Privacy at Hey Ula
Your trips are personal. So is your data.
This is how Ula looks after what you share, written in plain language. No small print, no surprises.
At a glance
We never sell your data
Not to advertisers, not to data brokers, not to anyone.
Only what your trip needs
Dates, places, budget and who is coming along. Nothing more.
No card numbers in the chat
Ula never asks for payment cards, passwords or ID in WhatsApp.
Nothing booked without your yes
Ula suggests. You decide. Every booking needs your approval.
Your Travel DNA, your call
See it, correct it or delete it whenever you like.
Real people, one email away
Write to hello@heyula.ai and a person from the team replies.
Your data, one tap away
Each button opens an email to the team with the request filled in.
01Who we are
In shortHey Ula is responsible for the personal data described here. The operating company is named in our Impressum.
Hey Ula ("Ula", "we", "us") plans trips around you and the people you travel with, through a WhatsApp chat and the website heyula.ai. This policy explains what personal data we collect, why we collect it, who we share it with, and the choices you have.
The operator of Hey Ula, named in our Impressum at https://heyula.ai/impressum, is the controller of your personal data under the EU and UK General Data Protection Regulation (GDPR). For anything in this policy, write to hello@heyula.ai. You can also use our Contact page.
02What we collect
In shortWhat you tell Ula about your trips, the basics WhatsApp shares with us, and standard website data.
| Category | Examples | Where it comes from |
|---|---|---|
| Chat and trip details | Travel dates, destinations, budget, pace, who is travelling, and your feedback on options | You, in the WhatsApp chat |
| Travel DNA | Preferences Ula learns over time, such as "no 6am flights" or "weekends under €100" | Built from your chats, with your knowledge |
| WhatsApp account basics | Phone number, WhatsApp profile name and message timestamps | WhatsApp, when you message Ula |
| Booking details | Traveller names and the details a provider needs to confirm a booking | You, only when you choose to book |
| Waitlist check-in | Your WhatsApp number and, if you add them, your email, home city, where you travel next and when. With it, the country and region you checked in from, worked out from your connection (we never keep the IP address itself) | You, when you check in on our website |
| Contact details | Your name and email address | You, when you write to the team |
| Website data | IP address, browser type, pages visited, and approximate location from your IP | Your browser, when you visit our website |
Details about children, such as ages or nap times, are only ever shared by a parent or guardian to plan a family trip. We treat them with extra care and use them for that purpose only.
We never ask for payment card numbers, passwords or government ID in the chat. Please do not send them. If they arrive by mistake, we delete them and keep them out of our systems, logs and trip history.
03How we use your data
In shortTo plan and support your trips, keep the service safe, and answer you. Each use has a clear legal basis.
| What we do | Why | Legal basis |
|---|---|---|
| Plan trips and suggest options | This is the service you ask Ula for | Contract, Art. 6(1)(b) GDPR |
| Remember your Travel DNA | So every trip builds on the last and you do not repeat yourself | Contract, Art. 6(1)(b) GDPR |
| Help you book, when you approve | To pass the right details to the travel provider you chose | Contract, Art. 6(1)(b) GDPR |
| Run the waitlist | To give you a seat, tell you when one opens, and get Ula ready for the trip you mentioned | Steps before a contract, Art. 6(1)(b) GDPR |
| Answer support questions | To help when you write to us | Contract or legitimate interest, Art. 6(1)(b) and (f) GDPR |
| Keep the service secure | To prevent abuse, fraud and outages | Legitimate interest, Art. 6(1)(f) GDPR |
| Understand how the website is used | To improve pages and fix what does not work | Legitimate interest or consent where required, Art. 6(1)(f) or (a) GDPR |
| Meet legal duties | For example tax records for bookings | Legal obligation, Art. 6(1)(c) GDPR |
We do not use your data for advertising profiles, and we do not sell it.
04Travel DNA: what Ula remembers
In shortUla remembers your preferences so you only say them once. You stay in control of that memory.
Travel DNA is the set of preferences Ula keeps for you, such as who usually travels with you, your budget range, your pace, and the places you loved or would rather skip. It is what lets Ula explain why it suggested something.
- Ula only remembers what you share in the chat. It does not read other apps, contacts or photos.
- You can ask what Ula remembers about you, and we will send you a copy.
