Privacy Policy

SECTION 2 — DATA MINIMIZATION, SEGREGATION ARCHITECTURE & THE STRIPE WALL

2.1 Data Minimization Principle

Traveloop operates under a strict data minimization architecture: we collect, process, and retain only the personal data that is strictly necessary for the specific, explicit, and legitimate purposes described in this Policy. We do not collect personal data in anticipation of future needs that are not clearly defined at the time of collection.

2.2 Traveloop's Data Perimeter (Supabase Layer)

Traveloop stores and processes the following categories of personal data within its own controlled infrastructure, hosted on Supabase Inc. servers located within the European Union (Frankfurt, Germany — EU-Central region):

• Full Name: Used for account identification, listing attribution, and review display purposes.
• Email Address: Used as the primary account identifier, for transactional notification delivery (escrow confirmations, dispute triggers, system alerts), and for support communications.
• Phone Number (hashed/tokenized post-verification): Collected at registration solely for Multi-Factor Authentication (MFA) via SMS One-Time Password (OTP). Post-verification, the raw phone number is hashed and not stored in plaintext in Traveloop's operational databases.
• Profile Status & Trust Score: Computed metadata reflecting account verification level, dispute history, review aggregates, and platform tenure, used for marketplace trust and safety operations.
• Chat Metadata & Message Content: Timestamps, sender/recipient User IDs, and message content transmitted through the Platform's Chat System, retained for dispute resolution, law enforcement cooperation, and platform safety operations.
• Listing Data: Hotel name, location, dates, price, room type, and other listing attributes submitted by Sellers.
• Uploaded Validation Documents (PDFs/Images): Hotel confirmation vouchers, booking receipts, and name-change confirmations uploaded by Users for listing verification and dispute evidence purposes.
• Transaction Metadata: Records of transactions initiated, including timestamps, amounts, statuses, and escrow release events (excluding raw payment card data).
• IP Address & Device Metadata: Network IP coordinates and device fingerprinting data collected at login and transaction initiation for fraud detection, rate-limiting, and security operations.
• Support Ticket Content: Content of support requests submitted by Users through the Platform's ticketing system.

2.3 The Stripe Wall — Segregation of Sensitive Financial & Governmental Data

Traveloop has implemented a strict architectural segregation — informally referred to as the "Stripe Wall" — to ensure that highly sensitive financial and governmental identity data is never collected, stored, processed, transmitted through, or accessible by Traveloop's own servers or databases. The following categories of data are processed exclusively by Stripe:

• Government-issued identity documents: passports, national identity cards, driver's licenses, and equivalent documents collected for KYC compliance.
• Bank account details: IBANs, SWIFT/BIC codes, bank routing numbers, and account numbers collected for Seller payout configuration.
• Payment card data: Primary Account Numbers (PANs), card verification values (CVVs), expiry dates, and cardholder data collected for Buyer payment processing.
• Tax identification numbers: VAT numbers, social security numbers, and equivalent governmental tax identifiers collected for AML and DAC7 compliance.
• AML/PEP screening results and associated compliance records.

All such data is subject exclusively to Stripe's Privacy Policy, available at https://stripe.com/en-gr/privacy. Traveloop has no technical or administrative access to any data described in this Section 2.3.

SECTION 6 — DAC7 REGULATORY REPORTING — MANDATORY TAX DISCLOSURE CONSENT

6.1 DAC7 Directive Overview

Council Directive (EU) 2021/514 (the "DAC7 Directive"), transposed into Greek law via Law 5057/2023, imposes mandatory reporting obligations on Platform Operators. Traveloop qualifies as a Platform Operator subject to DAC7 reporting obligations.

6.2 Mandatory Reporting Obligations

Traveloop and/or Stripe are legally mandated to collect, process, and report Seller identification data, transaction volume, number of transactions, platform fees, and taxes withheld to the Greek tax authority (ΑΑΔΕ) and other EU Member States where applicable.

6.3 Reporting Thresholds

Reporting is triggered for each Seller who completes thirty (30) or more relevant transactions or receives total consideration exceeding two thousand Euros (€2,000) in a calendar year.

6.4 DAC7 Legal Basis

The processing is conducted on the legal basis of compliance with a legal obligation (Article 6(1)(c) GDPR). This basis does not require additional consent and cannot be objected to under Article 21 GDPR.