PaxFlow Privacy Policy
PaxFlow ehf.
Version 2.0
Effective Date: 11 October 2026
1. Introduction
PaxFlow ehf. ("PaxFlow", "we", "us" or "our") respects your privacy and is committed to protecting personal data.
This Privacy Policy explains how we collect, use, disclose, retain and protect personal data when you visit our websites, communicate with us, or use our software and related services (the "Services").
PaxFlow provides software for tour and activity operators, including tools for bookings, departures, resources, employees, communications, guest information and other operational activities.
Our role depends on the circumstances:
- As a data controller, PaxFlow determines the purposes and means of processing personal data relating to website visitors, business contacts, account administration, billing, security and certain service usage activities.
- As a data processor, PaxFlow processes personal data on behalf of customers using our Services. Our customers determine what personal data they collect and how they use it.
Where PaxFlow acts as a processor, processing is governed by our Data Processing Agreement (DPA) and the applicable customer agreement. This Privacy Policy primarily describes processing for which PaxFlow is the controller.
2. Who is responsible for your personal data?
PaxFlow ehf.
Borgartún 27
105 Reykjavík, Iceland
Email: info@paxflow.io
For personal data collected and managed by a tour or activity operator using PaxFlow, that operator is generally the controller. If you are a traveller, employee, guide, contractor or other individual whose information is managed by a PaxFlow customer, you should normally contact that customer to exercise your privacy rights concerning that information. PaxFlow assists its customers as required by the DPA and applicable law.
3. Personal data we collect
3.1 Information you provide directly
We may collect information when you register for an account, request a demonstration or quotation, contact sales or support, subscribe to the Services, manage billing, register for an event, subscribe to communications or apply for employment.
This may include your name, business email address, telephone number, company name, job title, billing information, account credentials and communications with us. Payment card transactions may be handled by third-party payment service providers; PaxFlow does not need to store complete payment card details to administer subscriptions.
3.2 Information collected automatically
When you visit our websites or use the Services, we may collect IP addresses, device and browser information, operating system, language preferences, login and authentication activity, features accessed, actions performed, error reports, diagnostic information, performance data, and cookies or similar identifiers where applicable.
We use this information to operate, secure, support, analyse and improve our websites and Services. Where usage information identifies an individual, we treat it as personal data. Aggregated or effectively anonymised information that no longer identifies an individual is not personal data.
3.3 Information from third parties
We may receive relevant information from authentication providers, payment processors, booking-system integrations, event organisers and other business service providers, depending on the services involved and applicable permissions.
4. Personal data processed on behalf of customers
Our customers use PaxFlow to manage operational activities. Depending on their configuration and use of the Services, we may process information about travellers, passengers, booking contacts, employees, guides, drivers, contractors, suppliers, partners and other operational contacts ("Customer Personal Data", as defined in our Data Processing Agreement).
This may include names, contact details, booking and travel information, pickup locations, passenger requirements, communications, forms, waivers, staff availability, qualifications, schedules, assignments and other information submitted by customers or collected through the Services.
Customers determine what information they collect and why. PaxFlow does not prescribe the contents of customer forms or determine whether particular information is necessary for a customer’s operations.
Customers may collect sensitive information, such as accessibility requirements, medical information, dietary requirements or information revealing special categories of personal data. The customer is responsible for establishing an appropriate legal basis, including any applicable conditions under Article 9 GDPR. PaxFlow processes this information on the customer’s documented instructions under the DPA.
5. How and why we use personal data
When PaxFlow acts as controller, we process personal data for the following purposes and legal bases, as applicable:
| Purpose | Legal basis |
|---|---|
| Creating and administering accounts and providing contracted Services | Performance of a contract or legitimate interests, as applicable |
| Managing subscriptions, payments and customer relationships | Performance of a contract, legitimate interests and legal obligations |
| Responding to enquiries and providing support | Legitimate interests or performance of a contract |
| Maintaining security, detecting misuse and investigating incidents | Legitimate interests and legal obligations |
| Monitoring performance, troubleshooting and improving functionality | Legitimate interests |
| Sending service announcements and important account communications | Performance of a contract or legitimate interests |
| Sending marketing communications | Consent or legitimate interests, where permitted by law |
| Maintaining financial and business records | Legal obligations |
| Establishing, exercising or defending legal claims | Legitimate interests |
Where we rely on legitimate interests, we consider the impact on individuals and their rights. Where processing is based on consent, you may withdraw it at any time without affecting earlier lawful processing.