- You can ask us to correct or delete any part of it, or all of it.
- Deleting your Travel DNA does not affect bookings you have already made.
05AI and your decisions
In shortUla uses AI to suggest options. You always make the final decision.
Ula uses AI models to understand your messages and prepare trip suggestions. These models receive only the trip context needed to answer you. Payment details and secrets are never part of it.
Suggestions are recommendations, not decisions. Nothing is booked or paid without your explicit approval, and we do not make decisions with legal or similarly significant effects about you based solely on automated processing.
06Bookings and travel providers
In shortWhen you choose to book, we share what the provider needs to confirm it. Nothing else.
When you approve a booking, we pass the required details, such as traveller names and dates, to the airline, hotel, rail company or other provider you chose. That provider then uses your data under its own privacy policy, as an independent controller.
Payments are handled by the provider or a dedicated payment service. We never see or store your full card number.
08International transfers
In shortSome providers are outside your country. Where that happens, recognised safeguards protect your data.
Some of our providers process data outside the European Economic Area or the UK, including in the United States. Where this happens we rely on an adequacy decision, such as the EU-US Data Privacy Framework, or on the European Commission's Standard Contractual Clauses, together with additional safeguards where needed.
09How long we keep it
In shortOnly as long as it is useful to you or required by law. Then it is deleted.
| Data | How long | Then |
|---|---|---|
| Travel DNA and chat history | While you use Ula, and up to 24 months after your last message | Deleted |
| After a deletion request | Removed within 30 days | Deleted from backups on their normal cycle |
| Booking records | As long as tax and consumer law requires | Deleted |
| Waitlist check-in details | Until you ask us to remove them, and at most 12 months after you check in | Deleted |
| Support emails | Up to 3 years after the conversation ends | Deleted |
| Website server logs | A short security window, normally up to 30 days | Deleted |
| Website analytics | At most 14 months | Deleted or kept only in aggregate |
10How we protect it
In shortEncryption in transit, strict access, and secrets kept out of logs, analytics and anything Ula reads.
- Data travels over encrypted connections (HTTPS and TLS).
- Only people who need access to help you or run the service have it.
- Passwords, payment credentials and secret keys are never placed in what Ula reads, in logs or in analytics.
- We review our providers before we work with them.
No system is perfectly secure. If a breach affects your data and puts your rights at risk, we will tell you and the relevant authority as the law requires.
11Your rights and choices
In shortYou can see, correct, delete or take a copy of your data at any time. We reply within one month.
- Access: ask for a copy of the data we hold about you.
- Correction: ask us to fix anything inaccurate or incomplete.
- Deletion: ask us to erase your data.
- Portability: receive your data in a common, machine-readable format.
- Objection and restriction: object to processing based on legitimate interest, or ask us to pause it.
- Withdraw consent: where we rely on consent, withdraw it at any time for the future.
To use any of these rights, write to hello@heyula.ai. We may ask you to confirm your identity, for example from the WhatsApp number you use with Ula. We reply within one month, and we never charge for a reasonable request.
If you live in California or another US state with a privacy law, you have similar rights to know, correct and delete your data. We do not sell personal information or share it for cross-context behavioural advertising.
If you are not happy with how we handle your data, please tell us first so we can put it right. You can also complain to the data protection authority where you live or work.
13Children
In shortUla is for adults. Children do not use Ula directly.
Ula is meant for people aged 18 and over. We do not knowingly collect data from children as users. Details about a child that a parent or guardian shares to plan a trip are part of that adult's Travel DNA and can be deleted at any time.
14Facebook and Instagram data deletion
In shortIf you connected to us through Facebook or Instagram, you can ask us to delete that data.
Email hello@heyula.ai, or use our Contact page. You can also remove our app under Facebook Apps and Websites. Meta then sends us a signed deletion request, and you receive a confirmation code with a status page at heyula.ai/deletion. We do not keep Facebook login profiles for Ula.
15Changes to this policy
In shortIf something important changes, we tell you before it takes effect.
We update this policy when the service or the law changes. The version and date at the top always show the current one. If a change materially affects how we use your data, we will let you know in the chat or on our website before it applies.
16Contact us
In shortQuestions about your privacy? Write to hello@heyula.ai.
For any question about this policy or your data, write to hello@heyula.ai or use our Contact page. A person from the Hey Ula team will reply.