Wander Window is a workspace for travel advisors, their teams and the clients they invite. This Privacy Policy explains what Wander Window LLC collects, why we use it, who receives it, and how to request access, correction or deletion. It covers the software, including the advisor beta.
A business lead can generate an expiring code for the business's shareable dining catalogue and selected DMCs with their general catalogue tours. Any signed-in advisor who receives that code can preview the business name and item counts, then explicitly import editable copies into their own business. When the code includes an ongoing dining connection, newly added restaurants are also copied when the recipient opens or refreshes Dining. A business in a dining network shares the restaurants it adds after joining (for a business that was already a member when this default began, from that day) with the network's other member businesses by default; a restaurant can be unticked for a network or kept as Only mine, and the business's lead can choose Share everything to send its existing catalogue too. A network manager who is also their business's lead can also publish that business's existing dining and future additions, and a business already published this way keeps sending its whole catalogue. A restaurant a business received from someone else is never passed on automatically. Ongoing connections do not pass on restaurants a business itself received from someone else, but a new code that includes dining can include them.
The copies contain restaurant facts and descriptions, supplier names, websites and service countries, and tour descriptions, destinations and planning details. Shared dining also includes published restaurant images, captions and attribution, retaining generated-image disclosures and provider-hosted image links. When sharing remains authorized, missing images on previously imported restaurants may be filled; recipient photo choices and removals are preserved. Client-specific tours, client and trip records, private notes, rates, commissions, source documents, client-submitted photos and unpublished image candidates are excluded. We store a hash of each code, selected item identifiers, sender and recipient identities and businesses, connection settings and import progress to prevent duplicate copies and resume interrupted imports. Codes are shown to their creator once. The creator can also have us email a code to an address they enter; we send it through our email provider and don’t keep the address. Expiring a code prevents new joins; an existing dining connection continues until the code is disabled, the recipient stops that connection, or the source loses its authority. Turning off network publishing, ending network membership, or the member business stopping the network’s updates stops further additions. Saved copies remain with the recipient; later sender edits do not overwrite them. Only share content you have permission to distribute, and give codes only to your intended recipients.
A team lead can share a selected DMC or tour operator with a connected agency network. The shared copy includes the supplier name, website and service countries, plus the names, descriptions, durations and destinations of tours the lead selects. The lead reviews this content before sharing. Private rates, commissions, booking links, supplier documents, private notes and client and trip records are excluded. A selected tour's name and description are shared as written, so select general tours, not a tour made for a particular client. Connected advisor teams may read the shared copy. Revoking a share or ending the source team's agency connection stops future access; it cannot erase information a recipient has already read or saved.
Advisors can also share a selected DMC list directly with another advisor’s sign-in email. We store the sender, recipient address, selected supplier names, websites and service countries, invitation status and acceptance. Pending invitations expire after 30 days. The recipient must accept to read the list; private contacts, rates, notes and tours are not included. The sender may revoke future access. Deleting the sender’s account or an accepting recipient’s account removes the direct share.
Agency managers can assign reusable dining-network join codes, including an IATA identifier. A code requests access for a business; a network manager reviews and approves the request. We email the network’s managers and Wander Window’s administrators when a request arrives, and the administrators also see it in their notifications. When a request is approved, we email the person who asked. The requesting business can always see whether it is pending, approved or declined. We store the request, business, requester and reviewer. Designated platform administrators can view business profiles, advisor names, emails, contact numbers, IATA numbers, team roles, network connections, client counts, time zones and websites to operate and support the service. This organization view is separate from the usage report available to authorized platform operators.
Advisor registration requires your first name, last name, email, mobile number and personal sign-in password. An advisor may instead sign up and sign in with Google: no password is set here, Google confirms your email address, and your name comes from your Google account; your mobile number is asked for during setup. We also ask for your own or host agency’s IATA number, if applicable. Your signup email and contact phone are suggested notification destinations; saving contact details does not consent to text messages. Team setup collects your business name, team display name, main planning region and time zone; a business website is optional. Clients receive account invitations from their advisor. An invited client may choose Google instead of a password, using the Google account for the invited email address: Google confirms that address, and the client’s name, mobile number and agreement are still asked for here. A client whose account already exists may also sign in with the Google account for its email address.
If you sign up as an advisor with an address that already has a Wander Window sign-in, we confirm the address again before using that sign-in for advisor setup: with Google, for a Gmail or Google Workspace address, or with a one-time link sent to that address. We record the invitation, the sign-in, which method confirmed the address, when it happened, and whether a business had the address in its contact book (yes or no, never which business). This record is removed when the invitation or sign-in is deleted.
We record a limited set of page and workflow events, your account identifier, your team, your role, the time, and whether you use a phone, tablet or desktop. Authorized Wander Window platform operators can view the cross-team usage report to support and operate the service. An advisor or agency-management role alone does not provide access to this report.
