California and US state notice · Effective July 14, 2026
Your US state privacy rights.
California’s notice at collection and the rights available in US states with comprehensive privacy laws.
Notice at collection
UpTrip may collect identifiers and contact information; customer records; internet or electronic activity used for security; destinations and locations you enter (not device-derived precise location); travel and loyalty preferences; commercial interaction records such as saved hotels; support content; and inferences such as a hotel match score. The global collection table gives examples, sources, whether fields are required, and linked retention periods.
Business purposes
UpTrip uses these categories to provide accounts, hotel matching, trip and shortlist tools, invitations, transactional communications, support, security, debugging, legal compliance, and optional user-authorised provider synchronization. Service providers receive only the categories needed for their contracted purpose.
Category, source and recipient map
| California category | Sources and purposes | Service-provider categories |
|---|---|---|
| Identifiers and customer records | You and Auth0; account access, invitations, support, privacy requests and transactional messages. | Hosting/security, authentication, database and transactional email. |
| Internet or electronic activity | Your browser and service infrastructure; session delivery, abuse prevention, debugging and audit. | Hosting/security and authentication; bounded status records may be stored in the database. |
| Entered destination, commercial interactions and preferences | You; trips, saved hotels, loyalty profile, requested hotel features and matching. | Hosting/security and database; AwardWallet only if you separately authorise Account Access. |
| Inferences | UpTrip’s deterministic match policy; hotel-fit ranking and visible explanations. | Hosting/security and database. |
| Potential sensitive personal information | Auth0 handles account credentials that UpTrip does not receive. UpTrip tells people not to include diagnoses, medical history or other health details in free text and does not use sensitive information to infer characteristics. | Authentication for credentials; hosting/security and database may handle information a person nevertheless submits in free text. |
Preceding 12 months
During the preceding 12 months, UpTrip did not sell personal information, share personal information for cross-context behavioral advertising, use personal information for targeted advertising, use or disclose sensitive personal information beyond purposes necessary to operate the service, or offer financial incentives related to personal information.
California categories disclosed for a business purpose
Infrastructure, authentication, database and transactional-email providers may receive identifiers, account records, electronic activity and user-submitted content solely to provide their contracted service. AwardWallet public point values contain no user data; optional Account Access is disabled until partner approval and individual permission. See Subprocessors.
Your rights
Where a state law applies, you may ask to know/access, correct, delete, obtain a portable copy, opt out of sale/sharing/targeted advertising or certain profiling, limit sensitive-information use, and appeal a refusal. UpTrip provides these choices voluntarily where feasible even before a statutory business threshold is met. We will not discriminate against you for exercising a right.
How to exercise a right
Use Your Privacy Choices; no account is required. A signed-in user may use Data controls to download an account export. We may verify control of the email or authenticated account and may ask an authorised agent for proof of authority. Parents or guardians may submit a request concerning a child, although UpTrip is an adults-only service.
Global Privacy Control
When a browser exposes Global Privacy Control, UpTrip’s preference centre treats it as an opt-out of analytics, marketing, sale, sharing and targeted advertising. Those activities are already off. The signal is honoured without requiring an account. A cookie choice cannot override GPC for those categories.
Do Not Track and third-party collection
UpTrip does not currently respond to the older, non-standard Do Not Track signal. It does respond to GPC as described above. UpTrip runs no advertising or analytics trackers and is not aware of third parties collecting personal information across the public site over time. Necessary hosting and authentication providers may process technical data to deliver their service.
Appeals and complaints
If UpTrip denies a state request, select “Appeal a privacy decision” in the request form. California residents may contact the California Privacy Protection Agency or California Attorney General.