Privacy policy

1. Information we handle

• Information you provide: your name, contact details, account information, travel dates, destinations, preferences, questions, itineraries, and any messages, screenshots, images, or other attachments you send us.
• Messaging information: your platform username and identifiers, conversation and message identifiers, timestamps, message content, attachments, and available delivery or interaction information.
• Purchase information: the service purchased, payment status, transaction references, and information needed for support or refunds. Stripe processes checkout payment details; ChinaPal's checkout does not store your full payment-card number.
• Website activity: device and browser information, IP address, pages visited, referral information, interactions, and technical logs collected through our hosting and analytics services.

Information comes from you, the messaging platforms you use to contact us, payment and account services, and your use of our website. Share only what is needed for your request, and redact passwords, card numbers, identity documents, and unrelated information from screenshots. If you share details about travel companions, make sure you are entitled to do so.

2. How we use information

We use information to answer inquiries, explain our services, plan trips, provide concierge support, maintain conversation context, manage accounts and purchases, handle refunds and complaints, improve the website, protect our systems, and meet applicable recordkeeping obligations. Without the details needed for a particular request, we may be unable to provide that service.

Where a legal basis is required, we rely on performing a contract or taking steps you request before a purchase; our legitimate interests in providing, securing, and improving the service; legal obligations; and consent where required. You may object to processing based on legitimate interests and withdraw consent by contacting us. Withdrawal does not affect processing that was lawful before it was withdrawn.

3. Instagram messages and AI assistance

When you contact ChinaPal on Instagram, our team can read and reply to your messages there. When our API integration is enabled, it can also retrieve available conversation history and receive new messages and attachments for our internal support inbox. This access concerns conversations with ChinaPal; it does not give us access to your unrelated private chats or your Instagram password.

We use AI tools, including ChatGPT/OpenAI, and may use Anthropic-powered planning tools, to help understand questions and images, translate, prepare recommendations, and draft replies. Relevant message text, screenshots, attachments, and conversation context may be submitted to these providers for processing. Their handling of that information also depends on the product used, its terms, and its privacy settings.

Our Instagram reply workflow uses AI to assist the team: a person reviews and approves a draft before it is sent. AI can make mistakes, and you can ask our team to clarify or correct a response. We do not use Instagram message content for advertising or sell that content.

4. Who receives information

ChinaPal team members handling your inquiry or trip can access relevant information. We also use service providers for specific functions:

• Vercel: website hosting and server operations.
• Supabase: account services and database storage, including support records when the integration is enabled.
• Stripe: payment processing and related transaction records.
• Meta/Instagram, WhatsApp, and email providers: communications through the channels you choose.
• AI providers: processing the information supplied for planning, analysis, translation, and drafting as described above.
• PostHog, Microsoft Clarity, and Google where enabled: website analytics and advertising measurement as described below.

We may share relevant information with a travel supplier when needed to carry out a request you make, or with authorities and advisers where legally required or necessary to address fraud, security incidents, or legal claims. External booking sites and messaging platforms have their own privacy policies.

Some itineraries are provided as shareable webpages. Anyone who has or finds a publicly accessible itinerary link may be able to view its contents. Treat these links carefully and contact us if an itinerary contains information you want removed.

5. Cookies, browser storage, and analytics

The website uses cookies and browser storage for account sessions and site functionality. Some chat information may be stored locally in your browser. PostHog helps us understand page visits and interactions. Microsoft Clarity provides interaction metrics, heatmaps, and session replay to help us understand and improve how the website is used. These tools may use cookies and similar technologies and collect device, usage, and page-interaction data.

Microsoft may also use the information it collects for its own purposes, including advertising, as described in the Microsoft Privacy Statement. Where Google Ads measurement is enabled, Google receives activity and conversion information to measure advertising performance; see Google's explanation of partner-site data.

You can control or delete cookies and site storage through your browser settings and use the privacy controls offered by these providers. Blocking storage may affect sign-in and other features. This policy describes our use of these tools; it is not itself a request for cookie consent.

6. Storage, security, and retention

Our team and service providers may process information in China, the United States, Canada, and other countries where they operate. Privacy protections may differ from those in your country. Contact us for details about the providers and transfer arrangements relevant to your information.

Retention depends on the purpose: ongoing travel support and follow-up, account administration, resolving refund requests or disputes, security, and applicable legal recordkeeping periods. We retain information only as long as needed for those purposes. Deletion is handled through the request process below; messages are not automatically deleted when a support pass ends.

We use access controls and technical safeguards appropriate to the systems involved. No internet transmission or storage system is completely secure.

7. Your rights and data deletion

Depending on the law that applies to you, you may have rights to access, correct, delete, or receive a copy of your information; restrict or object to processing; withdraw consent; and complain to your local data-protection authority. Contact us at the email below to exercise these rights.

You can request deletion of personal information held by ChinaPal, including Instagram conversation data, images, AI drafts, and customer records associated with you. You do not need a website account to make a request.

1. Email chinapal_travel@outlook.com with the subject Data deletion request.
2. Include the Instagram username or email address you used with ChinaPal, and tell us whether you want all associated information deleted or only particular conversations or records. Approximate conversation or trip dates can help us find the records. Please do not send passwords, payment-card details, or identity documents with your initial request.
3. We handle requests manually and may ask you to confirm ownership of the relevant account. We will respond within the period required by applicable law and explain the outcome, including any information we must retain and why.

We delete information within our control that is no longer needed and request deletion from service providers where applicable. Certain payment, tax, fraud-prevention, or dispute records may need to be retained. Backup copies may remain until they are overwritten under the relevant backup lifecycle.

A request to ChinaPal does not delete your Instagram account or messages held independently by Meta or another messaging platform. Likewise, deleting a message in Instagram does not necessarily delete copies already used by ChinaPal. Use the request process above for those copies. Information stored only in your browser can be removed by clearing this website's site data; doing that does not remove records held on our servers.

Open the standalone data-deletion instructions.

8. Children and family travel

Our service is intended to be arranged by an adult traveler or group organizer. Please avoid sharing identifying information about children unless it is necessary for your request. Contact us if you believe a child has provided personal information that should be removed.

9. Changes and contact

We will update this page when our practices change and revise the date at the top. Where required, we will provide additional notice of material changes. Questions or requests can be sent to chinapal_travel@outlook.com.