Privacy Policy

This policy explains what TacLine LLC does with personal information in connection with ONE Travel OS.

If you are a traveler whose advisor uses ONE Travel OS, this is probably not the document you want. Your relationship is with the agency, not with us; ask them for their privacy notice. The notice for households is the template most of them start from.

1. We wear two hats, and they carry different duties

Almost every confusing question about privacy and software comes from mixing these up, so they are separated first.

As a business, for our own data. When you visit our site, ask for a demo, or hold an account as an agency administrator or advisor, we decide what to collect and why. That data is ours to answer for, and this policy governs it.

As a service provider, for an agency’s data. Everything an agency puts into ONE Travel OS (its households, travelers, trips, bookings, correspondence, documents) belongs to that agency. We hold it on their instructions and for no purpose of our own. The agency decides what goes in, why, and how long it stays; it tells the people concerned; and it answers their requests. What binds us on that data is the Data Processing Addendum, not this policy.

Sections 2 to 4 are the first hat. Section 5 is the second.

2. What we collect directly

We do not buy personal information, and we do not collect it from data brokers.

Bank details and taxpayer numbers

An advisor’s taxpayer identification number and bank account and routing numbers are encrypted at rest and visible only to the people who run payouts. They are used to pay you and to report what you were paid, and for nothing else.

3. What your browser stores, and what it sends us

• A sign-in cookie. Set only once you sign in. It holds a session identifier, nothing else, and it is signed, HTTP-only and same-site.
• Your theme and menu choices. Light or dark, and whether you collapsed the menu, kept in your browser’s local storage. They never reach us.
• A bot check. Our sign-in and public forms may run Cloudflare Turnstile, which is there to tell a person from a script. It is not an analytics product and it does not profile you.
• Analytics cookies, only if you accept them. On the pages agency staff and advisors use once signed in, we ask whether PostHog, a product-analytics service, may see which pages and buttons you use and record your sessions. If you accept, PostHog sets a cookie. Its recordings hide every word on the screen and everything typed into a field, and we strip search terms from web addresses before PostHog sees them. If you reject, PostHog sets no cookie, records no sessions and sees no clicks. It counts each page you open, and tells visits apart with a code it works out from your IP address and browser and changes every day. Until you answer, it receives nothing. We keep your answer with your account, and you can change it under Your details.

There is no advertising and no third-party tracker on any page we serve, and no analytics anywhere but the staff pages above. Our public site, the client portal and these legal pages run none. Nothing here follows you to another site, and there is nothing for a “do not sell” signal to switch off, but see section 9 on how we treat one anyway.

4. Why we use what we collect

To run ONE Travel OS and keep it available; to sign you in and to detect and investigate misuse; to answer you; to bill you and to pay advisors; to meet our tax, accounting and legal obligations; to tell you about changes that affect you; and, where you accepted analytics cookies, to learn how ONE Travel OS is used.

That is the list. We do not use any of it for advertising, and we do not use it to train machine-learning models.

5. The data agencies put in

An agency using ONE Travel OS will typically store, about its own households and travelers: names and contact details, postal addresses, travel documents including passport numbers and expiry dates, dates of birth, known traveler and redress numbers, emergency contacts, dietary requirements and accessibility needs, trip and booking records, amounts paid and owed, uploaded documents, and correspondence where the agency has connected a mailbox.

We hold all of it as a service provider. Specifically, we do not:

• sell it, share it, or disclose it for anyone’s advertising;
• use it to build, train or improve a product, ours or anyone’s, with one exception we would rather name than let this line cover: where an agency enables document parsing, the booking confirmations it sends to be read may go to an outside service whose own terms permit it to use them to improve its services. Which of two services reads them is our choice, made for every agency at once. Only those documents, and only where it is switched on. Commission statements go only to the other service, whose terms bar it from training on them. See the AI disclosure and the DPA;
• combine it with data from another agency or another source;
• read it for any purpose other than operating ONE Travel OS, supporting the agency, and complying with law.

Two access paths exist and both are recorded. A platform administrator can view ONE Travel OS as one of an agency’s users to reproduce a problem; this needs a stated reason, expires after thirty minutes, and is written to an audit trail. The people who operate the platform have the database access that running it requires.

If you are one of those households or travelers and you want something changed or deleted, ask the agency. They can do it themselves, in the app, and they are the ones who owe you the answer. If you cannot reach them, write to onetravelos@taclinetech.com and we will help you find them.

6. Who else sees it

Only the companies we need to run the service. Each is bound by contract to use what it holds solely to provide its service to us, and never for its own purposes, except one of the two document-parsing services, whose terms permit it to use documents submitted to it to improve its own services, and which does not offer an agreement barring that on the plan we hold. It receives the booking confirmations an agency sends to be read, when we have chosen it to read them, and nothing else, and only where document parsing is enabled. The DPA section 3 states the exception; the AI disclosure explains it.

They are listed by name, with what each one gets, in the Data Processing Addendum. That list is the authoritative one and it changes when the services change; repeating it here would only let the two drift apart.

We will also disclose personal information where the law genuinely requires it. If we are compelled to hand over an agency’s data, we will tell the agency unless we are legally barred from doing so.