These analytics do not record form contents, passwords, names, email addresses, phone numbers, private notes, messages, supplier documents or exact IP addresses. We do not use session recordings, advertising identifiers or analytics cookies. Events are retained for up to 90 days, with daily deletion of older events, and are removed when the associated account is finally erased.
Wander Window LLC, a New York limited liability company, is responsible for this tool and for the data in it. For anything on this page — a copy of your data, a correction, a deletion — write to support@wanderwindow.travel.
We determine how account administration, service security and product analytics operate. Your advisor business determines what client information it enters and how it uses that information for travel planning; we process that workspace information to provide the service. Depending on applicable law and the processing involved, the advisor business and Wander Window may have different controller or processor responsibilities. Your advisor and suppliers may provide their own privacy notices for their separate services. You may contact us even if you are unsure which business should handle your request.
Your first and last names and email address identify your account. Advisors also provide the business and team details above. Passwords are submitted over an encrypted connection for account creation and sign-in; Supabase handles authentication and stores password hashes. If an advisor or a client chooses Google, Google signs them in and returns their verified email address, name and profile-photo address to Supabase, which keeps them with the sign-in; Google never shares a Google password with us, and we use the address only to find the existing Wander Window account. We do not store plaintext passwords in the application database or include them in product analytics. Profile names are account information, not proof of identity or authority. If an advisor chooses, we copy their Google profile photo once for them to crop and save. We do not load Google profile photos on client pages or in client emails.
When you explicitly agree during registration, invited account setup or advisor setup, or agree again after one of these policies changes, we record your account email, the Website Terms and Privacy Policy versions, the time, setup context, available network address and browser user-agent information. A team identifier may be attached from an existing client grant. We use this record to document the agreement and investigate disputes. A privacy acknowledgment is not blanket permission for unrelated processing, and it does not opt you into texts. Signup email ownership is confirmed separately through the email verification link.
If you ask to join the advisor beta on our Join page, we collect your first and last name, work email and mobile number, and, if you give them, your website, your agency or host agency, your accreditation type and number (such as IATA), how many trips you plan a month, how many advisors on your team will need access, your role, how you heard about us, the destinations or specialties you sell and your note. We use them to review your request, to contact you about it by email or phone, to plan your team's access, and to send you a personal invitation if we offer one. We also record when you agreed to be contacted, which version of this policy was in effect, and when and how many times you sent the form.
Your request is emailed to our support address and copied to Wander Window's founders, and Wander Window's platform administrators can see it in the admin workspace. Our email provider, Resend, delivers those emails and a short confirmation to you. We don't text the mobile number you give on this form, we don't share it, and we don't use it for marketing. Sending the form does not create an account, does not sign you up for texts and does not accept the Website Terms. Sending it again from the same email updates your request instead of adding another. You can ask support@wanderwindow.travel for a copy of your request, or to delete it, without an account.
Your personal account can belong to a private advisor team and separately to a dining network. We record those connections, your roles, invitation recipient email addresses and expiry dates, and who made access or restaurant-library changes. Network managers see their connected team names, the email addresses of people they appoint or invite, and the email addresses of advisors whose network activity, such as submitting, copying or hiding a restaurant, appears in the network's history. A network is not an advisor account and receives no access to your team's clients, trips or private notes. Connected teams receive only what a business shares with them: restaurants it shares with or contributes to the network, with the notes, photographs and reviews marked for sharing, and the supplier and tour details shared through the separate supplier-sharing controls.
Restaurant sharing is a deliberate action, taken in one of two ways. A contributor can submit public restaurant details they have permission to share to the network's library, where another curator or manager reviews them before publication. Network members can read published details and save independent copies into their own team's catalogue for trip planning; those saved copies do not change when the network version changes, is archived, or the team leaves the network. Or a business shares its own catalogue with the network, as described under "Catalogue sharing codes": member businesses then receive copies without a review of each restaurant, photographs can later be added to those copies, and the notes, photographs and reviews marked for sharing are read from the source as they change. Personal hiding affects only your own view; team hiding is controlled by team leads.
Opened restaurant details may show the original contributor and network sharer, using their current advisor name and the team they belonged to when they contributed. Optional advisor feedback records a recommendation, written note, or both, any experience type and month you choose to add, and the trip it came from. You write one note per restaurant and tick which of your dining networks see it (all of them by default). Your name and contribution-time team are shown with it to members of a ticked network who reach the restaurant through it. Businesses linked to the restaurant's business by a sharing code also see the note, without your name or team, unless that business's lead or admin hides it from them. A note written before 26 October 2026 for your private team may since have become network feedback. Feedback on tours stays within your team. Clients do not receive advisor feedback. Avoid including client names, personal details or private supplier terms.
