Privacy Policy

PixelMakers Studio SRL, operating as Voyant

Effective date: August 15, 2026

This policy explains what personal data we collect, why we collect it, who we share it with, and what rights you have. It covers our website at voyant.travel, including the documentation and help center, and the Voyant platform we operate for our customers.

We are PixelMakers Studio SRL, a company incorporated in Romania, registered office at Ion Campineanu 23, Sector 1, Bucharest, Romania, VAT number RO43917962. For privacy questions, write to hello@voyant.travel.

Words defined in our Terms of Service have the same meaning here.

1. Two different roles

Which parts of this policy apply to you depends on how your data reached us.

We are the controller for data about people we deal with directly: visitors to our website, people who contact us or request a demo, and the staff of our customers who hold accounts on the platform. We decide why and how that data is processed, and this policy describes it.

We are a processor for data our customers put into the platform. Our customers are travel businesses. When one of them records you as a traveler, uploads your passport details, or sends you a booking confirmation, that business decides why and how your data is used. We only act on its instructions.

If you are a traveler and you want to access, correct, or delete your data, contact the travel business you booked with. They are the controller and only they can act on your request. If you contact us instead, we will pass your request to them and tell you we have done so, but we cannot act on it ourselves. Section 4 explains this in more detail.

2. What we collect as controller, and why

2.1 When you visit our website

We collect your IP address, approximate location derived from it, device and browser information, the pages you view, and how you arrived. Our infrastructure provider also processes request data to protect the site against attack and abuse.

We use your approximate country for two things you will notice: choosing which language version of the site to show you, and showing prices in the right currency.

Legal basis: legitimate interest in operating, securing, and understanding our website, and in presenting it in a form that is useful to you. For analytics and any advertising cookies, consent where the law requires it. See section 5.

Retention: security and request logs for up to 12 months. Analytics data for up to 14 months.

2.2 When you contact us or request a demo

Contact forms, demo requests, and support enquiries collect your name, email address, phone number where you give it, your company and its website, and whatever you write to us. Form submissions are stored in our content system and reach us by email.

We use this to answer you, to prepare and hold the meeting you asked for, and to keep a record of the conversation.

Legal basis: steps taken at your request before entering into a contract, and our legitimate interest in responding to enquiries and keeping business records.

Retention: up to 3 years from our last exchange, unless you become a customer, in which case the record moves into your account history.

2.3 When you or your colleagues use the platform

For each person with an account we hold name, work email address, the organization they belong to, their role and permissions, authentication events including sign-in times and IP addresses, and their activity in the product where it is recorded in audit logs.

We use this to give you access, to apply the right permissions, to keep the account secure, to provide support, to tell you about changes that affect your service, and to investigate abuse.

Legal basis: performance of our contract with the customer organization, and legitimate interest in security, abuse prevention, and service administration.

Retention: for the life of the account. On closure, data stays available for export for 30 days and is then deleted from live systems. Backups expire on their normal cycle, no more than 90 days later. Security and audit logs are kept for up to 12 months.

2.4 Billing

We hold your billing name and address, VAT number, plan and usage records, invoices, and payment status. Card details are handled by our payment provider and never reach our systems.

Legal basis: performance of the contract, and legal obligation for invoicing and accounting.

Retention: as Romanian accounting and tax law requires, generally 10 years for accounting documents. This obligation survives account closure.

2.5 Support

Support conversations, the messages in them, and any files or screenshots you attach. Where we need to look at your data to solve a problem, we access the minimum necessary and log that we did.

Legal basis: performance of the contract and legitimate interest in providing and improving support.

Retention: up to 3 years from closure of the conversation.

2.6 Marketing

If you opt in, or if you are an existing customer and the law allows it, we may send you product news. Every message carries an unsubscribe link, and unsubscribing takes effect across all our marketing.

Legal basis: consent, or legitimate interest in marketing to existing customers about services like the ones they already have.

Retention: until you unsubscribe. We then keep the minimum needed to make sure we do not contact you again.

2.7 Security and abuse

We log platform access, API calls, security events, and payment risk signals, and we monitor for fraud, intrusion, and breaches of our Acceptable Use Policy.

Legal basis: legitimate interest in protecting the platform, our customers, and their travelers, and legal obligation where the law requires us to act.

Retention: up to 12 months, longer where an investigation or a legal claim requires it.

3. What we do not do

We do not sell personal data. We do not rent or share it with third parties for their own marketing. We do not use our customers' data, or their travelers' data, to train foundation models, and we contract with the AI providers we use so that they do not either.

4. Traveler data, in more detail

Travel businesses using the platform record the data their operations need. That typically includes traveler names and contact details, booking and itinerary records, passport and identity document details, dates of birth, payment records, and sometimes special category data such as dietary requirements, accessibility needs, or medical information relevant to a trip.

For all of it, the travel business is the controller. Our role is limited to hosting and processing on its instructions under a data processing agreement, which obliges us to keep the data confidential, secure it, use approved sub-processors only, help the customer answer requests from people like you, notify incidents, and delete or return the data at the end of the contract.

