Privacy

01Who We Are

Mylz is a UK-based travel technology company providing users with the ability to search, personalize, and book travel services such as flights, ground transport, accommodations, and experiences through AI-powered tools and integrations with third-party providers.

02What Data We Collect

We collect different types of data depending on your interaction with the Platform:

• If you use the Platform anonymously, we do not collect personal data beyond what is required for functionality (e.g., essential cookies).
• If you create an account, we may collect your name, email, preferred languages, travel preferences, passport details, payment card details, and chat history.
• If you register using a social login (Google, Facebook, or Apple), we may also collect your associated profile information (e.g., profile photo, name, verified email).
• We collect your IP address and the approximate location derived from it, which we use for security and to operate the sanctions screening described in our Sanctions Compliance Policy.
• We do not collect or process sensitive data (such as health, biometric, or religious information).

We use your data to:

• Provide and personalize your travel search and booking experience
• Improve the quality and responsiveness of our AI and user flows
• Analyze usage trends and optimize performance
• Fulfill bookings and customer support requests

Conversation history is stored for account-based users to deliver more personalized responses and streamline the booking process. Anonymous users’ interactions are not stored beyond the session.

03Voice Input

Where you choose to use voice input, we process the audio you record in order to transcribe it into text and act on your request. Voice capture is never automatic: it begins only when you activate the microphone and ends when you stop it or the request completes.

Audio is transcribed by a speech-to-text provider acting under contract on our instructions. We retain the resulting transcript as part of your conversation history on the same basis as typed messages, and we do not retain the underlying audio recording beyond the short period required to produce and verify the transcript.

We do not use voice recordings to identify you by your voice, and we do not use them to train third-party models. Voice input is processed on the basis of your consent, given each time you activate the microphone: you can decline it entirely and type your request instead, with no loss of functionality, and withdrawing it has no effect on your ability to search or book. To request deletion of a transcript, contact privacy@gomylz.com.

04AI and Automated Processing

We use large language models (LLMs) to power conversational interactions and personalize travel recommendations. For account-based users, your conversations may be analyzed by automated systems to detect booking issues, improve UX, or evaluate AI performance.

For account-based users we also build a travel preference profile from your conversations and bookings — for example the cabin, carrier, rail operator or accommodation type you tend to choose — and use it to rank and pre-fill future suggestions. This is personalisation of the options we show you: it does not change the price you are offered, and you can opt out of it, or ask us to reset it, at any time by contacting privacy@gomylz.com. We build and keep this profile on the basis of your consent, given when you create an account and enable personalisation; withdrawing that consent stops the profiling and deletes the profile, and does not affect your ability to search or book.

No automated decisions are made that would have legal or similarly significant effects on users. Mylz does not involve human review of individual conversations, although aggregate patterns may be used to guide platform improvements.

05Cookies and Analytics

Mylz uses only essential cookies required for platform operation unless you create an account or opt into analytics. We may use third-party analytics services such as Google Analytics and Tableau to understand site usage. These tools may collect anonymized technical data (e.g., browser type, pages visited).

We may also use social media tools for login and engagement (e.g., Google, Facebook, Apple).

06Data Sharing and Third Parties

We do not sell your personal data. We may share limited, aggregated, and anonymized data with trusted travel partners for analytics and performance insights. Personal user data is not shared with travel partners unless necessary to complete a booking.

We use third-party services to support platform functionality including:

• Payment processors
• Social sign-in services (Google, Facebook, Apple)
• Analytics platforms (e.g., Google Analytics, Tableau)
• Speech-to-text transcription providers, used only when you activate voice input
• Sanctions and compliance screening partners, who receive the minimum data needed to check a booking against applicable sanctions lists

These providers process data under contract and only for the purposes we instruct. Payment card information is processed securely by a regulated third-party payment processor (e.g., Stripe) and is never stored directly on Mylz systems.

07Data Retention and Deletion

For account-based users, we retain conversation history and personal data (including passport and payment card details) for up to 12 months unless otherwise requested. Your travel preference profile is derived from that history but is retained separately for as long as your account remains open, so that personalisation survives the expiry of the underlying conversations. It is retained on the basis of your consent and contains preferences only — never passport or payment details — and we delete or reset it when you withdraw consent, on request, or when you close your account.

You may request the deletion of your account or data at any time by contacting us at privacy@gomylz.com.

Anonymous usage data is not stored.

08User Rights

You have the right to:

• Access the data we hold about you
• Request correction or deletion of your personal data
• Object to or restrict certain types of processing
• File a complaint with a data protection authority

To exercise your rights, contact: privacy@gomylz.com

09Data Storage and International Transfers

Data may be processed and stored in the United Kingdom, the European Economic Area (EEA), or the United States, depending on infrastructure location.

We ensure appropriate safeguards are in place for all data transfers outside the UK or EEA in compliance with GDPR and other applicable laws.

10Children’s Privacy

The Platform is not intended for users under the age of 18. We do not knowingly collect or process data from children under 18.

Our Terms & Conditions require all users to confirm they are 18 years or older. If we discover such data has been collected, we will delete it promptly.

11Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes and post the updated version on gomylz.com with a new effective date.

12Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at: privacy@gomylz.com