Privacy Policy
What personal data we collect, why, and the rights you have over it.
Last updated 2026-09-09 · Operated by B.Army
This policy describes how B.Army collects and processes personal data when you visit https://travelopen.ai and when your organisation uses TravelOpen.
It is written to comply with Decree 13/2023/ND-CP on personal data protection (Vietnam).
1. Two different roles
Two situations must be kept apart, because the legal responsibility differs:
When you browse this website — we are the data controller. We decide what is collected and why.
When a property uses TravelOpen to manage its guests — the property is the controller and we are the processor. We process guest data only on the property's instructions, never for our own purposes. Details are in the Data Processing Addendum.
If you stayed at a property that uses TravelOpen and want to exercise your rights over your data, contact that property directly. We will assist them in responding to you.
2. What we collect on this website
When you submit a contact or demo form: name, email, phone number, property name, property size, and whatever you write in the message. Used to respond and to discuss the service. Legal basis: your consent, given by submitting the form.
When you browse: anonymous measurement via Plausible Analytics — page views, referrer, device type, country. Plausible sets no tracking cookies and builds no identifiable profile.
When you use the support chat: the message content and any contact details you provide, via Chatwoot.
We do not collect sensitive personal data through this website and we do not run retargeting advertising.
3. Who we share it with
We do not sell personal data. Data is shared only with the service providers needed to run the service:
| Provider | Purpose | Processing location |
|---|---|---|
| Amazon Web Services | Servers and databases | Singapore |
| Cloudflare | CDN, DDoS protection, secure tunnel | Global |
| Vercel | Marketing site hosting | Global |
| Resend | Transactional email | United States |
| Plausible Analytics | Anonymous traffic measurement | European Union |
| Chatwoot | Live support chat | Self-hosted |
We may also disclose data where a competent authority requires it through due legal process.
4. Cross-border transfers
Some of the providers above process data outside Vietnam. We carry out such transfers in line with Decree 13/2023/ND-CP, including preparing and retaining the required cross-border transfer impact assessment dossier.
5. Retention
Contact form data: kept for up to 24 months after the last exchange, unless a contractual relationship begins.
Customer operational data: kept for the term of the contract plus 30 days after termination to allow export.
Audit logs: kept for 12 months.
6. Security
Data is encrypted in transit (TLS) and at rest. Internal access follows least privilege with role-based permissions. Every AI agent action is written to an audit log.
In the event of a personal data breach we notify the affected Customers and the competent authority within the statutory deadlines.
7. Your rights
Under Decree 13/2023/ND-CP you have the right to be informed, to consent and withdraw consent, to access, to rectify, to erase, to restrict processing, to object to processing, to obtain a copy of your data, and to complain, denounce or bring legal proceedings.
Send requests to support@travelopen.ai. We respond within 72 hours.
8. Changes
Where we make a material change we update this page and notify active Customers by email at least 15 days beforehand.
9. Contact
B.Army — support@travelopen.ai