Privacy Policy

Last updated: 2 October 2026

This Privacy Policy explains how IT TRAVEL LP, a limited partnership incorporated in Scotland, Company Number SL024264, with its registered office at Suite 4054 Mitchell House, 5 Mitchell Street, Edinburgh, Scotland, EH6 7BD (“Octripus,” “we,” “us,” or “our”), collects, uses, shares, and protects personal data when you access or use our website, mobile application, emails, Guides, Partner Program, and other online products and services (collectively, the “Services”).

For the purposes of the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the UK GDPR, and other applicable data protection laws, IT TRAVEL LP acts as the data controller of personal data processed for the purposes described in this Privacy Policy.

“Personal data” means any information relating to an identified or identifiable natural person.

We process personal data in accordance with applicable principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality.

This Privacy Policy applies to:

• users of the Octripus Services;

• Creators who create, publish, share, or sell Guides;

• Buyers who purchase Paid Guides;

• users who communicate with Creators through the Services;

• applicants and participants in the Octripus Partner Program;

• visitors to our websites and landing pages; and

• other individuals who interact with Octripus.

We may amend this Privacy Policy from time to time. If we make material changes, we will update the “Last updated” date and, where appropriate or required by law, provide additional notice.

1. Legal Bases for Processing Personal Data

We process personal data only where we have a valid legal basis.

Depending on the circumstances, we may rely on the following bases under Article 6 GDPR and equivalent provisions of applicable data protection law.

1.1 Performance of a contract

We process personal data where necessary to enter into or perform a contract with you, including to:

• create and manage your Account;

• provide access to the Services;

• create, publish, share, and deliver Guides;

• process Subscriptions and other purchases;

• facilitate purchases of Paid Guides;

• facilitate payments and payouts to Creators;

• administer the Octripus Partner Program;

• track qualifying referrals and commissions;

• facilitate Partner payouts;

• provide customer support; and

• send transactional and service-related communications.

1.2 Legitimate interests

We may process personal data where necessary for our legitimate interests or those of a third party, provided that those interests are not overridden by your fundamental rights and freedoms.

Our legitimate interests may include:

• operating, maintaining, and improving the Services;

• understanding how the Services are used;

• internal analytics and product development;

• preventing fraud, abuse, and security incidents;

• investigating suspicious transactions, referrals, refunds, disputes, or chargebacks;

• protecting Octripus, users, Buyers, Creators, and Partners;

• administering our business;

• establishing, exercising, or defending legal claims; and

• maintaining accurate records of transactions and activity.

1.3 Consent

We rely on consent where required by law, including in relation to:

• non-essential cookies and similar technologies;

• certain analytics or marketing technologies;

• marketing communications;

• push notifications;

• affiliate or referral tracking where consent is required; and

• other optional processing activities that require consent.

You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

1.4 Legal obligations

We may process personal data where necessary to comply with applicable legal, tax, accounting, regulatory, consumer protection, anti-fraud, financial, or reporting obligations.

2. Personal Data We Collect

2.1 Information You Provide Directly

We collect personal data that you provide when you:

• create or manage an Account;

• complete your profile;

• create, edit, or publish content;

• create or publish a Guide;

• purchase or sell a Paid Guide;

• purchase a Subscription or paid feature;

• apply to or participate in the Partner Program;

• contact another user through available communication features;

• contact customer support;

• communicate with us through messaging platforms;

• participate in surveys, promotions, webinars, or other activities; or

• otherwise provide information to us.

This information may include:

• name;

• display name;

• username;

• email address;

• telephone number;

• profile photograph or avatar;

• biography;

• country or location information;

• language preferences;

• professional or business information;

• Creator or seller information;

• Partner Program application information;

• tax or business information where required;

• customer support communications; and

• other information you voluntarily provide.