You can edit or remove your own feedback while you have access. A network's managers and curators, and the lead or admin of the business whose restaurant it is, can hide and restore feedback in that network only; that lead or admin can also hide it from businesses linked by a sharing code. Each hide records a reason. Uploading a restaurant does not let someone delete another advisor's feedback. Leaving a network removes access to its discussion; it does not automatically delete your past contributions. Your data export includes your feedback, contributor credit and associated moderation history. Account erasure removes your feedback and recommendations and clears your contribution identity and team snapshots; public restaurant facts and independent copies can remain.
Client invitation setup asks for a mobile number, so your advisor has a way to reach you while you are traveling. Whether we ever text it is a separate choice, and it stays entirely yours — there is a tick box beside the number, it is never ticked for you, and leaving it alone changes nothing about your account or your bookings.
If you do tick it, we record the number, your name and email, the fact you agreed, which version of the wording you agreed to, where and when you agreed, and, when you agree on a sign-up or invitation form, the network address and browser you agreed from, with a history of each change. That record is what proves you asked for these messages rather than being added to a list, so we keep it, with the number, even after your account is deleted (see "Deleting your data"). If you never tick it, the number simply sits on your account and nothing sends to it.
We use it to text you about your trip and nothing else — for example reservation confirmations, your advisor's picks or proposals to review, trip check-ins, sign-in links, reminders when a booking needs an answer, and replies when you contact us for help while traveling. Reply STOP to a message to stop texts from that business's number, turn them all off in My Account, or email us. See the text messaging page for the full terms.
When a business administrator chooses a paid plan or add-on, we send Stripe the account email, business name and an internal business identifier to create or reuse that business's billing customer. For purchases sold through Link, LLC using Stripe Managed Payments, Stripe and Link receive the payment, billing address and tax information entered directly at checkout. Link is the merchant of record and handles receipts, invoices, applicable sales taxes, refunds, disputes and transaction support. Their own privacy notices apply to that processing. We do not receive or store full payment-card numbers or security codes, and we do not send client travel records to Stripe for advisor billing.
We retain provider customer and subscription identifiers, test or live mode, subscription and payment status, billing interval, seat count, service dates and signed billing-event receipts to administer access, reconcile payments and investigate errors. The business's authorized administrators and platform operators can see the billing status permitted by their roles. A data-deletion request made directly to Link can cancel the subscriptions it administers; closing a Wander Window account does not replace a cancellation request for a business subscription. Contact support for help with both.
Businesses that enable optional messaging provide legal and trading names, business type, website, business address, contact details and business registration information. We send these details and consent-workflow evidence to Telnyx and the reviewing carriers to obtain a dedicated number and messaging approval. Stripe handles activation and subscription payments. We retain the accepting account, business, Messaging Agreement version, time and browser information to document the agreement, and a copy of the registration and payment-setup requests and their responses, including these details, as a record of the setup.
Each business has its own number. Message receipts record that business, the sending and receiving numbers, times, delivery status, reported segments and available provider costs, with the client identifier where we can match it. STOP is recorded for the business number you texted, and that record is kept to prevent further texts. Consent and withdrawal history is retained as evidence and is included in your data export.
Inbound text replies are temporarily queued so they can be emailed to your current advisor in the correct business. The queue clears the text after delivery, when a safe recipient cannot be found, or at its next cleanup after 23 hours. If the worker is unavailable, cleanup resumes when it recovers. The delivered email remains with your advisor and our email provider under their retention practices. This queue is not a permanent in-app conversation history. Message receipts and queued replies associated with your consent address are included in your data export and erased with your account data; consent evidence and business agreement records are retained.
| What | Why we keep it |
|---|---|
| Restaurants and experiences you like | So your advisor builds the itinerary around what you actually want, instead of guessing |
| Destinations you save | Your dreaming list, and a signal of what to plan next |
| Walking routes you build and save | So you can reopen them, and so your advisor can refine them |
| Your answers and ratings on the decisions your advisor sends | To settle a choice without a long email thread |
| Notes you write to your advisor | They are messages to them |
| Trip quiz answers | To understand your taste early on |
| Trip proposals, trip updates, Dining confirmations, check-in invitations and submission recaps, with their saved content and sending outcomes | So you and your advisor can distinguish what was proposed, what you answered, and whether sending was accepted, failed or remains uncertain |
| Trip notification events, delivery outcomes, advisor read state and notification preferences | To reliably alert the assigned advisor when you submit answers and show what has been reviewed. Generic alerts contain no dietary answers. A message you write to your advisor is quoted in their email alert as you wrote it (up to 600 characters), including anything you mention about allergies or diet (see private trip conversations below). These records are included in your data export and erased with your account data, including when you are a guest on someone else's trip. |
| Visible quiz, Dining and Tour content | We record the first time a version is displayed in your signed-in Wander Window view, with its trip and content identifier. Your assigned advisor can see these receipts. They do not prove that you read or understood the content, and email delivery or a background page load is not treated as a view. These records are included in your data export and erased with your account data. |
| Dining preferences, including allergies or dietary restrictions, whether anyone in your party has mobility restrictions (and any note you add about them), party size, celebrations, preferred nights, food, atmosphere, drinks, your answers to the dining questions, anything else you ask us to plan around, and the dining profile and brief made from them | To let your advisor tailor restaurants and dining times to your party instead of guessing |
When you submit a quiz, Dining review or Tour answers, we save a recap and queue an email to you. Your advisor sees a corresponding in-app update and receives alerts through their selected channels. Opening an update is not the same as marking the work done. A sending provider accepting a message does not prove you received or opened it; where delivery or opening is unknown, we do not describe it as confirmed.
