We collect only what we need to deliver your card. We do not sell your data. We do not use your allergy information for advertising. Here's exactly what we do — and what we don't.
Prepared Travel ("Prepared Travel," "we," "us," or "our") is committed to protecting your privacy and handling personal information responsibly.
This Privacy Policy explains how we collect, use, disclose, retain, and safeguard personal information when you access or use our website, digital tools, AI-powered services, destination intelligence reports, travel consultation services, and related offerings (collectively, the "Services"). The Services are intended primarily for users located in the United States.
By using the Services, you acknowledge the practices described in this Privacy Policy.
We may collect the following categories of personal information:
We may use personal information to:
Where required by applicable law (including GDPR), we rely on one or more legal bases: performance of a contract, legitimate business interests, compliance with legal obligations, or consent.
Prepared Travel provides destination intelligence reports as part of its Services. These reports draw on aggregated and de-identified user data, publicly available information, third-party data sources, and AI-assisted analysis to generate country-level guidance on cuisine, allergen risk, labeling laws, emergency infrastructure, and related topics.
We may use de-identified and aggregated travel preference data — which cannot be traced back to any individual — to improve the depth, accuracy, and coverage of destination reports over time.
Destination intelligence outputs are dynamic. They reflect our best understanding at the time of publication and may be updated as conditions change. Nothing in a destination intelligence report constitutes medical advice, a safety guarantee, or a substitute for independent verification before and during travel.
If we use third-party data providers or research services to generate destination content, those providers are subject to the same contractual data protection standards as all other Subprocessors.
We may use third-party artificial intelligence service providers to generate translations, audio outputs, destination intelligence, and related functionality. Where we use AI service providers, we rely on API-based services that contractually restrict the use of submitted data for model training purposes.
Certain features may generate destination intelligence, menu analysis, or recommendations based on aggregated data, user inputs, and third-party sources. These outputs are dynamic and may change over time as underlying data and models are updated.
We may use de-identified and aggregated information to improve our own Services, including the quality and coverage of destination intelligence reports.
Payments are processed by third-party payment processors (e.g., Stripe). Prepared Travel does not store full credit card numbers. We may retain transaction identifiers, tokenized payment references, fraud detection signals, and billing metadata for fraud prevention, recordkeeping, analytics, and customer support.
We may use cookies and similar technologies for essential website functionality, security and fraud prevention, performance analytics, and advertising measurement where applicable.
If we use third-party analytics or advertising technologies (such as Google Analytics, Meta Pixel, or similar services), certain device identifiers and browsing activity may be disclosed to those providers. Under certain U.S. state privacy laws, this type of disclosure may be considered "sharing" for cross-context behavioral advertising.
We may disclose personal information to the following categories of service providers:
We do not sell personal information for monetary consideration.
Prepared Travel may engage third-party service providers ("Subprocessors") to assist in delivering the Services, including hosting providers, payment processors, analytics providers, AI service providers, fulfillment vendors, and destination data providers.
Subprocessors are contractually required to process personal information only for authorized purposes and to implement appropriate data protection safeguards. They may not use data submitted through Prepared Travel for their own independent purposes — including model training, advertising, or product development — unless expressly permitted in writing.
A current list of material Subprocessors is available upon written request to justin@prepared.travel.
We retain personal information only as long as reasonably necessary for legitimate business or legal purposes, including:
We may retain certain information longer if required by law, to resolve disputes, or to enforce agreements.
We collect only the personal information reasonably necessary to provide the Services. We do not collect medical diagnoses, treatment records, prescription information, insurance data, or clinical health records. Allergy selections are limited to user-entered preferences necessary to generate communication materials and related outputs.
To the extent allergy or dietary preference information is considered "consumer health data" under applicable state laws (including Washington's My Health My Data Act), Prepared Travel processes such information solely to provide user-directed communication tools.
We do not sell consumer health data. We do not use consumer health data for targeted advertising.
Prepared Travel is not a "covered entity" or "business associate" as defined under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") unless expressly agreed in a separate written Business Associate Agreement. The Services are consumer-directed tools and are not designed to store or manage clinical medical records.
If Prepared Travel enters into a written Business Associate Agreement with a healthcare provider, additional data protection obligations may apply.
Prepared Travel may be used by parents, guardians, or educational institutions. Unless expressly agreed in writing, Prepared Travel does not act as a "school official" under the Family Educational Rights and Privacy Act ("FERPA"). Parents or guardians remain responsible for providing student information.
If required by contract, we may enter into appropriate data processing agreements with educational institutions.
If you access the Services from outside the United States, your information may be transferred to and processed in the United States. By using the Services, you consent to such transfers. Where required by law, we implement reasonable safeguards for cross-border data transfers.
If you are a California resident, you may have the right to:
Prepared Travel does not sell personal information for monetary consideration. To exercise your rights, contact justin@prepared.travel. We may verify your identity before processing requests.
If you are located in the EEA or UK, you may have rights including: access, rectification, erasure, restriction of processing, data portability, and objection to processing.
Prepared Travel acts as a data controller for personal information processed under this Privacy Policy. You may lodge a complaint with your local supervisory authority.
The Services are intended for individuals who are at least eighteen (18) years of age. We do not knowingly collect personal information directly from individuals under 18. If a parent or legal guardian uses the Services on behalf of a minor, the parent or guardian is responsible for providing information and supervising the minor's use.
If you believe we have collected personal information directly from an individual under 18 without appropriate authorization, please contact us and we will take appropriate steps to delete such information.
We implement reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, disclosure, alteration, or destruction. These safeguards include, where appropriate:
We conduct periodic reviews of our security practices appropriate to the size and nature of our business. No method of transmission over the Internet or method of electronic storage is completely secure. We cannot guarantee absolute security. In the event of a data breach affecting personal information, we will provide notice as required by applicable law.
If Prepared Travel provides Services to an organization subject to specific regulatory or contractual requirements, we may enter into a written data processing agreement or other appropriate contractual safeguards upon request. Contact justin@prepared.travel to discuss.
The Services may contain links to third-party websites. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party sites you visit.
We may update this Privacy Policy from time to time. The Effective Date at the top of this page reflects the most recent revision. Continued use of the Services after updates constitutes acceptance of the revised Policy.
For any questions, requests, or concerns about this Privacy Policy or how we handle your data: