1. Introduction

Altoura is a premium travel and lifestyle membership platform that connects members with curated flight bookings, hotel stays, tours, experiences, active-travel retreats, and exclusive lifestyle content. Altoura operates under the host agency umbrella of Nexion Travel Group (IATA: 45-61343-3), which provides regulatory, accreditation, and operational support.

We are committed to protecting the personal information of everyone who visits our website, uses our mobile application, or purchases a membership or booking through our platform. This Privacy Policy describes our practices regarding the collection, use, disclosure, and protection of your personal information in connection with all Altoura services.

This Policy is effective as of June 3, 2026. If you have any questions or concerns about our privacy practices, you may contact our Privacy Team at any time at legal@altoura.ai.

2. scope of this policy

This Privacy Policy applies to:

• The Altoura website (altoura.com and any related subdomains)
• The Altoura mobile application (iOS and Android, if and when available)
• All services, features, content, and transactions offered through the Altoura platform, including membership subscriptions, flight and hotel bookings, tour and experience purchases, and retreat enrollments
• Communications between you and Altoura, including email, live chat, and customer support

This Policy does not apply to third-party websites, services, or applications that may be linked from our platform. We encourage you to review the privacy policies of any third-party platforms you visit. Altoura is not responsible for the privacy practices of external sites.

3. Information We Collect

We collect information in several ways — directly from you, automatically through your use of the platform, and from third-party services we integrate with to deliver our travel and lifestyle offerings.

3.1. PERSONAL ITEM YOU PROVIDE

When you create an account, purchase a membership, or make a booking, you may provide us with:

• Full legal name, email address, and phone number
• Billing and shipping address
• Date of birth
• Passport details and nationality (required for international flight bookings)
• Emergency contact information
• Travel preferences, dietary requirements, and accessibility needs

3.2. PAYMENT INFORMATION

When you make a purchase on our platform, payment information such as credit or debit card numbers is collected and processed by our PCI-DSS compliant third-party payment processor. Altoura does not directly store, process, or transmit full payment card data. We may retain limited transaction metadata (e.g., last four digits of a card, transaction ID) for billing reference and fraud prevention.

3.3. Booking & Travel Data

To fulfill your travel bookings, we collect and process:

• Flight data — searches, selections, and completed bookings processed via the Duffel API
• Tour and experience data — searches, selections, and completed bookings processed via the Viator API
• Hotel reservation data — property selections, check-in/check-out dates, and guest preferences
• Retreat enrollment data — active-travel retreat registrations, participant details, and itinerary preferences

3.4. Account & Membership Data

• Membership tier (e.g., Free, Wanderlust, Global Citizen, Jetsetter)
• Login credentials — passwords are stored in hashed, non-reversible format
• Subscription status, billing cycle, and renewal history
• Member profile preferences and saved itineraries

3.5. Usage & Technical Data

When you access or use our platform, we automatically collect certain technical information, including:

• IP address and approximate geographic location
• Device type, operating system, and browser type and version
• Pages visited, links clicked, and time spent on pages
• Session data and referral source (how you arrived at the platform)
• Cookies and similar tracking technologies (see Section 6)

3.6. Communications

If you contact our support team or interact with us through other channels, we collect:

• Customer support emails and responses
• Live chat or messaging transcripts
• Survey responses and feedback submissions

4. How We Use Your Information

We use the information we collect for the following purposes:

5. How We Share Your Information

Altoura does not sell your personal information. We share your information only in the limited circumstances described below.

5.1. Service Providers

We engage trusted third-party vendors to support our operations, including payment processors, cloud hosting providers, email and SMS delivery platforms, customer support tools, and analytics services. These providers access only the data necessary to perform their services and are contractually required to protect it.

5.2. Travel Suppliers

To complete your bookings, we share the minimum necessary personal information with:

• Airlines — via the Duffel API, including passenger name, date of birth, passport details, and contact information
• Tour operators and experience providers — via the Viator API, including participant names and relevant booking details
• Hotels and accommodation providers — including guest name, check-in/out dates, and special requests
• Retreat venues and activity partners — including enrollment details and participant health or accessibility information as required

5.3. Host Agency (Nexion Travel Group)

As Altoura's host agency, Nexion Travel Group (IATA: 45-61343-3) may receive access to booking records, financial data, and member information as required for IATA/ARC accreditation, regulatory compliance, auditing, and legal reporting obligations. Nexion is bound by applicable data protection obligations in connection with this access.

5.4. Legal & Regulatory Disclosures

We may disclose your information when required to do so by law, regulation, subpoena, court order, or governmental authority, or when we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Altoura, our members, or the public.

5.5. Business Transfers

In the event of a merger, acquisition, asset sale, or other business restructuring, your personal information may be transferred as part of that transaction. We will notify affected users via email or a prominent platform notice prior to any such transfer, and the acquiring entity will be required to honor the commitments made in this Policy.

5.6. With Your Consent

We may share your information with third parties for purposes not described in this Policy when we have obtained your explicit prior consent to do so.

6. Cookies and Local Storage

Altoura uses a small number of cookies and browser local-storage entries to keep you signed in, remember your preferences, and — only with your consent — measure how the platform is used. We do not use third-party advertising networks, social-media tracking pixels, or cross-site advertising cookies.

6.1. Cookie Categories

Our cookie consent controls group cookies and similar technologies into four categories. Strictly necessary cookies are always active; the other three are off by default until you allow them:

6.2. Cookies and Storage We Set

Our cookie consent controls group cookies and similar technologies into four categories. Strictly necessary cookies are always active; the other three are off by default until you allow them:

6.3. Cookie Consent

When you first visit the Altoura platform, a cookie consent banner lets you accept all, reject all, or customise the non-essential categories (Performance & Analytics, Preferences, and Marketing & Tracking). Non-essential cookies are not set until you give consent, and your choice is saved for future visits.

6.4. Managing or Changing Your Choices

You can change your decision at any time using the "Cookie preferences" link in the site footer, which reopens the consent controls. Withdrawing consent for Performance or Marketing immediately deletes the related cookie. You may also block or delete cookies through your browser settings (Chrome, Firefox, Safari, Edge). Please note that disabling certain cookies may affect functionality, such as staying signed in or remembering your preferences.

7. Data retention

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods include:

• Active account data: Retained for the duration of your active membership and account relationship with Altoura.
• Booking and financial records: Retained for a minimum of 5 to 7 years following the transaction date, as required by tax, accounting, and travel regulatory compliance obligations.
• Marketing and communications data: Retained until you opt out of marketing communications, at which point your contact information is removed from marketing lists promptly.
• Account deletion requests: Upon receipt of a verified deletion request, your personal data will be anonymized or securely deleted within 30 to 90 days, except where retention is required by law or for legitimate business purposes (e.g., outstanding disputes or legal holds).

8. Data Security

We implement a range of technical and organizational security measures designed to protect your personal information from unauthorized access, disclosure, alteration, and destruction.

• Encryption in transit: All data transmitted between your device and our servers is encrypted using Transport Layer Security (TLS).
• Encryption at rest: Sensitive data stored on our systems is encrypted using AES-256 encryption standards.
• Access controls: Access to personal data is restricted to authorized personnel on a need-to-know basis, with multi-factor authentication enforced for system access.
• Regular security audits: We conduct periodic security assessments, vulnerability scans, and penetration testing to identify and remediate potential weaknesses.
• Password protection: User passwords are stored using one-way hashing algorithms and are never stored in plain text.

While we strive to maintain industry-standard security practices, no method of electronic transmission or storage is 100% secure. If you believe your account has been compromised or you have reason to suspect a data breach involving your information, please contact us immediately at legal@altoura.ai.

9. Your Rights and Choices

Depending on your location and applicable law, you may have the following rights with respect to your personal information:

• Access: Request a copy of the personal information we hold about you.
• Encryption at rest: Sensitive data stored on our systems is encrypted using AES-256 encryption standards.
• Access controls: Access to personal data is restricted to authorized personnel on a need-to-know basis, with multi-factor authentication enforced for system access.
• Data Portability: Request a machine-readable copy of your personal data to transfer to another service.
• Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.
• Opt Out of Marketing: Use the unsubscribe link included in any marketing email, or contact legal@altoura.ai to be removed from marketing lists. Transactional communications (booking confirmations, receipts, itinerary updates) cannot be opted out of while your account remains active, as they are necessary to fulfill your purchases.
• Cookie Opt-Out: Manage cookie preferences through the consent banner or your browser settings (see Section 6).