Your advisor may import an itinerary or supplier document for your exact trip. We temporarily store the source, extraction progress and review corrections so that work can continue after they leave the page. Document text or PDF content is sent to Anthropic for extraction and may contain the traveler or booking details in that source. Your advisor must review the results before approving them. A separately attached supplier proposal PDF is stored privately as an unchanging original; it is not a public catalogue image.
An advisor may connect their own TravelJoy and selected Gmail or Outlook messages through their own Zapier account. Zapier handles the selected source data under that account's settings. Wander Window receives trip fields, client contact details from TravelJoy (name, phone and tags, which are added directly to the advisor's client list) or selected email text; email text is sent to Anthropic to suggest hotel, restaurant and tour booking details. We keep the extracted details, the email's subject line, short supporting excerpts, optional source-message links and private review history, not the full email body or attachments. Each advisor's connection credentials and import list are separate. Imported trip and booking details require advisor review before changing a trip or booking. Accepting an import does not send a client message. Unassigned imports are deleted after 30 days by daily cleanup. Trip-linked imports follow the trip's retention and deletion rules. Disconnecting stops new intake; previously saved records remain until deleted under those rules.
If your advisor adds a profile photo, it appears beside their name on your trip pages and in emails they send you. For advisors, your profile photo is shown to the clients you plan for and in emails sent to them, from a public web address that isn't listed anywhere. Anyone with that address can view it. Removing it stops new pages and emails showing it; cached copies can remain visible on our pages for up to an hour, and email services may keep their own copies longer. Previously sent emails keep your name and may display your replacement photo. We store a cropped, compressed square and a smaller round email image without camera metadata, not the original upload.
Advisors may also upload catalogue photos, with captions, ordering and an explicit cover. Catalogue images can appear with the restaurants or Tours your advisor shares. Generated editorial images are identified as such, not represented as verified photographs of the actual venue. Opening Directions on a restaurant your advisor shares opens Google Maps with the restaurant's name as our catalogue lists it and its Google place identifier, or, for a restaurant without an identifier, only its coordinates. Nothing else is added to that link: not your name or email, and not the title or notes your advisor wrote for you. Other map links, such as those in field guides, shortlists and the Dining map, can carry a place's name and city or its coordinates, but never your name or email.
When answer links are on for your advisor’s business, an email or text about your trip’s options carries a personal answer link. It opens those options on this site so you can choose and send your answers without an account. It opens nothing else: not your other trips, your messages, your Dining preference profile or anyone else’s account, and the page leaves out your hotel’s name and address and your advisor’s surname, because an email can be forwarded. Anyone who has the link can answer as you until it closes, so please don’t forward it.
For each link we keep your email address, the trip and business it belongs to, why it was first sent (a proposal, a trip update, a reminder or a new link) and by whom, when it was last emailed, last opened and last used to answer, when it closes, and whether and by whom it was turned off. We keep a one-way fingerprint of the link’s secret, never the link itself. The secret sits after the “#” in the address, which browsers leave out when they ask for a page, so it does not reach our hosting logs; the page removes it from the address bar first, then sends it only to our server: to open the link, and again if you retry or ask for a new link. A link sent by text passes through our text-message provider and the mobile carriers. Answers sent through a link are saved and shared exactly as your other answers are, marked as having come through a link, and your advisor is told so. A link closes when your trip ends or 60 days after the email, whichever is sooner; your advisor can turn it off at any time, and a new link stops the older ones working. If your link has expired, or a newer email replaced it, that page can email you a new one: it goes only to the address the link was sent to, at most three times a day, and your advisor can see that it was sent. If you ask for an account from that page, we email the same address an invitation (or, if you already have an account, how to sign in). Link records are included in your data export and erased with your data.
Down Time uses the destination, accommodation and plans shared with your trip to suggest a nearby stop. If you choose your current location, your browser asks for permission. The selected coordinates are used to find nearby places and walking directions; they are not attached to your name or email in provider requests. If you describe in your own words what you feel like doing, that sentence and the categories you choose are sent to OpenAI to interpret it, without your name or email.
When you explicitly save a suggestion, we keep its stop, starting and finishing points and planning choices with your account so you can reopen it on another device. A saved starting point is not continuous location tracking. Opening a directions link sends that walking leg's coordinates to Google Maps. When commercial weather service is enabled, Open-Meteo receives the coordinates, day and timezone for a forecast.