3. Content and Guide Information

When you use the content creation features of Octripus, we may process information that you provide or generate through the Services, including:

• Guides;

• Itineraries;

• Place Collections;

• Points or locations;

• descriptions;

• personal tips and recommendations;

• Greetings;

• photographs;

• videos;

• uploaded files;

• prices or cost information;

• links;

• voice recordings and audio;

• transcribed voice content;

• messages;

• information entered into the Copilot;

• information included in your public profile; and

• other content you submit to or create through the Services.

Content that you choose to publish publicly may be visible to other users or visitors.

Content in a Paid Guide may be made available to Buyers who purchase access to that Guide.

We do not intentionally request special categories of personal data through normal use of the Services. However, you may voluntarily include such information in content or communications. Please avoid submitting sensitive personal data unless necessary.

4. Voice and Audio Data

Certain Octripus features allow users to submit voice recordings or audio.

We may process audio and transcripts to:

• receive spoken instructions;

• transcribe your content;

• create or edit Guide content;

• provide voice-enabled product features;

• create a voice for use in Guides where you choose to use such functionality; and

• operate and improve the relevant Services.

Where a specific voice feature requires consent or additional disclosure, this will be presented to you through the relevant interface.

If you delete voice or audio data through available functionality, we will delete or anonymize it subject to technical backup periods and any retention required by applicable law, security requirements, or dispute resolution.

5. Payment and Financial Information

5.1 Payments to Octripus

Payments for Subscriptions and other paid Services may be processed by third-party payment providers.

Octripus does not ordinarily store full payment card details.

Payment providers may process payment details directly under their own privacy policies and applicable legal responsibilities.

We may receive transaction information from payment providers, including:

• transaction identifiers;

• amount;

• currency;

• payment status;

• transaction date;

• subscription status;

• refund status; and

• limited payment method information.

5.2 Paid Guide Transactions

When a Buyer purchases a Paid Guide, we may process transaction-related information including:

• Buyer identifier;

• Creator identifier;

• Guide identifier;

• purchase amount;

• currency;

• Octripus Platform Fee;

• payment processing information;

• transaction date;

• payment status;

• payout status;

• refund information;

• dispute information;

• chargeback information; and

• other records necessary to administer the transaction.

We process this information to facilitate the transaction, provide access to the purchased Guide, administer Creator payouts, prevent fraud, resolve disputes, maintain accounting records, and comply with legal obligations.

6. Creator Payments and Stripe Connect

Creators who wish to sell Paid Guides may be required to complete payment onboarding through Stripe.

Depending on the applicable setup and legal requirements, Stripe may collect information including:

• name;

• contact information;

• date of birth;

• address;

• business details;

• identity verification information;

• tax-related information;

• bank or payout account information; and

• other information necessary to verify eligibility for payments and payouts.

This information may be provided directly to Stripe rather than to Octripus.

Octripus may receive limited information from Stripe necessary to operate seller functionality, including:

• Stripe or connected account identifiers;

• verification status;

• payout eligibility;

• payment status;

• transaction information;

• payout information;

• refund information;

• dispute or chargeback status; and

• other information required to manage payments and seller access.

Stripe may act as a service provider, processor, or independent data controller depending on the relevant processing activity.

Stripe processes personal data in accordance with its own terms and privacy documentation where it acts independently.

We do not ordinarily receive or store full Creator bank account or payment card credentials where those details are collected directly by Stripe.

7. Seller Information Shared with Buyers

Where you sell a Paid Guide, certain Creator or seller information may be made available to Buyers where:

• it is necessary to identify the seller of the Paid Guide;

• it is necessary to facilitate or document the transaction; or

• disclosure is required by applicable consumer protection or other laws.

This may include information such as:

• Creator or business name;

• public profile information;

• professional or trader status;

• country or other legally required seller information; and

• contact information where disclosure is legally required.

We do not disclose identity documents, bank account information, or other confidential verification information to Buyers merely because you sell a Guide.

