Privacy Policy

Last updated: 7 August 2026

This Privacy Policy explains how GLOAB Travel collects, uses, stores and shares personal information when you use the Get Lost On A Budget blog and website, GLOAB’s web and mobile applications, trip-planning tools, itinerary-request service and related support communications (together, the “Service”).

1. Who we are

GLOAB Travel is operated by Andrew Cachia, of 20 Guze Flores Street, Santa Venera, Malta. Andrew Cachia is the data controller for the personal data described in this policy.

For privacy questions, support requests or data-rights requests, email getlostonabudget@gmail.com.

2. Information we collect

Depending on how you use the Service, we may collect:

Blog and website information: pages and articles viewed, referring pages, approximate location inferred from IP address, browser and device information, cookie choices, and cookie or similar identifiers. If you use a contact form or newsletter, we collect the information you choose to provide.
Account and contact information: name, email address, account identifier, home country, nearest airport and, if you choose to provide it, telephone number.
Trip-request information: destination, dates or date flexibility, duration, traveller and baggage details, budget, accommodation, activity, day-trip and car preferences, existing-booking information you voluntarily provide, and free-text requests.
Service and payment records: trip reference, quote, invoice and payment-status records, purchase or transaction references, and support history. We do not receive or store full payment-card numbers.
Communications preferences: WhatsApp itinerary-contact consent, consent version, time, source and withdrawal, if you choose to opt in.
Technical and app information: IP address, device, browser or app information, authentication and security logs, diagnostics, notification permission status and locally stored reminder preferences.

Please do not send passport numbers, payment-card details, health information or other sensitive personal data through the Service, email or WhatsApp unless we specifically ask for it and explain why it is needed.

3. How and why we use information

To operate the blog and website, manage cookie preferences, and answer enquiries.
To create and secure accounts, review requests, prepare personalised itineraries, communicate about quotes and completed itineraries, and provide customer support.
To process or verify purchases, maintain tax and accounting records, prevent fraud, and keep the Service secure.
To send optional WhatsApp itinerary messages where you have opted in. You may withdraw this permission at any time.
To understand how the website and Service perform and improve them, using non-essential analytics or marketing technologies only where required consent has been given.

Our legal bases are performance of a contract or steps taken at your request before entering one; compliance with legal obligations; our legitimate interests in operating a safe and reliable Service; and consent where we ask for it. We do not make decisions based solely on automated processing that produce legal or similarly significant effects.

4. Cookies and similar technologies

Our blog and website use cookies and similar technologies. Essential cookies help the site work, remember cookie choices, protect accounts and prevent abuse. Functional, statistics and marketing cookies are used only in accordance with your choices where consent is required. You can change non-essential choices through the website’s cookie-consent tool. See our Cookie Policy for more detail.

5. Who receives information

We do not sell personal information. We use providers that process data on our instructions to operate the Service, including:

Supabase for authentication, database and file storage;
Resend for transactional email delivery;
Stripe for web payments, where offered;
RevenueCat, Apple and Google for mobile in-app purchases and purchase validation;
Expo, Apple and Google for mobile notifications where notifications are enabled;
Meta/WhatsApp where you opt into WhatsApp itinerary communications;
Google Analytics, cookie-consent tools, WordPress plugins and hosting providers used for the blog and website.

We may also disclose information to professional advisers, regulators, authorities or other parties when required by law or reasonably necessary to establish, exercise or defend legal claims. If you share an itinerary with another person through the Service, they can see information included in the shared itinerary.

Booking, affiliate and other third-party links take you to independent services. Their handling of personal data is governed by their own policies; we do not control those services.

6. International transfers

Some providers may process information in the European Economic Area, the United Kingdom, the United States or other countries. Where information is transferred outside the EEA or UK, we use an applicable transfer mechanism, such as an adequacy decision or standard contractual clauses, with supplementary safeguards where appropriate. Contact us if you want further information.

7. How long we keep information

Account, profile, saved-trip and itinerary information is kept while your account is active.
After account deletion, we aim to delete or anonymise this information within 30 days, unless we need it for a legal obligation, unresolved dispute, fraud prevention or security.
Abandoned trip requests are kept for up to 12 months.
Payment, invoice and tax records are kept for at least six years where required by applicable law.
Security and diagnostic logs are normally kept for up to 90 days, unless needed to investigate an incident.
WhatsApp and cookie-consent records are kept for up to five years after withdrawal or account deletion to demonstrate compliance.

8. Your rights

Subject to applicable law, you may request access to, correction of, deletion of, restriction of or portability of your personal data, and may object to processing based on legitimate interests. You may withdraw consent at any time where processing is based on consent. Email getlostonabudget@gmail.com to make a request. We may need to verify your identity and normally respond within one month.

If you are in Malta or the EEA and believe our processing infringes data-protection law, you may complain to the Malta Information and Data Protection Commissioner or your local supervisory authority.

9. Security

We use reasonable technical and organisational measures designed to protect personal data. No internet transmission or storage system is completely secure. Keep your account credentials confidential and contact us promptly if you suspect unauthorised access.

10. Children

The Service is not intended for users under 16. Users under 18 must have a parent or guardian’s permission before making a purchase or submitting a paid request. We do not knowingly collect personal information from children under 16. If you believe a child has provided personal information, contact us and we will take appropriate steps.