If you turn on live location in the Christmas Markets tab, it stays on your device, is never sent to us or stored, and stops when you leave the tab or after 30 minutes.
While it is on, the map shows your position, so the map provider serves map images of the area around you.
In the Christmas Markets season, we email each traveler on a trip about the markets in the cities they will visit: once about a week before the first such stay, and on the morning they arrive in each city. Your advisor can stop these for a trip, and each email has a link to stop them for you. If you stop these emails and later ask us to erase your data, we keep only a scrambled form of your address so we never send them again.
Saving a discovery idea keeps its source reference with your trip and account. If you save it for a free-time window, we also keep your chosen date and time. Your advisor can access these ideas for trip planning. Removing an idea deletes that saved reference and its private planned time; the source listing is unchanged. Saved ideas are included in your account data export and erasure.
Optional live place search sends your search words and destination to Tripadvisor, and suggestions near a starting point send that point's coordinates. Please leave personal and confidential information out of search text. When the event service is enabled, Ticketmaster receives the destination area and selected dates to find events; loading a saved event's current details sends its source identifier. We do not attach your account name, email, reservation details or advisor notes to these requests.
Credited discovery photographs may load from their publisher's servers, which receive your IP address and normal browser request information to deliver the image. Choosing a source, ticket or website link opens that provider's website.
The short Dining check-in separates information that is likely to remain useful from information that belongs only to one trip. Your food preferences, atmosphere preferences, drink preferences, accessibility notes, your answer about mobility restrictions, allergies and dietary restrictions, along with your tour interests and touring style and your answers to the dining persona questions, are saved to a profile so you can review and change them instead of answering from scratch on a future trip. Party size, celebrations, dates, free nights and destination-specific choices stay with the trip they describe.
Allergies, dietary restrictions and mobility restrictions can be sensitive health information. The check-in asks whether anyone in your party has mobility restrictions, so your advisor can check walking, stairs and transfers before booking; you can answer no, yes with an optional note, or ask your advisor to talk it through. These answers are shown to your advisor and their team for planning. When your advisor asks the matching tool for help, we send your check-in answers (your saved preferences, including any mobility answer and note, plus that trip's party size, celebrations, dates and notes, and your dining persona) and a bounded list of restaurants from their own catalogue to OpenAI. We do not attach your account name or email address to that request, and person labels beside dietary needs are replaced with anonymous traveler numbers. Free-text answers still contain whatever you choose to type. The tool can rank only the restaurant identifiers it was given. A match is planning assistance, never a guarantee that a restaurant can safely accommodate an allergy; your advisor must verify that directly.
When your advisor sends the Standard dining questions, the last screen asks you to agree, with a tick box, that Wander Window and your advisor may use the dietary and health details you share to plan your meals and pass them to the restaurants they book for you. We record that agreement with the version of this policy and the exact questions you were asked. Without it, those answers are not saved.
When your advisor books a restaurant for you, they may pass your party's allergies and dietary needs to that restaurant so it can prepare. Please also confirm them with your server when you arrive.
Your answers to the dining questions produce a short dining profile, written from fixed texts by our software, and a planning brief. Both are for your advisor and their team. Neither one is a medical or safety assessment.
Your answers also give your party a dining persona, chosen by our software from fixed rules, with no AI. The recap email we send you after you submit names it, in a few fixed lines, and your advisor sees the same persona. It is a light reading of your taste, not a medical or safety assessment, and it never says a restaurant can accommodate a dietary need.
“Anything else we should plan around?” is saved in your own words and shown to your advisor and their team as you wrote it. Please share there only what you want your advisor to use.
When an advisor describes restaurants, tours or DMCs to find, OpenAI receives that description and relevant catalogue text to interpret and rank the results. Catalogue text, including advisor knowledge notes, may also be sent to OpenAI to create search embeddings. Advisors' restaurant reviews, including reviews shared in a dining network their business belongs to, are also used to rank these searches, without the names of the advisors who wrote them. This search sends no client or trip records to OpenAI; a search started from a trip reads only that trip's destinations to narrow the results. Free text still contains whatever the advisor types; advisors should keep personal and confidential information out of searches and catalogue notes. We record search counts, result counts and timing, rather than saving the search description in our search metrics.
For official-site research, our server retrieves the website selected for a catalogue item. Where configured, Firecrawl receives the public website URL to retrieve readable pages. OpenAI receives the item name, destination and retrieved text to identify quoted source details for advisor review. Advisor knowledge notes are attributed to their author and visible within their team; sharing with connected dining teams is optional. Source checks and proposed changes are retained with the catalogue item. Operational research jobs and search metrics are retained for up to 90 days.
