Privacy policy
Review status: draft — not a certified translation or legal advice.
This draft describes the kinds of data a planning and booking service like Oasia will handle. It is not a compliant privacy notice until legally reviewed.
Conversation data
Messages you send to the planning assistant, voice transcripts processed in your browser, suggestion chips you tap, and trip-summary fields are stored so we can continue planning and so a human can review. Mock mode currently keeps a copy in your browser and in a server-side mock adapter — not in a production database.
Requires review: Kyrgyz lawyer.
Contact information
Name, email, phone, WhatsApp, or Telegram handles are used to continue the conversation and to send confirmations.
Requires review: Kyrgyz lawyer.
Traveler preferences
Dates, pace, interests, budget notes, accommodation and transport preferences help us design a trip. They are not sold as marketing lists in this draft policy — a lawyer must confirm actual practice.
Requires review: Kyrgyz lawyer.
Passport or document information
Identity documents, if required, should be collected only after booking through a secure flow, not via the public homepage chat. That flow is designed, not yet implemented.
Requires review: Kyrgyz lawyer.
Health, dietary, and accessibility information
You may share dietary, medical, mobility, or accessibility notes so we can plan safely. This is sensitive information. Access should be limited to people who need it to operate the trip.
Requires review: Kyrgyz lawyer.
Supplier data sharing
Guides, drivers, stays, and other partners receive the minimum information required to deliver the service (for example, first names, dates, allergies they must know). They should not receive your full conversation history.
Requires review: Kyrgyz lawyer.
AI processing
The assistant uses an AI service interface. In production this must be a contracted processor with documented retention. No API keys belong in the browser. The AI must not be treated as a source of confirmed prices or legal advice.
Requires review: Kyrgyz lawyer.
Data retention
Planning conversations, quotes, and booking records will need stated retention periods (for example, as long as needed to deliver the trip and meet accounting rules). Exact periods are not invented here.
Requires review: Kyrgyz lawyer and accountant.
Deletion and access requests
You should be able to ask what we hold and to request deletion where law allows, understanding that booking and invoice records may need to be kept. The request channel will be the published privacy email once operations confirm it.
Requires review: Kyrgyz lawyer.