Understand the controls and responsibilities
TravelSpy provides workspace-scoped event and outcome interfaces. Before implementation, confirm the applicable security documentation, data-processing terms and service commitments for your workspace. This page is not a certification or legal-compliance claim.
Workspace authorization
Collector requests require a registered website origin or server bearer token and an enabled workspace. Server credentials must remain server-side.
Consent-aware sessions
Creating a personalisation session requires explicit analytics and personalisation consent. Customers must configure collection in line with their own obligations.
Retention and deletion
Collector data is subject to configured retention. The device forget endpoint can remove collected subject data; customers must also assess their own connected systems.
Server-authenticated outcomes
Verified booking outcomes are submitted from an authenticated customer backend. Cancellations and refunds require server authentication.
Identity under customer control
Identity assertions use identifiers supplied through the customer’s configured integration; automatic cross-device identity is not provided by default.
Third-party data
Signal types in the catalogue are not a promise of connected providers. Each provider, licence and data-processing arrangement must be confirmed.
Confirm assurance before procurement
Do not assume a certification, audit report, encryption standard, data residency option, uptime SLA or regulatory certification from this marketing site. Ask TravelSpy for current, scope-specific evidence and confirm it with your security, privacy and legal teams.
Security issue reporting
If you believe you have found a security issue, contact us through the contact form. Do not include real traveller or customer data in an initial report.
Review integration requirements
Discuss workspace access, security documentation and the data-processing requirements for your intended integration.