Purpose and roles
The agency controls the customer, passenger, supplier and employee data it enters. TraaxAgent processes those business records to provide the requested workspace, documents, collaboration, accounting, backup and support features. Account administration, service security and payment records may involve separate service-provider responsibilities. Processing continues while the service is used and during applicable retention or closure procedures.
Data and people covered
Business records may include names, email addresses, phone numbers, travel references, itinerary details, invoices, supplier payments, payroll and accounting data. The people concerned include customers, passengers, staff, agency owners and supplier contacts. Enter only data you are authorised to process. Optional attachments should contain only what is needed for the transaction.
Instructions and confidentiality
Workspace actions and verified written requests document the agency's instructions. TraaxAgent uses agency records for the requested service and necessary security or legal purposes. Access should be limited to authorised people who are subject to confidentiality obligations. A supplier invitation shares the stated records with that supplier according to the agency's choice.
Security and assistance
The application uses sign-in controls, staff permissions, agency isolation, activity history and encrypted saved backups. Downloaded backup files contain readable private data and must be protected by the agency. We assist verified owners with corrections, exports, rights requests and incident facts that are available to us. These measures do not amount to an independent certification.
Service providers and locations
Sites/OpenAI and Cloudflare provide hosting and infrastructure; Resend handles application email; PayPal handles checkout. PayPal receives payment information directly through checkout. Agencies should request the current provider and processing-location information before accepting a regulated deployment. Provider contracts, international-transfer safeguards and country-specific terms require confirmation; do not assume a particular hosting country.
Incident handling
On becoming aware of an incident affecting agency personal data, support assesses impact, preserves evidence, contains the issue and informs verified affected owners without undue delay. Updates include known scope, protective steps and subsequent corrections. The agency obtains local advice on notices to authorities or individuals. Public notices contain service information rather than personal records.
Return, deletion and retention
Owners can export agency records and request return or deletion from the owner's verified email. Closure requests are reviewed for accounting, tax, dispute and legal retention obligations. Saved daily backups are scheduled for 30-day retention; provider backups and mandatory records may have different retention requirements. Export before closure. In-app restore adds missing records and does not undo edits.
Contracts and professional review
These terms describe the operating workflow. A regulated agency should obtain an executed agreement identifying the legal contracting entities, authorised subprocessors, locations and transfer safeguards, assistance duties, return/deletion terms and audit arrangements before relying on a formal DPA. No signed agreement or universal privacy compliance is implied. Contact support to arrange the required professional review.