Privacy Policy

Effective August 8, 2026 · Last updated August 8, 2026

This policy explains what MBM Studio Travel collects, why, and what you can do about it. It covers two different groups of people, and it matters which one you are.

Prospective travellers who fill in a travel advisor’s inquiry form on this site.
Travel advisors who hold an MBM Studio account and use the software.

If you are a traveller: the advisor you contacted decides how your information is used to plan your trip — they are the one you have a relationship with. MBM Studio is the software they use to receive and manage it. Questions about your trip go to your advisor; questions about the software can come to us.

1. Information we collect

If you submit an inquiry form

Only what you type, plus a little context:

You provide: first and last name, email address, phone number, and optionally destination, travel dates, budget, number of travellers, trip type, and any notes you write.
Collected automatically: how you arrived at the page (referring site and any advertising tags such as utm_source, gclid or fbclid), and your IP address, which we use to block automated spam submissions.

Your inquiry goes to the specific advisor whose form you used. It is not shared with other advisors.

If you hold an advisor account

Account: name, email address, and a password (or your Google sign-in, in which case we never see a password).
Profile: anything you choose to add — phone, agency name, IATA number, address, website, social handles, profile photo, branding.
Your work: the trips, client records, itineraries, templates, notes, calendar entries and financial figures you enter.
Usage: basic events such as signing in, creating a trip or using the AI assistant, so we can see what is working and what is broken.

Payment card details

If your advisor sends you a secure authorization link and you enter a card:

The card number and security code are encrypted the instant they reach our servers using AES-256-GCM. The key never leaves the server and is never available to any browser.
Your advisor may reveal the card once, to submit it to the named supplier. At that moment the card number, security code, expiry and billing ZIP are permanently deleted.
What remains is an authorization record: cardholder name, last four digits, amount, supplier, your typed consent, and a timestamp.
Card numbers are never emailed and never written to logs.

2. Why we use it

To deliver your inquiry to the advisor you contacted, and to notify them so they can respond promptly.
To provide the software: your account, your data, and the features you use.
To keep the service secure — detecting spam, abuse and fraud.
To understand how the service is used, so we can fix and improve it.
To contact you about your account or a material change to the service.

We do not sell your personal information, and we do not share it with advertisers.

3. Who else processes your information

We use a small number of established providers to run the service. They may only process data on our instructions.

Provider	What it does	What it sees
Google Firebase & Google Cloud	Hosting, sign-in, database, server functions	All stored data (encrypted at rest)
Google Analytics 4	Website traffic measurement	Pages viewed, approximate location, device — not form contents
Anthropic	AI assistant	Only the text of an assistant request, when an advisor uses it
OpenAI	AI assistant (backup)	Same, only if the primary provider is unavailable
Resend	Sends new-lead notification emails to advisors	The advisor’s address and the lead details in the message
Google / Microsoft	Sending email from an advisor’s own mailbox	Only if that advisor connects their mailbox, and only to send

These providers are based in the United States, and information is stored and processed there. We may also disclose information if the law requires it, or to protect the rights and safety of our users.

The AI assistant is used only when an advisor actively chooses to use it. Traveller inquiry details are not sent to AI providers unless the advisor includes them in a request.

3a. Connecting your Google account

An advisor may choose to connect their Gmail account so that emails MBM Studio drafts can be sent from their own address. This is optional; nothing in the app requires it, and drafts can always be copied into your own mail program instead.

When you connect, we request a single permission: https://www.googleapis.com/auth/gmail.send. That permission allows us to send a message on your behalf and nothing else. MBM Studio cannot read, search, download, modify or delete any message in your mailbox, and cannot see your contacts, labels or attachments.

What we store is an encrypted Google refresh token and the email address of the connected account. The token is encrypted at rest and is used only at the moment you press Send. We keep a copy of the messages you send through MBM Studio so they appear in the client’s history inside the app.

You can disconnect at any time in Settings → Send from your own mailbox → Disconnect, which revokes the permission with Google and deletes our copy of the token. You can also revoke it yourself at myaccount.google.com/permissions.

Limited Use. MBM Studio’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to develop, improve or train generalised artificial intelligence or machine learning models, do not transfer it to any third party except as needed to provide or improve this feature, to comply with applicable law, or as part of a merger or acquisition, and do not allow humans to read it except with your explicit consent, where necessary for security purposes, to comply with applicable law, or where the data is aggregated and anonymised.

4. Cookies and analytics

We use Google Analytics to count visits and understand which pages people use. It sets cookies and records a trimmed version of your IP address. We also store a small record in your browser noting how you first arrived, so an advisor can tell which of their links or ads is working.

We do not use advertising cookies and we do not build advertising profiles. You can block cookies in your browser settings, or install Google’s opt-out add-on. The site works normally either way.

The secure card-authorization page carries no analytics and no tracking of any kind. Nothing about a card entry page is reported to any third party.

5. How long we keep things

Card numbers and security codes: deleted the moment the advisor reveals them once. Never retained.
Inquiries: kept in the advisor’s account until they delete them. Ask your advisor to remove yours at any time.
Advisor accounts and trip data: kept while the account is active, and deleted on request when it closes.
Spam-prevention records: IP addresses used for rate limiting are stored hashed, not in readable form, and expire automatically.

6. Your choices

See or correct your information. Advisors can view and edit everything in the app. Travellers should contact the advisor they submitted to, or email us and we will help route it.
Delete it. Email support@mbmstudiotravel.com and we will delete your information, unless we are required to keep a record.
Export it. Advisors can export trip data from the app at any time.
Stop emails. Every non-essential email has an unsubscribe link. Service messages about your own account cannot be switched off while the account is open.

Depending on where you live, you may have additional rights over your personal information — including access, correction, deletion, and the right not to be discriminated against for exercising them. Email us and we will honour any right that applies to you, whether or not we are strictly required to.

7. Security

All traffic is encrypted in transit (HTTPS). Data is encrypted at rest by our infrastructure provider. Payment card fields get a second, separate layer of encryption with a key held only on the server. Access to each advisor’s data is enforced by database-level rules, so one advisor cannot read another’s clients. No system is perfectly secure, but we take this seriously and fix problems quickly when we find them.

8. Children

MBM Studio is not directed at children under 13 and we do not knowingly collect their information. An advisor may record the names or ages of children travelling as part of a family booking; that information is provided by the adult arranging the trip. If you believe a child’s information has been collected improperly, email us and we will remove it.

9. Changes

If we change this policy we will update the date at the top and, for anything material, notify account holders in the app or by email.

10. Contact

Privacy questions, requests or complaints: support@mbmstudiotravel.com

MBM Studio Travel · Terms of Service · Home