8. Partner Program Information

If you apply to or participate in the Octripus Partner Program, we may collect and process information including:

• your name;

• email address;

• business or professional information;

• application information;

• Partner account information;

• Partner or affiliate identifier;

• referral links;

• referral and attribution information;

• referred customer information where necessary for attribution;

• qualifying transactions;

• commission amounts;

• commission status;

• payout status;

• Partner Program communications; and

• payment, tax, or verification information required for Partner payouts.

We process this information to:

• evaluate and administer Partner Program applications;

• create and maintain Partner accounts;

• generate and operate referral links;

• attribute qualifying customers and transactions;

• calculate commissions;

• administer commission approval periods;

• process Partner payouts;

• prevent referral fraud or abuse;

• resolve commission disputes;

• maintain accounting and payment records; and

• comply with legal and regulatory obligations.

Participation in the Partner Program is also governed by separate Partner Program Terms.

9. Rewardful and Affiliate Tracking

Octripus uses Rewardful to administer elements of the Partner Program, including referral tracking, attribution, commission administration, and Partner payouts.

Rewardful may process information relating to:

• Partners;

• referral identifiers;

• referral links;

• referred visitors;

• attribution;

• sign-ups;

• qualifying payments;

• refunds;

• commissions;

• payout status; and

• related Partner Program activity.

Rewardful uses referral tracking technologies, including first-party cookies, to associate qualifying visitors or customers with the Partner who referred them.

Where applicable law requires consent for such tracking, relevant non-essential affiliate tracking technologies will be used only after the required consent has been obtained.

You may manage applicable cookie preferences through our cookie management tool.

Additional information about cookies and tracking technologies is provided in our Cookie Policy.

10. Partner Managed Payouts

Octripus uses Rewardful Managed Payouts to administer Partner commission payments.

The Octripus Partner Program operates in USD for the purposes of Managed Payouts.

Partners may be required to complete Rewardful payout onboarding before receiving commissions.

As part of that process, Rewardful or its payment service providers may request:

• identity information;

• contact details;

• payout details;

• tax information;

• bank or payment information; and

• verification information.

Depending on the Partner's location and selected payout method, additional information may be required by Rewardful or its payment providers.

Octripus does not ordinarily receive or store full bank or payment credentials entered directly into Rewardful's Managed Payouts system.

We may receive information necessary to administer the Partner Program, including:

• payout eligibility;

• payout status;

• amount payable;

• commission status;

• completed payout information; and

• related transaction records.

Rewardful and its payment providers may process certain personal data under their own privacy policies and legal responsibilities.

11. Information Collected Automatically

When you access or interact with the Services, we may automatically collect certain information.

11.1 Activity Information

This may include information about:

• pages or screens viewed;

• Guides viewed;

• features used;

• links clicked;

• creation and publishing activity;

• purchase activity;

• interactions with content; and

• other use of the Services.

11.2 Device and Usage Information

This may include:

• IP address;

• browser type;

• operating system;

• device type;

• device identifiers;

• network information;

• referring URLs;

• approximate location derived from IP address;

• access times;

• language settings; and

• diagnostic information.

11.3 Transaction Information

We may automatically record information about:

• Subscriptions;

• Paid Guide purchases;

• Creator sales;

• Partner referrals;

• commissions;

• payouts;

• refunds;

• payment disputes; and

• chargebacks.

12. Cookies and Similar Technologies

We use cookies and similar technologies to operate, secure, analyze, and improve the Services.

These technologies may include:

Strictly necessary technologies

These are necessary to provide requested Services, maintain sessions, authenticate users, secure the platform, or perform essential technical functions.

Preference technologies

These may remember settings such as language, interface preferences, or other user choices.

Analytics technologies

These help us understand how users interact with the Services and improve performance and functionality.

Affiliate and referral technologies

These may be used to attribute users and qualifying transactions to Partners participating in the Octripus Partner Program.

Marketing technologies

Where applicable, these may be used to measure campaigns or provide relevant marketing content.

Where applicable law requires consent, non-essential cookies and similar technologies are not activated before valid consent has been obtained.

