Privacy Policy

1. About This Privacy Policy

This Privacy Policy describes how My Waypoint Technologies Inc. collects, uses, stores, and discloses personal information when you access or use MyBusinessTrip.ca, including the web application, mobile application, account services, and related features (collectively, the “Service”).

This is Privacy Policy Version 2.0. When you create an account, your acceptance of the current Privacy Policy version is recorded alongside your acceptance of the Terms of Service. If we make material changes to this policy, we will publish an updated version with a new effective date.

This policy is grounded in verified technical implementation. Where we describe what a third-party provider does with data, we attribute that statement to the provider.

2. Who We Are

MyBusinessTrip.ca is operated by My Waypoint Technologies Inc., a Canadian company. When this policy refers to “we,” “us,” or “MyBusinessTrip,” it means My Waypoint Technologies Inc.

The Service is operated from Canada. Primary application data is stored on Amazon Web Services infrastructure in the ca-central-1 (Canada) region. Some service providers process data outside Canada — this is described in Section 11.

Privacy inquiries: privacy@mybusinesstrip.ca

3. Scope

This policy applies to:

• The MyBusinessTrip.ca website and public pages
• The authenticated MyBusinessTrip.ca web application
• The MyBusinessTrip mobile application
• Account registration and management
• Trip planning workspaces and all trip-related features
• AI-assisted features (trip planning, summaries, follow-up drafts)
• File upload, receipt scanning, and document storage
• Payment and subscription management
• Organization and team account features

This policy does not cover third-party websites or services you may access through links in the Service. Those services have their own privacy policies.

4. Information We Collect

We collect information you provide directly, information generated by your use of the Service, and limited technical information required to operate it securely.

A. Account Information

• Name and email address
• Password — stored as a secure hash; we do not store your plaintext password
• Account identifier and status
• Subscription plan and billing status
• Legal acceptance records (version of Terms and Privacy Policy accepted, timestamp of acceptance)
• Email verification status

B. Trip and Itinerary Information

• Trip titles, destinations, travel dates, and purpose
• Itinerary stops, route stops, and locations
• Hotel and accommodation details
• Restaurant and meal information
• Travel bookings (flights, rental cars, rail, parking)
• Trip status, outcomes, and ratings

C. Meeting and Business Engagement Information

• Meeting titles, dates, times, and locations
• Meeting objectives and attendees
• Discussion notes and outcomes
• Action items and follow-up information
• Notes and knowledge entries
• Trip proposals and planning information

D. Contact Information

• Contact names, roles, and organizations
• Phone numbers and email addresses for contacts you add
• Contact notes and categories
• Business contact and directory information

E. Loyalty and Travel Program Information

• Loyalty and rewards program names and providers
• Membership numbers and member names
• Tier status and program preferences

F. Vehicle Information

• Vehicle records including make, model, year, and type
• Licence plate numbers and province/state of registration
• Mileage rates and distance preferences
• Mileage records and drive segments

G. Files and Documents

• Uploaded PDFs, images, and documents
• Receipt photos and expense attachments
• Loyalty card images (for OCR scanning)
• Observation photos and general attachments
• File metadata (name, type, size, upload date)

Uploaded file content is not sent to generative AI services. See Section 6.

H. Routing and Location Information

• Addresses and route stop locations
• Origin and destination information for drive segments
• Coordinates used for route calculation and geocoding
• Routing results (distance, duration, route geometry)

MyBusinessTrip does not continuously track your device location. Location information is the trip and stop data you enter, plus coordinates used for route calculations.

I. Billing Information

• Stripe customer identifier and subscription identifier
• Subscription plan and status

MyBusinessTrip does not store payment card numbers. Payment card information is entered directly on Stripe's platform. See Section 9.

J. AI Interaction Information

When you use an AI-assisted feature, selected trip and business information required for that specific task is assembled into a request sent to our AI provider. The categories of information included depend on the feature you choose to use. See Section 6 for a detailed description.

