Privacy Policy – Effective Date: April 17, 2026

Last Updated: April 21, 2026

This Privacy Policy describes how TravelBaby LLC, operator of travelbaby.com.co and associated services (“TravelBaby,” “we,” “us,” or “our”), collects, uses, and shares personal information when you access or use our platform (the “Platform”). By using the Platform, you acknowledge and agree to the practices described in this Privacy Policy. Please read it carefully.

1. Information We Collect

1.1 Information You Provide Directly

Account and booking data: name, email, phone number, date of birth, nationality, identification documents when required for check-in or building access, billing and payment details, number of guests (including infants), and special requests.

Communications: messages, photos, reviews, and content you send through the Platform, email, or WhatsApp.

Host data (for property owners): name, email, phone, tax ID, property information, and banking details for payouts.

Children’s travel information: an adult making a booking may provide limited information relating to infants or children traveling as part of the reservation, solely to help us prepare baby-related amenities and support the stay.

1.2 Information We Collect Automatically

Device and usage data: IP address, browser type, device identifiers, pages viewed, referrer URL, and date and time of visits.

Cookies and tracking technologies: essential cookies, analytics cookies, and referral-tracking cookies stored for attribution and operational purposes. Where applicable, advertising and conversion measurement technologies may also be used.

1.3 Information From Third Parties

WhatsApp Business API (Meta Platforms, Inc.): message delivery status, message IDs, timestamps, and incoming messages when you communicate with us via WhatsApp.

Payment processors: transaction confirmations, partial card details such as the last four digits, and billing-related information. We do not store full payment card numbers.

Authentication providers (if applicable): name and email from services such as Google Sign-In.

Building administration, reception desks, or property managers: where necessary for access control, security, or legal guest registration.

2. Legal Basis and How We Use Your Information

We process personal data on one or more of the following grounds, as applicable: the data subject’s consent, the performance of a contract or pre-contractual measures, compliance with legal obligations, and TravelBaby’s legitimate interests where permitted by law and not overridden by the data subject’s rights.

Fulfill bookings: create reservations, send confirmations, coordinate check-in and check-out, and prepare the complimentary TravelBaby Kit.

Communicate with you via WhatsApp, email, or SMS about your booking, reminders, operational updates, and support matters.

Notify property owners or property managers about confirmed bookings so they can prepare the property to receive you.

Provide customer support through our AI chatbot and human agents.

Process reviews you submit and display approved reviews publicly.

Run referral programs, including tracking visits, attributing bookings, and calculating rewards.

Improve the Platform through analytics, testing, troubleshooting, and product development.

Comply with tax, accounting, anti-fraud, and lawful authority requests.

Send marketing communications only where permitted by law and, when required, with prior consent. You may opt out at any time.

3. How We Share Your Information

3.1 Property Owners and Property Managers

When you book a property, we may share your name, booking dates, number of guests, and relevant notes needed to prepare the stay.

We do not ordinarily share your phone number, email address, or payment details with hosts unless operationally necessary, legally required, or authorized by you.

Where required for access control, security, or building registration, limited guest information may also be shared with reception staff, building administration, or equivalent on-site personnel.

3.2 Service Providers

We use trusted third parties to operate the Platform, including Meta Platforms, Inc. for WhatsApp Business API, Google LLC or other AI service providers for chatbot functionality, payment processors, hosting providers, and email delivery providers.

These providers are expected to process personal information only to provide services to TravelBaby and under applicable contractual or legal safeguards.

3.3 Legal Disclosures

We may disclose information if required by law, court order, regulatory process, or lawful request from a competent authority.

3.4 Business Transfers

If TravelBaby is involved in a merger, acquisition, financing transaction, restructuring, or asset sale, personal information may be transferred subject to applicable safeguards.

4. WhatsApp Business API – Specific Notices

TravelBaby uses the WhatsApp Business API provided by Meta to send transactional messages, booking confirmations, reminders, support replies, and similar service-related communications.

Opt-in and service communications: by making a booking, submitting a form, starting a WhatsApp conversation with us, or otherwise providing consent, you authorize TravelBaby to send service-related messages connected to your booking or request.

