Privacy Policy

This Policy explains what personal data the Millennium Travel mobile application (the App) collects, why, how it is stored and what rights you have. The data controller is MILLENNIUM WORLD MCHJ (Millennium Travel), 3 Zargar street, Tashkent, Uzbekistan, phone +998 90 888 00 00, email millenniumtravel.uzb@gmail.com.

1. Data we process

• Mobile phone number — used as your login; a one-time SMS code is sent to it.
• Profile: first and last name, interface language and, if you choose, email, date of birth and a profile photo.
• Details of trips you purchased from Millennium Travel: destination, dates, hotels, flights, transfers, insurance, visa status.
• Trip documents (vouchers, tickets, insurance policies, confirmations) uploaded by your manager so they are available to you in the App, including offline.
• Details of travellers you add (full name, date of birth, passport number and expiry date, citizenship, a note) — as text.
• Chats with your manager and the visa department: messages and files you send (photos and PDFs, including document copies for a visa application).
• Requests to the concierge, for tours and events (with a contact phone number) and trip reviews.
• Data for AI features — only if you use them and have given consent: questions to the AI assistant and the dialogue history; voice notes, receipt photos and bank-notification screenshots for expense tracking; voice, photos and text for the translator, and a photo of a place or dish for the AI camera in the translator; trip preferences for the AI trip planner and the plans it creates; a photo or PDF of a ticket, voucher, policy, visa or event ticket bought elsewhere, if you add it to a trip via Add document (the model recognises the type, dates, cities, booking reference and names; passport numbers are not stored). A boarding pass barcode is read without AI, on our server.
• Calypso memory (the in-app assistant), only if you use Calypso and have not turned memory off: short facts about your travel preferences (for example, “does not eat meat”, “travels with two children”, “prefers beachfront hotels”, “hotel budget up to $150 a night”) that Calypso picks out of your messages to her or that you add yourself, plus a summary of your Millennium Travel orders and trips (where you have been, which hotels, average spend, who you travel with). Memory lets Calypso answer with your tastes in mind and not ask the same things again. Your name, phone number, passport and other document numbers, bank card and account numbers, home addresses and diagnoses are never stored in memory; of health information, only allergies and diet you mention yourself are kept. To pick out facts, the text of your message to Calypso is sent to OpenAI on the same terms as for the AI assistant (without your name or phone number); the memory itself is stored in our database. You can see everything Calypso remembers, delete any entry, clear the whole memory or turn it off in the App: Calypso screen, menu, “What Calypso knows about me”. When memory is off, nothing new is saved and nothing is used in answers.
• Location — if you allow access (see below).
• Physical activity data from the Health app (Apple Health) — only on iPhone and only if you open Trip activity and allow access (see below).
• Technical data: device model, OS and App version, push-notification identifier, App usage statistics (which screens and features are opened), crash reports; IP address and request time in the server's technical logs.

Location is used only if you allow access and only in the features you open: the map and routes, “places nearby”, “Where I am” weather, prayer times, qibla and nearby mosques. The Google map receives the map area and your position on it. For places nearby, routes and “Where I am” weather the coordinates are sent to our server and from it to Google Maps Platform and Open-Meteo. Prayer times and qibla for “Where I am” are calculated on your device. We do not store coordinates in our database, do not link them to your profile and do not share them with managers; to speed up answers the server may temporarily keep coordinates and query results in memory without any link to your account; they are not written to disk and are cleared when the server restarts.

Health and activity data. Only on iPhone, and only if you open the Trip activity section and grant access in the Apple Health system prompt, the App reads the following for the days of your trip: step count, walking and running distance, active energy, exercise minutes, and workouts with their routes (for example, a walk recorded by your watch). Access is read-only: the App never writes to Health. This data is processed and stored only on your device to show daily totals, the trip score and the route on the map. We do not send it to our server, to managers or to third parties, we do not use it for advertising, marketing, data sale or health assessment, and we do not pass it to AI features. You can revoke access at any time: iPhone Settings → Health → Data Access & Devices → Millennium Travel. Saved totals are deleted together with the App. The Android version of the App does not request access to Health Connect and does not read health or activity data.

Your profile photo is stored as a file that opens via a direct link without signing in — do not use a document as your profile photo.

We do not collect contacts, your photo library (other than the photos and files you choose to send) or data from other apps. Audio and photos for expense tracking and the translator are not kept on our servers after processing.

2. Document copies

We do not ask you to upload passport scans to the App. If you choose to send a copy of your passport or another document in a chat (for example, to the visa department for a visa application), the file is stored in private Supabase storage (Frankfurt, Germany), opens via a temporary link only for you and the Millennium Travel staff handling your request, and is deleted together with your account. Such images contain a photo of your face — send them only when needed to arrange your trip. Documents from your profile and trips are never sent to AI features.

3. Why we process data

• To show your trip, itinerary and documents in one place.
• To remind you about departures, visa and document expiry (notifications can be turned off in settings).
• To handle your requests and chats with your manager and the visa department and to contact you about your trip.
• To run the features you turn on: the map and places nearby, weather, prayer times, the AI assistant, expense tracking, the translator, the AI trip planner, trip activity.
• To find and fix crashes and improve the App (usage statistics and crash reports — without your name or phone number).
• To keep your account secure: SMS-code sign-in, protection against code guessing and abuse.

Legal basis: the travel services agreement between you and Millennium Travel and your consent — signing in to the App (accepting the Terms of Use and this Policy), a separate in-app consent for AI features, and device permissions for location, camera, microphone, Health data and notifications.