You may change or withdraw your cookie choices through our cookie management tool.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Further information about specific cookies, providers, purposes, and retention periods is available in our Cookie Policy.

13. Information from Other Sources

We may receive personal data from third parties, including:

• Stripe and other Payment Processors;

• Rewardful;

• analytics providers;

• authentication providers;

• messaging providers;

• social networks;

• accounting or financial service providers;

• fraud prevention providers;

• business partners; and

• other users where relevant to the Services.

If you create or access your Account using a third-party authentication provider, we may receive information permitted by that provider and your settings.

Information obtained from third parties is processed for the purposes described in this Privacy Policy and subject to applicable law.

14. Messaging and WhatsApp Communications

If you choose to communicate with Octripus through messaging platforms, including WhatsApp, we may process your phone number and message content.

We may use the WhatsApp Business Platform provided by Meta to communicate with users who choose to interact with us through WhatsApp.

Depending on the relevant processing activity, Meta or other messaging providers may act as independent data controllers or service providers.

We may process phone numbers and messaging information for purposes including:

• account creation or management where applicable;

• authentication or verification;

• customer support;

• transactional or service-related messages;

• payment or Guide access notifications;

• links to personalized travel content;

• other communications requested by the user; and

• resolving technical or customer service issues.

Processing of transactional messaging may be based on performance of a contract or our legitimate interests in operating the Services.

Messages may be retained where necessary to provide support, resolve disputes, ensure service reliability, prevent abuse, or comply with legal obligations.

Marketing communications through messaging platforms will be sent only where permitted by applicable law.

15. How We Use Personal Data

We may use personal data to:

(A) create, manage, and secure Accounts;

(B) provide and operate the Services;

(C) enable users to create, publish, share, and access Guides;

(D) process Subscriptions and purchases;

(E) facilitate Paid Guide sales between Creators and Buyers;

(F) provide Buyers with access to purchased Guides;

(G) facilitate Creator onboarding, payments, and payouts;

(H) administer the Octripus Partner Program;

(I) attribute Partner referrals and calculate commissions;

(J) process Partner payouts through Rewardful Managed Payouts;

(K) provide receipts, transaction records, and service communications;

(L) respond to inquiries and provide customer support;

(M) send technical notices, security alerts, and administrative communications;

(N) send marketing communications where permitted by law;

(O) analyze usage and improve the functionality, performance, and usability of the Services;

(P) debug and correct technical errors;

(Q) detect, investigate, and prevent fraud, abuse, security incidents, payment manipulation, and referral fraud;

(R) administer refunds, disputes, and chargebacks;

(S) enforce our Terms and other agreements;

(T) comply with applicable legal, tax, accounting, regulatory, and reporting obligations;

(U) establish, exercise, or defend legal claims; and

(V) carry out other purposes disclosed to you at the time personal data is collected.

We do not use personal data for purposes that are incompatible with the purposes described in this Privacy Policy unless permitted by applicable law.

16. How We Share Personal Data

We may share personal data as follows.

16.1 With Other Users

Information that you make public may be visible to other users or visitors.

Where you sell a Paid Guide, relevant seller information may be shown to Buyers as described in this Privacy Policy.

Where communication functionality is used, information necessary to facilitate that communication may be shared with the relevant user.

16.2 With Service Providers Acting on Our Behalf

We may share personal data with service providers that process data on our behalf, including providers of:

• hosting and infrastructure;

• customer support;

• communications;

• analytics;

• security;

• fraud prevention;

• email delivery;

• technical services; and

• other operational services.

Where a provider acts as our processor, we require appropriate contractual and data protection safeguards.

16.3 With Payment and Financial Service Providers

We may share or exchange information with Stripe and other payment providers to:

• process payments;

• verify Creators;

• administer payouts;

• prevent fraud;

• manage refunds;

• handle payment disputes and chargebacks; and

• comply with legal obligations.

Such providers may act independently as data controllers for some processing activities.