Your advisor can create destination field guides and share published versions with your trip. A shared guide is open to you while you have access to that trip; it closes when your trip access ends or your advisor withdraws it. We store the guides and stories you choose to save, and when you open a shared guide. Saved items are included in your data export and removed on account erasure. Saved items from closed guides are removed by scheduled cleanup using a 90-day retention window; cleanup runs in limited batches. Questions use the existing private trip conversation. Your advisor can also choose to email you a link to a guide when they add it to your trip or update it; adding a guide never emails you by itself. That email shows your advisor’s name via Wander Window, carries the guide’s title, cover, introduction and any note your advisor adds, and your replies go to your advisor.
Advisors can invite another advisor to view a published guide, permit an independent copy, or choose to make it discoverable by other active advisors. Draft edits and client-trip details are not included in these advisor shares. Invitations use the recipient’s account email and appear in the app; no invitation email is sent. Removing source access does not remove a personal copy already made with permission, including its original author credit. Uploaded destination photographs use public image URLs; they should not contain private traveler information. Music, book and film links open the separate provider’s website when selected.
When an advisor deletes a guide, it becomes unavailable to its recipients and remains recoverable by the advisor for 30 days. After that period, scheduled cleanup erases its content in limited batches. The record that a guide was sent to a trip is kept, and independent copies others made with permission remain theirs. Restoring a guide does not automatically share it again. Guides archived before this deletion feature have no automatic 30-day erasure clock. Uploaded photographs are removed only when no retained guide, publication or trip release still uses them.
When an advisor requests writing help, the selected wording, section heading, guide title and city, and requested edit are sent to Anthropic. Recognized email addresses and phone numbers in the submitted wording, heading, title and edit instruction are replaced with temporary placeholders before transmission; other personal information in the text can remain. Suggestions require the advisor's review and do not publish automatically. Accepting a suggestion saves it as normal Field Guide draft content.
Wander Window does not save the selected wording, edit instruction or suggestion as a separate AI conversation. We retain operational usage, cost and quota records, including model and token usage needed to account for a request or resolve an incomplete charge estimate. These records do not contain the submitted wording or suggestion.
Some photographs in your trip, field guides and recommendations are credited Unsplash photographs. Your browser loads them from Unsplash's servers, which receive your IP address and the ordinary information a browser sends with any request, such as its type and language; the referrer they receive is our site's address only, not the page you are reading. A photograph your advisor links from another website loads from that website in the same way. Advisors' previews in the field guide studio load photographs from Unsplash and Wikimedia Commons.
Our host records standard server logs, including IP addresses, for security and reliability. When you sign in, we record that in our own audit trail, along with the network address and browser details you signed in from, so we can investigate anything that looks wrong with an account. The same audit trail records the network address and browser for other account actions, such as data exports and deletion requests, and it records changes staff make to your records.
Individual decision ratings are available to the person who answered and their authorized advisor team. Shared group picks are different: the shared mode shows participating travelers' approve-or-pass responses and is identified where you answer.
In a household Dining restaurant review, and in Tour choices, one traveler's answers, including any note written with a Tour answer, stand for the party: the other travelers on the trip see them when they open the review. Dietary needs from the Dining check-in are not shared this way; they are seen by the person who entered them and your advisor team. Do not use a shared answer for information you need kept from other participants; contact your advisor directly. Access to one shared trip does not grant access to unrelated clients' records.
People on the same trip can see each other's names.
We use no advertising or analytics cookies of any kind. Wander Window itself sets one cookie, and only for advisors: a security cookie that lasts ten minutes while an advisor connects a Safari Portal account. We store your sign-in session in your browser's local storage, which is what keeps you signed in between visits. Local storage also remembers display choices, such as which tabs are open, how lists are sorted, map views and packing-list ticks; some of these are kept per account, under your email address or account identifier.
So that pages appear straight away instead of making you wait for them, we also keep a short-lived copy of what you were last shown in your browser's session storage: your own name and role, your trip — its name, dates, destinations and travelers — and your saved destinations. If you are a member of staff it also holds your clients' trips list and recoverable, unsaved drafts you are writing, such as a new trip, an import review, a shortlist or a wrap-up note. It is kept in your browser to restore your workspace. Session storage normally ends when the tab or browser session closes; sign-in and other local storage can persist between visits. Signing out removes your sign-in and most of these copies, but some display choices, and unsent staff drafts until the tab closes, stay until you clear site storage; on a shared device, sign out and close the tab. Clearing site storage removes these local copies and your local sign-in session, but does not delete the records held by the service.
The page an answer link opens keeps its short session, at most eight hours, in that tab’s session storage, so a reload keeps working and closing the tab forgets it. It writes nothing to local storage; it only looks there, on your device, for a Wander Window sign-in, and offers to open your account only when that sign-in is the account the link was sent to. It checks that on your device and sends nothing about your sign-in.
When Google maps are switched on, your browser loads Google's map software and images from Google's servers, and Google can read or set its own cookies under the Google Privacy Policy. Photographs from Unsplash, Wikimedia and other sites load from those sites' servers in the same way, under their own policies. We don't control those cookies; your browser settings can block third-party cookies.