Marketing communications: where legally required, promotional WhatsApp messages will be sent only after separate consent has been obtained.

Opt-out: you may reply STOP or UNSUBSCRIBE to request that non-essential WhatsApp communications cease, subject to any messages still necessary to complete an active booking or legal obligation.

Message content may be stored for operational, dispute-resolution, quality, and compliance purposes.

Meta may process metadata such as delivery status and timestamps in accordance with Meta’s own privacy practices.

5. AI Assistant (Google Gemini or Similar Services) – Specific Notices

TravelBaby offers an optional AI chatbot to answer questions about bookings, properties, and the local area.

Message processing: your messages may be sent to Google Gemini or another AI service provider to generate a response and maintain service functionality.

Training controls: where available under the applicable service configuration and terms, TravelBaby configures its AI service providers not to use customer conversations for general model training.

Escalation to humans: if a conversation involves emergencies, complaints, legal issues, or other escalation triggers, the AI may stop responding and route the case to a human team member.

Conversation history may be retained for a limited period to support continuity, troubleshooting, quality review, and compliance.

6. Data Retention

We retain personal information only for as long as reasonably necessary to fulfill the purposes described in this policy, meet contractual needs, and comply with legal, tax, accounting, fraud-prevention, and dispute-resolution obligations.

Retention periods may vary depending on the nature of the data and the applicable legal requirements. For example, booking and financial records may need to be retained for extended statutory periods, while cookies, review tokens, and chat histories may be retained for shorter operational periods.

When data is no longer required, we will delete it, anonymize it, or securely restrict access in accordance with applicable law.

7. Security

We implement reasonable technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse, or alteration.

These measures may include encrypted transmission channels, access controls based on role and need, secure hosting environments, logging and monitoring, and periodic review of our internal security practices.

However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your Rights

Depending on your jurisdiction, you may have rights to access, update, correct, delete, restrict, object to, or request portability of your personal data, as well as to revoke consent where consent is the legal basis for processing.

Under Colombian law, data subjects may also submit consultations and claims and file complaints with the Superintendencia de Industria y Comercio (SIC).

How to exercise your rights: send your request to privacy@travelbaby.com.co. We may request information needed to verify your identity before processing the request.

We will respond within the timeframes required by applicable law.

9. Cookies and Tracking

We use cookies and similar technologies for essential functionality, security, analytics, referral attribution, and, where implemented, advertising or conversion measurement.

Examples may include session cookies, analytics tools, referral tracking cookies, Meta Pixel, Conversions API, or similar measurement technologies.

You can manage non-essential cookies through your browser settings or, where available, through site-level preference tools. Disabling certain cookies may affect Platform functionality.

10. International Data Transfers

TravelBaby operates in Colombia, but some service providers may process data in the United States, the European Union, or other jurisdictions.

When international transfers occur, TravelBaby seeks to rely on appropriate safeguards under applicable law, which may include contractual protections, provider commitments, and legally recognized transfer mechanisms.

11. Children’s Privacy

The Platform is intended for users who are legally able to make bookings and enter into contracts.

TravelBaby does not knowingly collect personal data directly from children for independent use of the Platform.

However, an adult making a booking may provide limited information about infants or children traveling as part of the reservation, solely for operational purposes such as preparing baby-related amenities and supporting the stay.

If you believe we have collected personal information from a child inappropriately, please contact us at privacy@travelbaby.com.co.

12. Changes to This Policy

We may update this Privacy Policy from time to time.

When we do, we may post the updated version on the Platform, update the Last Updated date, and provide notice where legally required or where the changes materially affect your rights.

13. Contact Us

If you have questions, concerns, consultations, or claims regarding this Privacy Policy or TravelBaby’s handling of personal data, contact us at:

Data Controller: TravelBaby LLC, operator of travelbaby.com.co and associated services.

General privacy email: privacy@travelbaby.com.co

General inquiries: hello@travelbaby.com.co

WhatsApp: +57 313 492 9210

Website: travelbaby.com.co

Data Protection Officer / Data Privacy Contact (Colombia): TravelBaby Privacy Team — Area responsible for personal data requests, consultations, and claims — privacy@travelbaby.com.co