K. Technical and Security Information

• IP address and browser/user-agent information
• Request timestamps and server logs
• Authentication events and session records
• Security and audit records
• Error logs and application diagnostics

5. How We Use Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Authenticate your account and manage your session
• Store and retrieve your trip, meeting, contact, and business information
• Calculate routes and geocode locations using OpenRouteService
• Discover hotels and restaurants using Overture Maps open data
• Generate AI-assisted summaries, follow-up drafts, and trip plans when you request them
• Process receipt and loyalty card images using OCR
• Manage your subscription and process payments through Stripe
• Send transactional emails (account verification, password reset, billing notifications)
• Scan uploaded files for malware
• Prevent fraud, abuse, and unauthorized access
• Troubleshoot issues and respond to support requests
• Maintain security, audit, and legally required records
• Respond to privacy requests

MyBusinessTrip does not sell your personal information.

Your trip data is not used for advertising. We do not build advertising profiles from your trip or business information.

6. Artificial Intelligence

MyBusinessTrip uses Amazon Bedrock (an Amazon Web Services service) to provide generative AI features including trip summaries, follow-up draft generation, and AI-assisted trip planning. An Anthropic Claude model is accessed through Amazon Bedrock. MyBusinessTrip does not call the Anthropic API directly and has no direct data relationship with Anthropic.

AI features are optional. You choose when to invoke them. Free plan accounts do not have access to generative AI features.

For a full description of AI features, limitations, and user responsibilities, see our AI Policy.

What information may be included in an AI request

Depending on the AI feature you choose to use, the request sent to Amazon Bedrock may include information such as:

• Trip title, destination, workspace type, and travel dates
• Meeting titles, objectives, attendees, discussion notes, and status
• Action items and follow-up information
• Contact names, roles, and organizations
• Trip outcomes, notes, and expense totals
• User-entered natural language trip descriptions (for AI trip planning)
• Structured itinerary and proposal information
• Hotel information (for AI-assisted hotel ranking)

Not every category is included in every AI request. The information included depends on the specific feature you invoke.

What is excluded from AI requests

Generative AI prompts do not include:

• Passwords or authentication credentials
• Payment card numbers or financial account numbers
• Raw uploaded file content (PDFs, images, documents)
• Raw receipt images

AWS Textract processes receipt and loyalty card images for OCR. Textract is a separate document-processing service, not a generative AI model. See Section 8.

Prompt and output storage

MyBusinessTrip constructs AI prompts at runtime and does not store them. Raw model responses are parsed in memory and discarded. Only structured results derived from AI responses are stored — for example, a generated trip summary, a follow-up draft, or a structured trip proposal.

AWS states that Amazon Bedrock does not store or log prompts and completions, and that customer inputs and outputs are not used to train any models. AWS states that customer data is not shared with model providers. These are AWS's documented positions, backed by the AWS Data Processing Addendum.

AI processing geography

AI requests are sent to Amazon Bedrock using the ca-central-1 (Canada) service endpoint. Cross-region inference is not configured in the current implementation. AWS does not publicly specify the exact location of inference compute beyond the configured service endpoint.

7. Travel, Place and Routing Information

Place discovery

MyBusinessTrip uses open data from the Overture Maps Foundation for hotel and restaurant discovery features. MyBusinessTrip downloads this dataset and hosts it on its own infrastructure. Your place-search queries are processed against MyBusinessTrip's internal copy of the data — they are not sent to Overture Maps Foundation. Overture Maps Foundation is an open-data publisher, not a recipient of your queries.

Place data attribution: “Place data © Overture Maps Foundation” and, where applicable, “© OpenStreetMap contributors.” Attribution is displayed alongside place results in the application.

Routing and geocoding

MyBusinessTrip uses OpenRouteService, operated by HeiGIT gGmbH (Heidelberg Institute for Geoinformation Technology) in Germany, for route distance and duration calculations and address geocoding.

When you use routing or geocoding features, the following information is sent to OpenRouteService:

• Address text strings
• Coordinate pairs (latitude and longitude)
• Routing parameters (vehicle type, unit preference)

The following is not sent to OpenRouteService: your user account identity, email address, name, meeting or business content, or session tokens.

