Privacy Policy

1. Scope

This Privacy Policy describes how Miso Intelligence (“Miso,” “we,” “us,” or “our”) collects, uses, and shares personal information. It applies to our mobile application, our websites, and our messaging-based concierge service, including conversations conducted through Apple Messages for Business (together, the “Service”).

This Policy replaces all prior Miso privacy policies, including any policy published for text messaging.

Miso Intelligence is the controller of the personal information described in this Policy.

2. Information We Collect

Account information

Your name, email address, phone number, and account credentials.

Traveler profile information

Information about you and about any traveler you add to your account, including legal name, date of birth, sex as designated on the traveler’s identification, passport number and expiration date, Known Traveler Number, redress number, nationality, frequent flyer and loyalty program numbers and balances, credit card points balances, seat and cabin preferences, meal preferences, and travel history.

Payment information

Payment card details, which are tokenized and encrypted by our payment security providers and stored only in that protected form. Miso personnel do not have access to full card numbers.

Conversation content

The messages you exchange with Miso, including requests, responses, attachments, and the surrounding context of the conversation.

Connected account information

If you connect an email, calendar, or loyalty account, the information we access from it, such as booking confirmations, itineraries, calendar entries relating to travel, and loyalty balances.

Device and usage information

IP address, device identifiers, application version, and information about how you interact with the Service.

3. How We Use Information

We use personal information to:

• arrange, purchase, modify, and service travel on your behalf;
• complete airline check-in and provide the traveler information airlines and governments require;
• apply loyalty benefits, points, and certificates to your travel;
• communicate with you about your travel and respond to your requests;
• process payments and our own subscription fees;
• maintain the security of the Service and detect and prevent fraud;
• improve the Service; and
• comply with legal obligations.

4. Artificial Intelligence

The Service uses artificial intelligence to interpret your requests, evaluate travel options, and carry out the tasks you authorize. To do this, we use third-party AI model providers.

Information provided to AI providers. Conversation content, together with the traveler profile and itinerary information needed to carry out your requests, is processed by our AI providers for the purpose of delivering the Service.

Information not provided to AI providers. Payment card details are tokenized and encrypted and are not provided to our AI providers.

Training. We require our AI providers not to use your information to train their models.

Human involvement. Miso travel specialists review and participate in the Service. You may ask at any time for a human specialist to handle your request.

5. How We Share Information

Travel providers

We provide airlines, hotels, and other travel providers with the information they require to make and service a reservation, including traveler names, dates of birth, passport and travel document information, Known Traveler Numbers, redress numbers, loyalty numbers, and payment credentials. Airlines are required to transmit certain of this information to government authorities, including the United States Transportation Security Administration and, for international travel, border authorities.

Service providers

We share personal information with service providers that help us operate the Service. Each is bound by a written agreement that limits its use of personal information to providing services to Miso and requires it to protect that information consistently with this Policy. They include:

• AI model providers, which process conversation content and traveler information to carry out your requests, as described in Section 4;
• payment processing and security providers, which tokenize and encrypt payment card details;
• hosting, database, and authentication providers;
• messaging platforms through which you communicate with us; and
• providers of analytics, error monitoring, and customer support tools.

A list of our current service providers is available on request at legal@miso.com.

Legal and safety

We may disclose personal information where required by law, subpoena, or court order, or where necessary to protect the rights, property, or safety of Miso, our users, or others.

Business transfers

If Miso is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction.

We do not sell personal information

Miso does not sell personal information and does not share personal information for cross-context behavioral advertising.

6. Legal Bases for Processing

Where the General Data Protection Regulation or the UK GDPR applies, we rely on the following legal bases:

• Performance of a contract, for arranging, purchasing, and servicing travel, completing check-in, and processing payments.
• Consent, for connecting an email, calendar, or loyalty account, and for marketing communications. You may withdraw consent at any time.
• Legitimate interests, for security, fraud prevention, and improving the Service, where those interests are not overridden by your rights.
• Legal obligation, where we are required to retain or disclose information by law.

7. Retention

We retain personal information for as long as needed for the purposes described in this Policy, and then for the following periods:

• Account and traveler profile information: for the life of the account and 30 days afterward.
• Travel document information, including passport numbers and Known Traveler Numbers: for the life of the account, or until you remove it, and 30 days afterward.
• Booking and transaction records: 7 years, to meet tax, accounting, and dispute resolution requirements.
• Conversation content: 24 months.
• Payment tokens: until you remove the payment method or close your account.

Where we are required to retain information for longer by law, we retain it for the required period and then delete it.

8. Your Rights and Choices

Depending on where you live, you may have the right to:

• access the personal information we hold about you and obtain a copy;
• correct inaccurate information;
• delete your personal information;
• restrict or object to certain processing;
• receive your information in a portable format;
• withdraw consent where processing is based on consent; and
• lodge a complaint with your data protection authority.

You can review and update traveler profile information, manage connected accounts, and initiate deletion of your account from within the Miso application. You may also contact us at legal@miso.com. We respond within the time required by applicable law, and within one month where the GDPR applies.

Some information must be retained after a deletion request, including booking and payment records we are required to keep. Where that applies, we will tell you what was retained and why, and we will delete it at the end of the applicable retention period.

9. International Transfers

Miso is based in the United States and personal information is processed there. Where we transfer personal information from the European Economic Area or the United Kingdom, we rely on the European Commission’s Standard Contractual Clauses, together with the UK International Data Transfer Addendum where applicable. You may request a copy of the relevant transfer mechanism by writing to legal@miso.com.

Travel providers to whom we transmit your information may be located anywhere in the world, and the transmission of passenger information to government authorities is required by the laws of the countries you travel to and from.

10. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including tokenization and encryption of payment card details and access controls on traveler profile information. No method of transmission or storage is completely secure.

11. Children

The Service is not directed to children under 13 and we do not knowingly collect personal information from them. Travel may be arranged for child travelers by an adult account holder, in which case the adult is responsible for the information provided about that child.

12. California Residents

California residents have the rights described in Section 8, including the right to know, the right to delete, the right to correct, and the right not to be discriminated against for exercising those rights. The categories of personal information we collect, the purposes for which we use them, and the categories of recipients are described in Sections 2, 3, and 5. Government identifiers and payment information are treated as sensitive personal information; we use them only to provide the Service and do not use them to infer characteristics about you.

13. Changes to This Policy

We may update this Policy. We will post the updated Policy with a new Effective Date, and where a change materially affects how we use your personal information we will provide notice through the Service.

14. Contact

Miso Intelligence
legal@miso.com
54 W 21st St, Suite 607
New York, NY 10010