6. Cookies and website analytics
Our websites may use cookies and similar technologies to maintain essential functionality, remember preferences, understand usage and measure communications effectiveness. Where required by law, we obtain consent before using non-essential cookies or tracking technologies.
You can manage applicable preferences through our website controls or your browser settings.
7. Sharing personal data
We may disclose personal data to trusted providers supporting cloud hosting, infrastructure, authentication, payment processing, invoicing, support, communications, email, SMS, messaging, analytics, monitoring and AI-related services where applicable.
We require service providers to protect personal data and process it for authorised purposes subject to contractual and legal obligations. Where PaxFlow is a processor, the engagement of subprocessors is governed by the DPA, and relevant information is made available to customers in accordance with the DPA.
We may disclose data to comply with law, respond to lawful requests, protect rights and security, or in connection with a business restructuring, merger or acquisition. We do not sell personal data to third parties.
8. Integrations and connected services
PaxFlow integrates with booking systems and other third-party services selected or authorised by customers. Integrations may exchange booking information, passenger details and operational data needed for requested functionality. Customers are responsible for selecting and authorising integrations and ensuring that personal-data exchanges are lawful. Third-party services may have their own privacy policies and terms.
8.1 Google API Services
PaxFlow’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. See our Google Limited Use Disclosure for details on how PaxFlow uses Google user data.
9. Artificial intelligence and automated functionality
PaxFlow offers AI-powered features that may assist customers with operational planning, customer communications, information retrieval and other tasks. Depending on the feature, AI functionality may process information from the customer’s PaxFlow environment to generate recommendations, draft responses, identify operational issues or perform authorised actions.
Access remains subject to the permissions and functionality available to the relevant user or service. Where AI features process Customer Personal Data, PaxFlow acts as processor under the DPA and customer instructions.
PaxFlow does not use Customer Personal Data to train general-purpose AI models or models shared with other customers. We may use aggregated or anonymised data, from which no individual can be identified, to build statistical and forecasting features that improve the Services.
AI-assisted recommendations and operational actions do not necessarily constitute automated decision-making under Article 22 GDPR. Customers using automated functionality to make decisions affecting individuals are responsible for determining applicable legal requirements and safeguards. PaxFlow does not currently intend its own controller-side processing to make solely automated decisions producing legal or similarly significant effects for individuals.
10. Connections to external AI assistants
Customers and authorised users may connect compatible external AI assistants, including ChatGPT by OpenAI and Claude by Anthropic, to PaxFlow through the Model Context Protocol (MCP) at https://mcp.paxflow.io/mcp. Nothing is shared with an assistant until a user connects it. Users connect by signing in with their PaxFlow account through our authentication provider, Auth0 (EU region), or with a personal API key created in PaxAdmin. The assistant never receives the user’s PaxFlow password. Setup steps are in our help center.
10.1 Access and permissions
A connected assistant has the same access as the connecting user in PaxAdmin, and no more. It can reach only the PaxFlow companies the user is a member of and the functions the user’s role allows. Depending on the request, it may retrieve booking, passenger (including names and contact details), departure, product, resource, staff, scheduling and messaging information.
The assistant can change records or send communications only when the user has granted write access and the user’s role allows the action. Before an email, SMS or WhatsApp message is sent, the assistant first receives a preview of the message and its recipients; the message is sent only on a second, confirmed request.
10.2 Information processed by PaxFlow
For each request, PaxFlow receives the name of the tool the assistant calls and its inputs, such as a date, a search term or the text of a message to send. PaxFlow does not receive the user’s conversation with the assistant.