What this means in practice: the travel business decides what to collect, how long to keep it, who to share it with, and what its own privacy notice says. Its notice governs, not this one. Direct your requests to it.

5. Cookies and similar technologies

Our website uses a small number of cookies.

Strictly necessary. A cookie named `voyant-locale` remembers the language you chose, for one year. If you are signed in to the platform, a session cookie from our identity provider keeps you signed in. Our infrastructure provider sets cookies that protect the site against attack. Staff previewing unpublished content have additional cookies for that purpose. These are set without consent because the site cannot work correctly without them.

Analytics and advertising. We load Google Tag Manager, which in turn loads Google Analytics. These set cookies in the `_ga` family that measure how the site is used, and they may support advertising measurement. They are not necessary for the site to work.

You can clear or block cookies in your browser. Blocking the necessary ones will break language selection and sign-in.

The documentation site and the help center are separate surfaces and may set their own cookies for navigation and search.

6. Who we share data with

We share personal data with service providers who process it on our behalf, under contract, and only for the purposes we set. The current list:

• Cloudflare (United States, EU regions available) — hosting, content delivery, DNS, security and bot protection, object and key-value storage, background rendering, and video delivery.
• Google Cloud (United States, EU regions) — compute, key management and encryption, address lookup and mapping, and model hosting.
• Neon (United States, EU regions) — managed PostgreSQL databases.
• WorkOS (United States) — authentication and identity for platform accounts.
• Stripe (Ireland and United States) — payment processing, subscription billing, and invoicing.
• Netopia (Romania) — payment processing for Romanian card acceptance.
• SmartBill (Romania) — invoicing and Romanian electronic invoicing.
• Resend (United States) — transactional and marketing email delivery.
• Twilio (Ireland and United States) — SMS and WhatsApp messaging.
• Trigger.dev (United States) — background job scheduling and execution.
• Typesense (Germany and United States) — search indexing.
• Sanity (Norway and United States) — the content system behind our website, help center, and contact forms.
• Google (United States) — Tag Manager and Analytics on our website.
• AI model providers — depending on the feature and the model in use: Anthropic, OpenAI, Google, Moonshot AI, Deepgram, and ElevenLabs, for text generation, speech to text, and voice.

We also share data where we have to: with professional advisers under confidentiality, with authorities where the law or a valid order requires it, and with an acquirer if the business is sold, in which case we will tell affected customers.

We give notice before adding a sub-processor that handles our customers' personal data, and customers may object on reasonable data protection grounds, as set out in section 12.3 of the Terms of Service.

7. Where your data goes

We process data in the European Union by default. Several of the providers above are established outside the EU or operate globally, so some data reaches countries without an adequacy decision, principally the United States.

For those transfers we rely on the European Commission's standard contractual clauses, together with the technical measures in section 8, and we assess each provider before we use it. Ask us and we will tell you which safeguard applies to a specific provider.

8. How we protect data

Data is encrypted in transit. Secrets, credentials, and sensitive configuration are encrypted at rest using managed key services. Each customer organization is isolated from every other. Access inside the platform is controlled by role, API tokens are scoped to what they need, and administrative access on our side is limited to the people who require it, logged, and reviewed. We monitor for intrusion and abuse, keep backups, and test that they restore.

No system is perfectly secure. If a breach affects personal data we hold, we notify the supervisory authority and affected people as the GDPR requires, and we notify affected customers within 72 hours of becoming aware, as section 12.5 of the Terms of Service sets out.

9. Your rights

Under the GDPR you have the right to access your data, to have it corrected, to have it erased, to restrict or object to processing, to receive it in a portable form, and to withdraw consent at any time without affecting processing already carried out. Where processing rests on legitimate interest, you may object and we will stop unless we have compelling grounds that override your interests.

To exercise a right, write to hello@voyant.travel. We may ask for information to confirm who you are. We respond within one month, and we will tell you if we need longer because the request is complex.

If we are a processor rather than a controller, meaning your data reached us through a travel business, we will redirect you to that business. See section 4.

If you are unhappy with how we handle your data you can complain to the Romanian supervisory authority, ANSPDCP, at dataprotection.ro, or to the authority in the EU country where you live or work.

10. Automated decisions and AI

We do not make decisions about you by purely automated means that produce legal effects or similarly significant effects.

Our platform includes an AI agent that our customers can use in their own operations. Where a customer uses it to communicate with travelers or to prepare decisions, that customer is responsible for it, and its privacy notice should tell you so. The Terms of Service require our customers to keep a human in the loop for anything material.

11. Children

The platform is a business tool and is not directed at children. We do not knowingly collect personal data from children through our website.

Travel bookings frequently involve minors. Where a travel business records a child as a traveler, that business is the controller and is responsible for the lawful basis and for any consent required.

12. Changes

We update this policy when our processing changes. Material changes are announced by email to customers and posted here at least 30 days before they take effect, in line with section 19 of the Terms of Service. The effective date at the top always shows the current version.

13. Contact

PixelMakers Studio SRL

Aleea Vitioarei 3, Ploiesti, Romania

Email: hello@voyant.travel

Web: voyant.travel