4. Where and how data is stored

The database and files (documents, chat attachments, profile photos) are hosted by Supabase in Frankfurt, Germany; the App backend is hosted by Hetzner, Germany. Some data is processed by the recipients listed in section 5, including in the USA. Cross-border transfer is carried out in accordance with the Law of the Republic of Uzbekistan “On Personal Data”.

All connections are encrypted (HTTPS). Access is restricted: a client sees only their own trips, documents and chats; Millennium Travel staff act only within their duties, with an access log. SMS codes are stored only as a hash and deleted after sign-in.

5. Who receives data

• Supabase (data centre in Frankfurt, Germany) — hosting of the database and files, real-time chat messaging.
• Hetzner (Germany) — hosting of the App backend.
• Eskiz.uz (Uzbekistan) — delivery of the SMS sign-in code (phone number and SMS text).
• OpenAI (USA) — AI features, only after your in-app consent: the AI assistant (your questions and a short context of your trips, visas and requests, without your name or phone number; to answer, the assistant may search the web), expense tracking (voice note, receipt photo or bank-notification screenshot, text), the translator (voice, photo, text; the translation is read aloud; AI camera: a photo of a place or dish to name it and tell you about it, plus coordinates as a hint if you allowed location), the AI trip planner (city, dates, your questionnaire answers and wishes, hotel name, arrival and departure times, booked excursions), recognition of your travel documents added via Add document (photo or PDF, for recognition only), and automatic screening of messages to the assistant for prohibited content. Under OpenAI's API terms this data is not used to train models and may be retained by OpenAI for up to 30 days for abuse monitoring.
• Google Maps Platform (Google, USA) — the in-app map, places nearby, routes, city suggestions for weather and finding the city by coordinates for “Where I am” weather; for the AI trip planner, searching for the plan's places, the hotel and the trip city, routes between plan stops and place photos (coordinates, map area, typed text and place and hotel names are sent — without your name or phone number).
• Google Firebase (Google, USA): Cloud Messaging — push-notification delivery (device push identifier); Analytics — App usage statistics (screens and features opened, device model, OS version, country, App installation identifier); Crashlytics — crash reports (technical state of the device and App at the time of the crash). Only the notification title and text pass through Firebase and Apple for delivery, for example the beginning of a message from your manager or the name of a trip, document or booking. Your name, phone number and document files are not sent to Firebase.
• Apple (Apple Push Notification service) — push-notification delivery to iPhones.
• Open-Meteo — weather forecasts (coordinates of the trip city or the “Where I am” point, trip city names and city search text).
• AlAdhan — prayer times and qibla direction for trip cities (city coordinates).
• OpenStreetMap and related open services (OSRM, Valhalla, Overpass, Nominatim) — fallback routes and places when Google services are unavailable (point coordinates); Nominatim is used only by staff to look up addresses in the admin panel.
• Central Bank of the Republic of Uzbekistan and ExchangeRate-API — exchange rates (requested by our server; none of your data is sent).

We do not sell personal data and do not share it with third parties for advertising. Data may be disclosed upon a lawful request of authorised state bodies.

6. Retention

• Your profile, travellers, requests, chats and chat files, AI-assistant history and AI trip plans are kept while your account exists; when you delete the account they are erased immediately, including files in storage and device push identifiers. Bookings and travel documents that Millennium Travel issued for your trips (tickets, vouchers, policies) stay in the company's records as required by the contract and the law, but are no longer linked to your account.
• Calypso memory is kept while your account exists or until you delete it. A deleted entry is erased immediately (only a deletion mark remains so that Calypso does not recreate it from your order history), and when you delete your account the memory is erased completely.
• Documents of completed trips remain available to you in the App until you delete your account.
• Audio and photos for expense tracking and the translator are not kept on our servers; the expense records themselves are stored only on your device.
• Activity data from Health is stored only on your device and is deleted together with the App; it is never sent to our server.
• SMS codes are deleted after sign-in or shortly after they expire; records of code requests and failed sign-in attempts (phone number and time) are used to protect against abuse and are routinely deleted after a few days.
• The server's technical logs are kept for a limited time and contain no SMS codes, chat contents or coordinates.
• Records we must keep by law (for example, for accounting and tax purposes under the agreement) are kept for the statutory period; after account deletion the audit log holds none of your contact details.

7. Your rights

• Learn what data we hold about you.
• Correct inaccurate data — via your manager or in the App settings.
• Delete your account and data directly in the App: Settings → Privacy → Delete account. The account and related data are erased immediately; records we must keep by law are retained for the statutory period with restricted access.
• Withdraw consent for AI features: Menu → Settings → Privacy → “AI features: processing consent”.
• See, delete or turn off Calypso memory: Calypso screen, menu, “What Calypso knows about me”.
• Turn off access to location, camera, microphone and Health data and turn off notifications in the device or App settings.
• Withdraw consent for other processing by stopping use of the App and deleting your account.

Requests are accepted by email millenniumtravel.uzb@gmail.com, by phone +998 90 888 00 00 and at our office at 3 Zargar street, Tashkent, Uzbekistan.

8. Children

The App is intended for persons over 18. Data of minor travellers is entered only by their parents or legal guardians as part of a booked trip.

9. Changes to this Policy

We may update this Policy. The current version is always available at this address with the update date shown above. We will notify you in the App about material changes.