We do not use third-party advertising trackers or share data for cross-context behavioral advertising. We do not currently change first-party service analytics in response to a browser Do Not Track signal. You can contact us about privacy choices without changing browser settings.
Only the people and companies needed to run the service. We do not sell it, we do not share it for anyone else's marketing, or make it available to unrelated clients. Authorized group and household sharing is described above. This applies to mobile numbers and text-message consent in particular: they are never shared with third parties for marketing or promotional purposes.
| Who | What they handle |
|---|---|
| Your advisor and authorized team members | Your account and travel-planning information within their assigned access, so they can plan and support your trip or cover for a colleague. Agency membership alone does not grant access to these records. |
| Wander Window LLC | Account administration, security, support and operation of the service. Authorized platform operators receive the cross-team usage report described above. Its workflow events do not contain private form answers or messages. |
| Supabase | Sign-in; the database holding the service's account and trip records, including your access, decisions, ratings, message history and import reviews; and storage for private supplier PDFs, catalogue images and advisor profile photos |
| Netlify | Hosting and server logs |
| Resend | Sending the emails we send you and your advisor, including the message text quoted in trip-conversation alerts and text-message replies relayed to your advisor, and waitlist requests and their confirmations |
| Telnyx | Delivering text messages, if you asked for them. They handle your mobile number, message content and delivery information to provide messaging and meet applicable delivery and security requirements. For businesses that enable texting, they also receive the business's legal and contact details and registration number for carrier verification. |
| Google Maps Platform | Place details, photos and geocoding. When Google maps are switched on, the maps on pages that show one also load from Google: your browser fetches Google's map software, map images and the fonts that software uses from Google's servers, which receive your IP address, ordinary browser and request information, and this site's public map key; the referrer is our site's address only. Google's map software is given the area of the map you are viewing and where its pins sit. When Google works out walking routes and times between the places in your day, it receives the coordinates of those places. Opening a Google Maps directions link sends Google that walk's coordinates. Photographs from live venue search load from Google's servers even when Google maps are off. We do not send your name or email. Google's use of this information is covered by the Google Privacy Policy. Apart from these Google maps, the fonts, icons and scripts on our pages are served from our own site. |
| Unsplash | Credited photographs in trips, field guides and recommendations, and the destination photographs in the field guide studio. Your browser loads them from Unsplash's servers, which receive your IP address and ordinary request information; the referrer is our site's address only. The studio's search sends Unsplash the destination's name and country, and choosing a photograph tells Unsplash which one was chosen. We do not send your name, email or trip. |
| Google sign-in, when an advisor or a client chooses it | Signing an advisor or a client in with their Google account. Google receives the sign-in request (and, from advisor sign-up or a client’s invitation, the email address to sign in with) and returns the verified email address, name and profile-photo address. |
| Tripadvisor | Finding hotels, restaurants and attractions when your advisor searches for a place, suggesting stops near you when your trip has free time, and optional live discovery searches. They receive the search words and area, or the coordinates of a starting point for nearby suggestions. Your browser loads Tripadvisor's photographs and logo from Tripadvisor's servers, which receive your IP address. We do not attach your account name or email; free text contains whatever its author types. |
| Ticketmaster, when enabled | Finding events by destination area and selected dates, and retrieving current details for a saved event's source identifier. We do not send account names, email addresses, reservation details or advisor notes. Credited event photographs may load from Ticketmaster or the event publisher's servers. |
| Mapbox | Working out walking routes and times between the places in your day, unless Google Maps Platform does this instead. They receive the coordinates of those places — never your name or email. |
| Geoapify, Foursquare | Walking boundaries, place information and time zones for the planner and Down Time, and locating catalogue destinations. They receive coordinates or place names, never your name or email. |
| Open-Meteo, when enabled | Weather forecasts for the route's coordinates, day and timezone, through a commercial customer endpoint. We do not send your name or email. |
| Anthropic | Classifying and matching destinations in our catalogue; extracting structured records from documents your advisor chooses to import, including any personal or booking details those documents contain; reading the booking emails an advisor forwards through their own Zapier connection; and, when enabled, helping advisors draft selected Field Guide wording using the context described above |
| OpenAI | Drafting destination-and-season Dining questions, matching Dining preferences, interpreting the sentence a traveler types to describe their free time, interpreting catalogue searches, creating catalogue search embeddings, ranking catalogue records, extracting quoted official-site details for advisor review, and generating editorial catalogue images from advisor-selected descriptions. We do not attach your account name or email; free text contains what its author types. Dietary person labels in Dining matching are replaced with anonymous traveler numbers. OpenAI keeps requests for a limited period under its own data-retention terms. |
| Firecrawl (when configured) | Retrieving readable public pages from official catalogue website URLs selected by advisors for research. |
| CARTO | The background map tiles on the route planner and trip maps when Google maps are not switched on. They receive your IP address as part of serving the map images, on the pages that show a map. |
