Last updated August 2026
Papyrah never stores travellers' names. A traveller's name is used for the seconds it takes to write their document, and is then gone — it lives only in the PDF your agency receives.
For each design we keep only trip metadata: destination city and country, number of nights, travel month, page count, and what it cost. Plus your agency account: your name, email, branding and staff list.
Your agency owns its branding, its client relationships and every document generated. Papyrah owns the software and templates. In data-protection terms your agency is the controller and Papyrah is the processor; a data processing agreement is available on request.
Generated PDFs are deleted after 90 days. Usage and billing records are kept for accounting. On account closure we export your data on request and delete everything within 30 days.
We use Anthropic's API to write itineraries, a cloud host to run the service, and Wikimedia Commons for freely-licensed photographs. Under Anthropic's commercial terms, content sent through their API is not used to train their models.
We may publish anonymised, aggregated demand trends (for example, "agencies in country A are designing more trips to country B"). This never contains traveller names, never identifies your agency, and is only reported where enough agencies contribute. You can opt out in your settings at any time.
Questions or deletion requests: hello@papyrah.com
This is a plain-language starting point, not legal advice. Have a lawyer review it before launch.