OpenRouteService processes these requests on infrastructure in Germany/EU. This means address and coordinate data leaves Canada when routing or geocoding is performed. See Section 11 for more on international processing.

For information about OpenRouteService's data handling, see their privacy policy at openrouteservice.org/privacy-policy.

8. Files, Receipts and Document Processing

Files you upload — including receipts, documents, photos, and attachments — are stored in MyBusinessTrip-controlled Amazon S3 storage in the ca-central-1 (Canada) region. Uploaded file content is not sent to generative AI services.

Uploaded files are scanned for malware using AWS GuardDuty Malware Protection. Files that fail scanning are quarantined and not made available.

Receipt and document OCR

When you scan a receipt or loyalty card, the image is processed using Amazon Textract, an AWS optical character recognition (OCR) service. Textract is not a generative AI model — it extracts structured text from document images.

Textract requests use the ca-central-1 endpoint. AWS states that documents submitted to Textract are not stored by the service and are not used to train Textract models. The source file remains stored in MyBusinessTrip's S3 bucket according to the applicable file lifecycle.

9. Payment Processing

Subscription payments are processed by Stripe. MyBusinessTrip does not store payment card numbers. When you subscribe, payment card information is entered directly on Stripe's platform.

MyBusinessTrip stores the following Stripe-related information to manage your subscription:

• Stripe customer identifier
• Stripe subscription identifier
• Subscription plan and status

Stripe acts as a data processor for payment transactions processed on our behalf, and also as an independent data controller for its own fraud prevention and regulatory compliance purposes.

Stripe processes payment data on global infrastructure, which means payment information is transferred internationally.

Important: Deleting your MyBusinessTrip account removes our records of your Stripe customer and subscription identifiers. Stripe independently retains payment transaction records for its own legal and regulatory obligations. Deleting your MyBusinessTrip account does not cause Stripe to delete those records.

For information about Stripe's data practices, see stripe.com/privacy.

10. Service Providers

MyBusinessTrip uses the following material service providers to operate the Service. Each provider is engaged to perform specific functions and is not permitted to use your information for their own purposes beyond what is described here.

11. Data Storage and International Processing

Primary application data — your account, trips, meetings, contacts, files, and related information — is stored on Amazon Web Services infrastructure in the ca-central-1 (Canada) region.

However, some processing occurs outside Canada:

• OpenRouteService (Germany/EU): Address and coordinate data is sent to OpenRouteService servers in Germany/EU for routing and geocoding. See Section 7.
• Stripe (global): Payment processing data is handled by Stripe on global infrastructure. See Section 9.
• Email delivery: Transactional emails are delivered through AWS SES and necessarily transit to the recipient's email infrastructure, which may be located anywhere.
• AWS Bedrock and Textract (ca-central-1 endpoint): AI and OCR requests are sent to the ca-central-1 service endpoint. AWS does not publicly specify the exact location of inference compute beyond the configured endpoint region.

Personal information processed outside Canada may be subject to the laws of the jurisdiction where it is processed, including laws that may permit government access to that information. We cannot make guarantees about foreign government access to information held by third-party providers.

Where providers publish Data Processing Agreements or equivalent contractual terms, we rely on those agreements as the mechanism for cross-border transfers.

12. Security

We implement technical and organizational safeguards to protect personal information against unauthorized access, disclosure, alteration, and loss. These include:

• Encryption in transit using TLS for all connections
• Encryption at rest for database and file storage
• Password hashing using bcrypt — plaintext passwords are never stored
• Secure, httpOnly, SameSite session cookies
• Authorization controls ensuring users can only access their own data
• AWS Secrets Manager for credential management
• Encrypted local storage on the mobile application (SQLCipher)
• Device Keychain/Keystore for mobile authentication credentials
• Malware scanning for uploaded files
• Security logging and monitoring
• Web application firewall

No system can guarantee absolute security. If you believe your account has been compromised, contact us at privacy@mybusinesstrip.ca immediately.

13. Data Retention

Different categories of information are retained for different periods because they serve different operational, security, contractual, or legal purposes.

Backup and log retention periods reflect operational and security requirements. Data in backups and logs expires automatically according to the configured retention cycle.