| Stripe and Link, LLC | Billing for advisor software and business text messaging, as described under "Payments for advisor software" above. |
| Zapier, when an advisor connects it | Passing selected TravelJoy trip and contact details, or selected Gmail or Outlook email text, from an advisor's own Zapier account to us, as described above. |
| OpenStreetMap (Nominatim) | A backup place search: when our main lookup cannot find a hotel or place you type, your browser sends the search words to OpenStreetMap's Nominatim service, which receives your IP address. |
| Wikimedia (Commons, Wikidata, Wikipedia) | Place facts and photographs. Our server sends place names and coordinates; your browser loads some photographs from Wikimedia's servers, which receive your IP address. |
| Safari Portal and Axus, when an advisor connects them | An advisor's own Safari Portal connection, and the public itinerary pages from Safari Portal or Axus that an advisor links, which we fetch to bring itinerary details in. |
| Pexels, when enabled | Destination and tour photograph search for advisors. They receive the search words; your browser loads chosen photographs from their servers. |
| Supplier and official websites | When an advisor creates a tour from a web address or researches a catalogue item, our server fetches that page. Images from those pages may load from the supplier's site. |
Suppliers your advisor books with — hotels, restaurants, tour operators, airlines — receive booking information through your advisor when needed for travel arrangements. The separate services of your advisor and suppliers have their own notices and responsibilities; information stored in Wander Window remains covered by this policy.
We may disclose information when reasonably necessary to comply with a valid legal requirement, protect people's safety, investigate misuse or defend legal claims, with disclosure limited to the purpose. If the business or service changes ownership, relevant records may transfer with it subject to this policy and any notices or permissions required by law.
We use account and workspace information to provide the features you request, manage invitations, communicate about the service, maintain security, support users and improve the product. Where a law requires a lawful basis, we rely on the basis appropriate to that activity, such as performing an agreement, a legitimate interest in operating and securing the service where permitted, a legal obligation, or consent where required. Optional messaging and sensitive-information permissions are handled separately; acknowledging this notice does not waive your privacy rights.
Most retention follows the life of your account, because this is a planning tool you may come back to. Temporary import work has the shorter limits below:
Deletion requests and the records that remain are described below. Routine backups may retain prior copies until the provider overwrites them; those copies are not used as an active account.
Email support@wanderwindow.travel from the address on your account and ask; a client can also use Delete account in My Account. We verify your request before acting. Our account-closure process removes your personal account and planning records, subject to the exceptions below. You do not have to give a reason and can request an export first. If an applicable legal requirement or unresolved deletion problem affects timing or scope, we will explain it rather than describe an incomplete erasure as finished.
Deleting your account takes effect straight away, and the deletion itself runs 30 days later. Once we verify and process your closure request, your access ends, your sign-in stops working and your trips disappear from your advisor's active lists. The 30 days exist so that a deletion made by mistake — or by somebody who got into your account — can still be undone: write to us inside that window and we can put it back. After it, the erasure runs and cannot be reversed.
If you are the last active manager of a dining network, appoint another manager in Team & access before requesting account deletion. We check this before ending your access, so the network is not left without someone who can manage it.
The following records survive that erasure:
Everything else goes: your saved places, your likes and ratings, your answers and rankings, your answer links, your private notes and questions, unpublished drafts, your entry in your advisor's contact book, and your sign-in. Nothing that survives is used for anything else, and none of it is used to market to you.
Email support@wanderwindow.travel for any of these. You may make these requests wherever you live. Depending on applicable law, you may also have rights to restrict or object to processing, withdraw consent for future processing, use an authorized agent, appeal a request decision or complain to a privacy regulator. We may need information to verify your identity or an agent’s authority. We will explain any applicable exception or refusal and how to follow up. We do not penalize you for exercising applicable privacy rights. We do not use your information for solely automated decisions that have legal or similarly significant effects on you, and we do not sell it.
The service uses providers based in the United States. Information may be processed in the United States and other countries where providers operate, which may have different privacy laws from your country. Contact us for information about the provider arrangements and any transfer protections applicable to your data.
Accounts are for adults aged 18 and over; we do not knowingly register children. An adult traveler or advisor may provide limited information about a child in their travel party, such as age or travel needs, with appropriate parent or guardian authority. Do not submit unnecessary information about children. Contact us if a child has registered or information was provided without appropriate authority so we can investigate and address it.
We use account authentication, role and team permissions, database access policies, private document storage and audit records to protect information. We limit access according to the work being performed and use encrypted connections. No service can promise complete security. Protect your login, sign out on shared devices and report suspected unauthorized access promptly to our contact address.
We update the date and revision number when this policy changes. We will give notice of material changes through the service or email, and request additional permission where required before a new use that needs it. An earlier agreement record continues to identify the earlier wording.