16.4 With Rewardful and Partner Program Providers

We may share or exchange information with Rewardful and its relevant payment or service providers to:

• track referrals;

• attribute customers and transactions;

• calculate commissions;

• detect referral fraud;

• administer Partner accounts;

• facilitate Managed Payouts;

• process Partner verification where applicable; and

• maintain Partner Program records.

16.5 Messaging Providers

Where you communicate through platforms such as WhatsApp, information necessary to deliver communications may be processed by the relevant messaging provider.

16.6 For Legal and Safety Reasons

We may disclose personal data where reasonably necessary to:

• comply with law, regulation, court orders, or lawful governmental requests;

• protect our legal rights;

• protect users or third parties;

• investigate fraud, security incidents, or illegal activity;

• enforce our agreements; or

• establish, exercise, or defend legal claims.

16.7 Corporate Transactions

Personal data may be transferred as part of a merger, acquisition, financing, restructuring, sale of assets, or similar business transaction, subject to applicable legal requirements and appropriate safeguards.

16.8 With Your Consent or at Your Direction

We may share personal data where you ask us to do so or otherwise provide valid consent.

17. We Do Not Sell Personal Data

Octripus does not sell personal data for monetary consideration.

Sharing personal data with service providers, payment providers, Rewardful, or other third parties for the purposes described in this Privacy Policy does not mean that Octripus sells personal data.

Where applicable law uses a broader definition of “sale” or “sharing,” we will comply with any additional rights or disclosures required under that law.

18. International Data Transfers

Octripus and some of our service providers may process personal data in countries outside the United Kingdom or European Economic Area.

Where personal data is transferred internationally and applicable law requires safeguards, we use legally recognized transfer mechanisms as appropriate.

These may include:

• adequacy regulations or adequacy decisions;

• Standard Contractual Clauses approved by the European Commission;

• the UK International Data Transfer Agreement;

• the UK Addendum to the EU Standard Contractual Clauses; or

• other lawful safeguards recognized under applicable data protection law.

International transfers may occur in connection with services including hosting, analytics, communications, payment processing, fraud prevention, affiliate administration, and Partner payouts.

19. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy and to comply with legal obligations.

Retention periods vary depending on the type of information and why it is processed.

Account Information

Account-related information is generally retained while the Account remains active and for a reasonable period after deletion where necessary for security, restoration periods, disputes, or legal compliance.

Content

Content is generally retained while it remains available through the Services.

Where a Paid Guide has already been purchased, relevant content and associated records may be retained as necessary to continue providing Buyers with access to the purchased Guide.

Transaction and Payment Records

Records relating to:

• Subscriptions;

• Guide purchases;

• Creator sales;

• payments;

• payouts;

• refunds;

• disputes; and

• chargebacks

may be retained for the period necessary to comply with tax, accounting, financial, fraud prevention, contractual, and legal obligations.

Partner Program Records

Partner application, referral, commission, and payout records may be retained during participation in the Partner Program and afterwards for the period necessary to:

• resolve commission or payment disputes;

• maintain accounting records;

• prevent fraud or abuse;

• comply with legal obligations; and

• establish, exercise, or defend legal claims.

Consent Records

Where we rely on consent, we may retain records of consent and withdrawal for as long as reasonably necessary to demonstrate compliance with applicable law.

When personal data is no longer required, we delete it, anonymize it, or securely retain it only where required or permitted by law.

20. Account and Data Deletion

You may request deletion of your personal data by using available Account functionality or by contacting [email protected].

Following a verified deletion request, we will delete or anonymize personal data without undue delay unless retention is necessary for legitimate or legally required purposes.

We may retain information necessary to:

• maintain Buyers' access to previously purchased Paid Guides;

• record transactions;

• process outstanding Creator or Partner payouts;

• administer refunds, disputes, or chargebacks;

• comply with tax or accounting requirements;

• prevent fraud or security incidents;

• enforce our agreements;

• resolve disputes; or

• establish, exercise, or defend legal claims.

Deleting an Account therefore may not result in immediate deletion of every record connected with previous financial transactions or Paid Guide purchases.