To exercise any of the above rights, contact us at legal@altoura.ai. We will respond within the timeframes required by applicable law (generally 30 days, with an extension to 60 days for complex requests).

10. International Data Transfers

Altoura is based in the United States, and your personal information is primarily processed and stored on servers located in the United States. If you are accessing our platform from outside the United States — including from the European Economic Area (EEA) or the United Kingdom — please be aware that your information will be transferred to and processed in a jurisdiction that may have different data protection laws than your home country.

For EEA and UK users, we take appropriate safeguards to ensure that such transfers comply with applicable data protection requirements. These safeguards may include:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• UK International Data Transfer Agreements (IDTAs) where applicable
• Other legally recognized transfer mechanisms under GDPR or UK GDPR

Additionally, to complete international travel bookings, your personal information (including passport details and passenger names) may be shared with airlines, hotels, and tour operators located in countries other than the United States. Such sharing is required to fulfill your travel purchases and is conducted in accordance with international aviation and hospitality industry standards.

11. Children's Privacy

The Altoura platform is not directed at, designed for, or intended to be used by children under the age of 13. We do not knowingly collect personal information from children under 13 years of age.

If we become aware that we have inadvertently collected personal information from a child under 13 without verifiable parental consent, we will take prompt steps to delete that information from our records. If you are a parent or guardian and believe your child under 13 has provided personal information to Altoura, please contact us at legal@altoura.ai and we will act swiftly to remediate the situation.

12. Third-Party Links and Services

Our platform may contain links to third-party websites, travel suppliers, booking engines, and service partners — including, but not limited to, airline websites accessed via Duffel, tour and activity providers accessed via Viator, and hotel chains or retreat venues. These links are provided for your convenience and reference.

Altoura is not responsible for the privacy practices, security measures, or content of any third-party websites or services. Clicking on a third-party link will take you away from the Altoura platform and subject you to the privacy policy and terms of service of that third party. We strongly encourage you to review the privacy policies of any third-party sites you visit before submitting your personal information.

13. Marketing and Communications

Altoura may send you the following types of communications:

• Transactional messages: Booking confirmations, itinerary details, receipts, account notifications, and security alerts. These communications are necessary to fulfill your purchases and cannot be opted out of while your account is active.
• Membership communications: Billing notices, renewal reminders, and updates to membership terms or benefits.
• Newsletters and lifestyle content: Curated travel inspiration, destination guides, member spotlights, and exclusive content aligned with your travel preferences.
• Promotional offers: Discounts, limited-time deals, partner promotions, and member-exclusive pricing.
• Retreat announcements: Upcoming active-travel retreats, early-access registration, and retreat waitlist notifications.

How to Opt Out of Marketing Communications: Every marketing email sent by Altoura includes an unsubscribe link at the bottom of the message. You may click this link at any time to opt out of future marketing communications. Alternatively, you may email us at legal@altoura.ai with the subject line "Unsubscribe" and we will process your request within 10 business days. Please note that opting out of marketing does not affect the delivery of transactional messages.

14. Changes to This Policy

We reserve the right to update or modify this Privacy Policy at any time to reflect changes in our practices, platform features, applicable laws, or business operations. When we make material changes, we will notify you by:

• Sending an email notification to the address associated with your Altoura account, and/or
• Displaying a prominent notice or banner on the Altoura website or application

The "Last Updated" date at the top of this document will be revised with each update. Your continued use of the Altoura platform following the posting of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree to the updated Policy, you should discontinue your use of the platform and contact us to close your account.

We encourage you to review this Policy periodically to stay informed about how we collect, use, and protect your information.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please do not hesitate to reach out to our Privacy Team. We are committed to responding to all privacy-related inquiries within 30 days of receipt.

For California Residents: You may also submit privacy rights requests to legal@altoura.ai with the subject line "California Privacy Request." For EEA/UK Residents: You may contact your local supervisory authority if you believe your rights under GDPR or UK GDPR have not been honored.