Introduction
FitcationHQ (“FitcationHQ”, “we”, “us” or “our”), operated by GW TRAVEL LIMITED, is committed to protecting your privacy. This policy explains what personal information we collect, how we use and share it, and your rights, when you use our website, our trip-builder tool and browser extension, and our itinerary-planning service (together, the “Services”).
We handle personal information in accordance with the New Zealand Privacy Act 2020 and its Information Privacy Principles. By using the Services you agree to this policy. If you do not agree, please do not use the Services.
This policy does not cover third-party websites or services linked from ours; please review their own privacy policies.
A note on the browser extension
FitcationHQ offers two separate browser extensions, and they handle data differently:
The FitcationHQ Trip Builder:
We know browser extensions raise specific privacy questions, so we want to be clear up front:
- The extension captures only the place name you explicitly highlight and choose to add to a trip, plus the URL of the page you add it from.
- It does not read, monitor, record, or transmit your general browsing history, the content of pages you do not act on, your keystrokes, passwords, or activity on other sites.
- It runs its on-page features only when you invoke them (via the right-click menu or the toolbar button), using minimal browser permissions (
activeTab,scripting,contextMenus,storage). - It communicates only with FitcationHQ’s own service. Authentication tokens are stored locally in your browser; your website password is never entered into or stored by the extension.
The FitcationHQ Travel Toolkit:
Is a fully offline reference tool (passport validity, plug and voltage, tipping etiquette, and jet-lag planning). It requests only the storage permission, which it uses to remember your last inputs — such as your selected destination and travel dates — locally on your own device. It does not collect, transmit, or share any data, does not communicate with any server, and contains no remote code. Nothing you enter ever leaves your device.
We do not sell your personal information, and we do not use the extension for advertising or cross-site tracking.
What information we collect
Information you give us
- Account information — your name, email address, and login details when you register (handled through our account system).
- Itinerary-planning enquiries — the details you submit when you request a custom itinerary, such as destinations, dates, travel preferences, budget, and any other information you choose to share. Where you ask us to assist with a booking, this may include further details needed for that booking (for example traveller names or passport details). We collect this only when needed for a booking you have asked us to arrange.
- Trip-builder content — the places you save (the text you highlight and the source page URL), names, notes, categories, trip titles, and trip settings such as effort level and trip length.
- Communications — messages, feedback, and newsletter sign-ups.
Information collected automatically
- Usage and device data — IP address, browser and device type, and general usage of our website and tool, collected through cookies and similar technologies and standard logs, to keep the Services working, secure, and improving.
- Generation and credit records — records of itineraries you generate, credits purchased and used, and related transaction history.
Payment information
- Credit purchases and planning-service payments are processed by third-party payment providers (such as Stripe via WooCommerce, and PayPal where offered). They collect your payment details directly. We do not store your full card number. We receive confirmation of payment and limited order details (such as amount, date, and credits granted).
How we use your information
We use your personal information to:
- provide the Services — create and manage your account, save your places, generate itineraries, prepare your custom plan, and (where agreed) assist with bookings;
- process payments and maintain your credit balance and transaction history;
- geocode and map the places you save, and find verified nearby suggestions for your itinerary;
- communicate with you — confirmations, service updates, responses to enquiries, and, if you opt in, newsletters (you can unsubscribe at any time);
- improve, secure and troubleshoot the Services; and
- meet our legal obligations and protect our legal rights, prevent fraud or misuse, and enforce our terms.
We rely on your consent (for example, for marketing emails), the performance of our agreement with you (to deliver the Services you request), and our legitimate interests (to run, secure and improve the Services) as the bases for using your information. You can withdraw consent for marketing at any time.
How we share your information
We share personal information only as needed to run the Services, with:
- AI generation providers — when you run an itinerary generation, the relevant trip details (such as your saved places and trip settings) are sent to third-party AI providers (currently Anthropic (Claude) for itinerary synthesis, and Google (Gemini) for free-time enrichment) to produce your draft itinerary. This data is sent to generate your result; it is not used by us to build advertising profiles.
- Mapping and location providers — Google Maps Platform / Google Places to resolve and map the places you save and to find verified nearby suggestions.
- Payment providers — Stripe (via WooCommerce) and PayPal, to process payments.
- Hosting and infrastructure providers — our website host and the server that runs our generation workflow (currently a hosted virtual server), which process data on our behalf to operate the Services.
- Professional advisers, authorities, and successors — where reasonably necessary to comply with the law, respond to lawful requests, protect our rights or users’ safety, or in connection with a sale or restructure of our business.
We do not sell your personal information, and we do not share it with advertisers for their own marketing. We may share aggregated or de-identified information that cannot reasonably identify you.
Some of these providers are located outside New Zealand, which means your information may be stored or processed overseas. Where we transfer personal information offshore, we take reasonable steps to ensure it is protected by comparable safeguards, consistent with the Privacy Act 2020.
Cookies
We use cookies and similar technologies to keep you logged in, remember your preferences, keep the Services secure, and understand how the Services are used. You can control cookies through your browser settings, though some features may not work without them.
How we protect and retain your information
We take reasonable technical and organisational measures to protect personal information from loss, misuse, and unauthorised access, including access controls and encryption in transit. No system is completely secure, so we cannot guarantee absolute security, and you are responsible for keeping your account credentials safe.
We keep personal information only for as long as needed for the purposes described above or as required by law (for example, tax and transaction records), after which we securely delete or de-identify it.
Your rights
Under the New Zealand Privacy Act 2020 you have the right to:
- access the personal information we hold about you, and
- request correction of information that is inaccurate.
You can also ask us to delete information where we are not required to keep it, unsubscribe from marketing, and disconnect or remove the browser extension at any time (which stops further capture and clears its locally stored tokens). To exercise any of these, contact us at admin@fitcationhq.com. We may need to verify your identity before responding.
If you are not satisfied with how we handle your information or a privacy request, you can complain to us first, and then to the Office of the Privacy Commissioner (www.privacy.org.nz).
Children
The Services are not directed at children under 18, and we do not knowingly collect their personal information. If you believe a child has provided us information, contact us and we will delete it.
Changes to this policy
We may update this policy from time to time. The current version is always posted on our website with the “Last updated” date above. Where changes are material, we will take reasonable steps to notify you.
Contact us
For any privacy question or request, contact us at admin@fitcationhq.com.