14. Account Deletion

You can delete your account at any time from the Settings page or through the mobile application. When you delete your account:

• Your primary account data — trips, meetings, notes, contacts, expenses, files, and associated records — is deleted through the server-side deletion workflow
• MyBusinessTrip's records of your Stripe customer and subscription identifiers are removed from our database
• On the mobile application, locally stored trip data, files, and authentication credentials are cleared after successful server-side deletion

The following are not deleted at the same moment as primary account data:

• Database backups expire after 7 days on their normal cycle
• Application logs expire after 30 days
• Infrastructure and security logs expire on their configured schedules
• Platform administration audit records are retained for 7 years
• Stripe retains payment transaction records independently for its own legal and regulatory obligations — these are not deleted when you delete your MyBusinessTrip account

15. Mobile Application Privacy

The MyBusinessTrip mobile application stores trip data, contacts, and related information locally on your device to support offline use. Local data is protected as follows:

• Local trip data is stored in an encrypted SQLite database (SQLCipher) on your device's private filesystem
• Authentication credentials (session token, database encryption passphrase) are stored in the device Keychain (iOS) or Keystore (Android)
• The database encryption passphrase is device-local — it is not backed up to iCloud Keychain

iOS backup behaviour

Authentication credentials stored in the iOS Keychain using the device-local accessibility setting are not synchronized to iCloud Keychain and are not included in iCloud backups. They may be included in encrypted local device backups (iTunes/Finder with encryption enabled).

The encrypted local database file may be included in device backups. Because the database is encrypted with SQLCipher and the passphrase is device-local, a backup of the encrypted database without the passphrase is not usable on another device.

Account deletion on mobile

When you delete your account through the mobile application, the application clears all locally stored trip data, files, and authentication credentials after the server-side deletion succeeds. If the server deletion fails, local data is not cleared — your credentials remain revoked on the server side.

16. Cookies and Similar Technologies

MyBusinessTrip.ca does not use advertising or analytics cookies. The only cookie set on the MyBusinessTrip.ca domain is a strictly necessary session cookie:

Unauthenticated visitors receive no cookies. No third-party analytics or tracking scripts are loaded on MyBusinessTrip.ca.

For full details, see our Cookie Policy.

17. Organization Accounts

MyBusinessTrip supports organization and team accounts on applicable subscription plans. When you are a member of an organization on MyBusinessTrip:

• Your membership and role within the organization are recorded
• Organization administrators can manage member access
• Trip and workspace information may be shared within the organization
• Organization-level subscription and billing information is maintained separately

Organization administrators are responsible for managing access within their organization. If you have questions about how your organization uses MyBusinessTrip, contact your organization administrator.

18. User Rights and Choices

You have the following controls over your information within MyBusinessTrip:

• Access: View your account information and trip data within the application at any time
• Correction: Update your account information and trip data through the application
• Export: Export your trip data using the export feature in the application
• Deletion: Delete your account and associated data through Settings or the mobile application
• AI opt-out: AI features are optional — you choose when to invoke them. You can use all core trip planning features without using any AI functionality
• Privacy requests: Contact privacy@mybusinesstrip.ca for any privacy-related request not addressed by the above controls

Additional rights may apply depending on the laws of your jurisdiction. We will respond to privacy requests in accordance with applicable law.

19. Children and Eligibility

MyBusinessTrip is a business travel management service designed for professional use. The Service is not directed at children. You must be of legal age to enter into contracts in your jurisdiction to create an account.

If you believe a minor has created an account, contact us at privacy@mybusinesstrip.ca.

20. Changes to This Policy

When we make material changes to this Privacy Policy, we will publish an updated version with a new version number and effective date. The version you accepted at registration is recorded in your account.

Continued use of the Service after a new version becomes effective constitutes acceptance of the updated policy. If you do not agree with a material change, you may delete your account before the new version takes effect.

21. Contact Us

For privacy questions, requests, or concerns, contact My Waypoint Technologies Inc.:

Email: privacy@mybusinesstrip.ca

We will respond to privacy inquiries as promptly as practicable and in accordance with applicable law.