PaxFlow keeps:
- An audit log entry for each request: who made it, when, which tool ran, whether it succeeded and which records it changed. Tool inputs are not logged. Company administrators can view the log. Entries are deleted after 12 months.
- A record of each connection and API key, including when it was last used and, for API keys, the last IP address. API keys are stored only as a hash.
Access tokens expire after 24 hours. Refresh tokens expire after 30 days, or after 15 days without use. API keys expire after at most 365 days. Tokens and keys work only with PaxFlow’s MCP server and stop working when revoked.
PaxFlow processes personal data in these requests as processor under the DPA. It keeps the audit log and connection records to provide the service, for security, and so the customer can see what was done in its name.
10.3 External AI providers
PaxFlow sends the assistant only the data needed to answer the user’s request. Once received, the assistant’s provider processes that data under its own agreement and privacy terms, including its rules on retention and model training (for example, Anthropic and OpenAI). The customer chooses which assistant to connect; that provider is engaged by the customer and is not a PaxFlow subprocessor. Customers and users should review the provider’s terms before connecting an assistant, particularly where personal data may be disclosed. PaxFlow does not sell data from these connections or use it to train AI models, other than in aggregated and anonymised form as described in section 9.
10.4 Disconnecting
Users can remove PaxFlow in the assistant’s settings, or revoke a personal API key on their profile page in PaxAdmin. A revoked key stops working immediately. To ask us to remove a connection or its log entries, email info@paxflow.io.
11. International transfers
PaxFlow hosts the Services on Google Cloud in Belgium (europe-west1). Some of our providers may process personal data in other countries. Where personal data is transferred outside the European Economic Area, we ensure an appropriate transfer mechanism is in place where required by law. This may include adequacy decisions, the European Commission’s Standard Contractual Clauses or other legally recognised safeguards, with supplementary measures where necessary.
Customers may also choose to connect third-party services or external AI providers processing information outside the EEA, subject to their separate arrangements and terms.
12. Data retention
We retain personal data only for as long as necessary for its purpose, subject to applicable legal requirements. Retention varies by category:
- Account information: While needed to administer an account and for up to six (6) months after the account closes, unless a longer period is required by law.
- Billing and financial records: For periods required by applicable accounting and tax laws.
- Sales, marketing and business communications: While relevant to the relationship or purpose, subject to consent, objection and deletion rights.
- Security and technical logs: For periods appropriate to operational, security and compliance purposes.
- Customer Personal Data: In accordance with the customer agreement and DPA, including procedures following termination.
Information may remain in backups for a limited period under established retention procedures and safeguards. We may retain information where necessary to comply with law or establish, exercise or defend legal claims.
13. Data security
We maintain appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These include access controls, authentication, encryption where appropriate, monitoring, backups and internal security practices.
Access is limited to authorised personnel and providers with legitimate business needs and confidentiality obligations. We maintain incident-response procedures, including notifications where legally or contractually required.
14. Your privacy rights
Subject to applicable law, you may have the right to access, rectify or erase your personal data; restrict or object to processing; receive certain data in portable form; withdraw consent; and object to direct marketing.
To exercise rights concerning data for which PaxFlow is controller, email info@paxflow.io. We respond within applicable legal periods, generally one month, subject to permitted extensions.
For data managed by a tour or activity operator using PaxFlow, please contact that operator directly. PaxFlow assists the operator under the DPA.
15. Complaints
If you have concerns about PaxFlow’s processing of personal data, contact us so we can review them. You also have the right to complain to a competent supervisory authority. PaxFlow’s supervisory authority in Iceland is Persónuvernd (Icelandic Data Protection Authority), www.personuvernd.is, email postur@personuvernd.is.
16. Changes to this Privacy Policy
We may update this policy to reflect changes in our Services, practices, legal requirements or processing activities. The current version will be published on our website with its effective date. Where changes materially affect personal-data processing, we will provide additional notice where required or appropriate.
17. Contact
PaxFlow ehf.
Borgartún 27
105 Reykjavík, Iceland
Email: info@paxflow.io
Website: paxflow.io
