10. Changes to This Policy

We will notify you of material changes via email or in-app notification at least 30 days before the change takes effect.

11. Contact

Novio Group | privacy@noviogroup.com | https://noviogroup.com