Privacy Policy

Last updated: May 22, 2026

1. Information We Collect

When you use Sayakat, we collect only the information you voluntarily provide through our travel program generator form:

  • Travel preferences: destination country, cities, number of days, number of travelers, age group, vacation type, budget level, season, meal plan, transportation preference, accommodation type, and special interests.
  • Email address: used solely to deliver your generated travel program (PDF and HTML) and nothing else.

We do not collect names, phone numbers, payment information, physical addresses, or any other personal data beyond what is listed above.

2. How We Use Your Information

  • To generate a personalized travel itinerary using artificial intelligence.
  • To send you the generated travel program via email (PDF attachment and HTML link).
  • To send a notification to our internal Telegram channel for service monitoring.
  • To enforce rate limiting (maximum 2 program generations per email per day).

We do not use your information for marketing, advertising, selling to third parties, or any purpose beyond delivering the service.

3. Data Storage

  • Generated programs (HTML/PDF): stored on Cloudflare R2 with access via time-limited signed URLs that expire after 14 days. After expiration, files become permanently inaccessible.
  • Email rate limit counters: stored in n8n workflow static data (in-memory), automatically cleaned after 3 days.
  • Form data: not permanently stored. Data is processed in real-time and discarded after the program is generated and delivered.

4. Third-Party Services

Sayakat uses the following third-party services to operate:

  • Cloudflare Pages & R2: hosting, serverless functions, file storage. Subject to Cloudflare's Privacy Policy.
  • OpenRouter (GPT-4o-mini): AI model used to generate travel programs. Your form data is sent to OpenRouter as a prompt. Subject to OpenRouter's Privacy Policy.
  • n8n: workflow automation that orchestrates the generation pipeline.
  • Telegram Bot API: used for internal notifications only. Your personal data is not shared with Telegram beyond service metadata.

5. AI-Generated Content

Travel programs are generated by an AI language model. While we strive for accuracy, we cannot guarantee the correctness of recommendations, prices, opening hours, or availability of mentioned venues. AI-generated content should be verified before relying on it for travel decisions.

6. Data Retention

  • Generated PDF/HTML files are automatically deleted from R2 after 14 days (via expired signed URLs).
  • Email rate limit data is automatically purged after 3 days.
  • No long-term database of user information is maintained.

7. Your Rights

You have the right to:

  • Use the service without providing more information than necessary.
  • Request deletion of any stored generated files by contacting us.
  • Opt out by simply not using the service — we retain no persistent user profiles.

8. Cookies

Sayakat uses localStorage to remember your language preference (English or Russian). No cookies or tracking technologies are used. No analytics scripts are loaded.

9. Security

We implement reasonable security measures including:

  • HMAC-SHA256 signed URLs for file access with 14-day expiry.
  • CORS restrictions limiting API access to authorized domains.
  • Server-side input validation and sanitization.
  • XSS protection in the frontend (HTML escaping of AI-generated content).

10. Children's Privacy

Sayakat is not directed at children under 13. We do not knowingly collect personal information from children. The "age group" field in the form is used solely to tailor travel recommendations, not to collect data about minors.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. Continued use of the service after changes constitutes acceptance of the updated policy.

12. Contact

For privacy-related inquiries, contact us at:

[email protected]