If our business is ever sold or merged, data may transfer with it. Whoever receives it is bound by this policy until you are told otherwise, and you will be told before anything changes.

7. How we protect it

• Every agency’s data is scoped to that agency in the database, and the scoping is enforced by the application on every query, not by remembering to filter.
• Passwords are hashed, never stored in a form anyone can read back.
• The sensitive fields are encrypted at rest, individually. Passport numbers, dates of birth, known traveler and redress numbers, loyalty membership numbers, advisor taxpayer numbers and bank details, supplier portal credentials, mailbox tokens and two-factor secrets are each encrypted in the database, so reaching the database is not the same as reading them.
• Two-factor authentication is available to everyone and on by default for administrators.
• Uploaded documents are served through an authenticated check behind links that expire after five minutes, so a copied URL stops working.
• Payment card numbers are refused, not stored. Notes fields and outgoing mail are scanned, and a save or a send containing a card number is rejected. An uploaded file is scanned the same way wherever it has text to read: a PDF with a text layer, a Word file, a spreadsheet. A file we cannot read the text of is not checked: a photograph, a screenshot, a scan with no text in it, a password-protected document. We keep such a file and record that it was not checked, rather than treating it as clean, and files uploaded before this check existed carry no result either way. Beyond that one gap, no field in ONE Travel OS can hold more than the brand and last four digits of a payment, and it holds no card for a household in any form, encrypted or not.
• Changes to records are versioned, so there is a trail of who changed what.
• Our error reporting is configured to send errors only, with personal information switched off, so passports, dates of birth and bank details do not leave the application in a crash report.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your personal information we will tell you and the relevant regulators as the law requires.

8. How long we keep it

Within an agency’s own data, ONE Travel OS defaults to purging passport details 24 months after travel ends, correspondence after 24 months, and the original message files behind it after 90 days. Each agency can change those, so the agency is the one to ask.

9. What you can ask for

If you live in California, and under the comparable laws of Colorado, Connecticut, Texas, Virginia and other states, you can ask us to:

• Tell you what personal information we hold about you, where we got it, why we have it, and who we have given it to.
• Give you a copy of it, in a portable form.
• Correct anything inaccurate.
• Delete it, subject to what we must keep, chiefly tax and payout records, and anything under a legal hold.
• Limit how we use sensitive information. Passport numbers, taxpayer numbers, bank details and account credentials are sensitive information. We already use them only to provide the service and to meet our legal obligations, which is the narrow set of purposes the law permits without any request from you. There is nothing further to switch off, and asking will not reduce what you get.

We do not sell personal information and we do not share it for cross-context behavioral advertising, as those terms are defined in California law, and we have not in the twelve months before the date at the top of this page. A Global Privacy Control signal therefore has nothing to switch off: there is no selling or sharing to opt out of, whether or not your browser sends one.

You will not be treated differently for asking. No worse price, no reduced service, no consequence at all.

How to ask

Write to onetravelos@taclinetech.com. Tell us what you want and enough for us to find you; if you have an account, ask from the address on it.

We answer within 45 days, and will tell you if we need longer. An authorized agent may ask on your behalf with written proof, and we may still verify with you directly.

If we turn a request down we will say why, and you can appeal by replying to the same address. If you are still unhappy, you can complain to your state’s attorney general.

One honest limit. For data an agency put into ONE Travel OS, we will pass your request to that agency rather than act on it ourselves. They are the only ones who can decide whether a record should exist, and acting on their data without them is exactly the thing a service provider must not do.

10. Children

ONE Travel OS is a tool for businesses and is not directed at children. We do not knowingly collect anything from a child directly.

An agency may hold a minor’s details as a traveler on a family booking, entered by the parent or guardian arranging the trip. That data is the agency’s, under section 5, and requests about it go to them.

11. Text messages and mobile information

If you give us a mobile number and agree to automated text messages, that number and the record of your agreement are handled under ONE Travel OS Notifications, the messaging program TacLine LLC operates for ONE Travel OS. It sends from one shared toll-free number, (833) 270-2750. Message frequency varies, message and data rates may apply, and STOP stops it from any phone. The terms of service carry the program’s own terms.

This policy is the one that governs mobile information for ONE Travel OS. The commitment:

Mobile numbers and text-messaging consent are never sold, and never shared with third parties or affiliates for marketing or promotional purposes. They go to the messaging provider that delivers the message, and nowhere else. They are excluded from analytics, advertising and partner arrangements, and from any transfer of the business.

What we keep is the number, the version of the wording you agreed to, when you agreed, and which screen you were on, not a copy of the text you were shown. That is what lets us answer, later, which agreement a number is held under.

Recording a number is not permission to text it: agreement and a code sent to the handset are both required, and either can be withdrawn at any time from your own settings or by replying STOP.

12. Changes

When this policy changes we update the date at the top and keep the previous version. If a change materially affects your rights, we will tell account holders directly before it takes effect rather than after.

Ask us for the version that was in force on a particular date and we will show you.

13. Contact

TacLine LLC 418 Broadway STE R, Albany, NY 12207

Privacy requests, contract questions, anything else: onetravelos@taclinetech.com