Data retained for these purposes will not be used for unrelated purposes.

21. Your Choices

21.1 Account Information

You may access or update certain Account information through the Services.

21.2 Cookies

You may manage applicable cookie preferences through our cookie management tool.

You may also use browser controls to manage certain cookies, although blocking some strictly necessary technologies may prevent parts of the Services from functioning correctly.

21.3 Marketing Communications

You may unsubscribe from marketing emails using the unsubscribe mechanism included in those communications or through available Account settings.

Service, security, transactional, and legally required communications are not marketing communications and may continue where necessary.

21.4 Push Notifications

Where enabled, push notifications may be disabled through your device settings.

22. Your Data Protection Rights

Depending on your location and applicable law, you may have the right to:

• request access to personal data we hold about you;

• request correction of inaccurate or incomplete personal data;

• request deletion of personal data;

• request restriction of processing;

• object to processing based on legitimate interests;

• object to direct marketing;

• request portability of personal data where applicable;

• withdraw consent where processing is based on consent; and

• lodge a complaint with a competent supervisory authority.

These rights may be subject to conditions and exemptions under applicable law.

To exercise your rights, contact us at [email protected].

We may need to verify your identity before completing certain requests.

We will respond within the time limits required by applicable law.

23. Automated Decision-Making

Octripus does not currently use personal data to make decisions based solely on automated processing that produce legal effects or similarly significant effects on users.

Third-party services such as payment, identity verification, fraud prevention, or payout providers may independently use automated systems as part of their services.

Where such third parties act independently, their processing is governed by their own privacy documentation and applicable law.

If Octripus introduces relevant automated decision-making in the future, we will provide additional information where required by law.

24. Security

We implement appropriate technical and organizational measures designed to protect personal data from unauthorized access, accidental loss, misuse, alteration, destruction, or disclosure.

These measures may include:

• access controls;

• authentication measures;

• infrastructure security;

• monitoring and logging;

• organizational policies;

• vendor security requirements; and

• other safeguards appropriate to the nature of the information processed.

No system can guarantee absolute security.

You are responsible for maintaining the confidentiality of your Account credentials and should notify us promptly if you suspect unauthorized access to your Account.

25. Children's Privacy

The Services are not intended for children below the minimum age permitted under our Terms of Service.

We do not knowingly collect personal data from individuals who are not legally permitted to use the Services.

If we become aware that personal data has been collected from a child in circumstances where valid authorization was required but not obtained, we will take appropriate steps in accordance with applicable law.

26. Complaints

If you believe that Octripus has not complied with applicable data protection law, we encourage you to contact us first at:

[email protected]

You also have the right to lodge a complaint with the competent data protection supervisory authority.

For individuals in the United Kingdom, the supervisory authority is the Information Commissioner's Office (ICO).

Individuals in the European Economic Area may contact the competent supervisory authority in the country where they live, work, or where the alleged infringement occurred.

27. Third-Party Services and Privacy Policies

The Services may integrate with or link to third-party products and services, including payment providers, messaging services, authentication providers, affiliate platforms, or websites.

Those third parties may process personal data under their own privacy policies.

This Privacy Policy does not govern processing carried out independently by third parties where Octripus does not determine the purposes and means of that processing.

We encourage users to review relevant third-party privacy information when using those services.

28. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes to the Services;

• new product features;

• changes to payment or Partner Program functionality;

• changes to service providers;

• changes to legal requirements; or

• changes to our data processing practices.

The latest version will be made available through the Services.

If changes materially affect how we process personal data, we will provide additional notice where required by law.

Where a new processing activity requires consent, we will seek consent separately rather than treating continued use of the Services as consent.

29. Contact Us

If you have questions about this Privacy Policy, wish to exercise a data protection right, or wish to make a privacy-related request, please contact:

IT TRAVEL LP
Suite 4054 Mitchell House
5 Mitchell Street
Edinburgh, Scotland
EH6 7BD

Email: [email protected]