Legal
Privacy policy
Last updated 1 November 2026
This policy explains what personal data Visit Pass handles, why, who it is shared with and the choices you have. Visit Pass is operated by Rethink Labs LLC(“we”, “us”). It covers the Visit Pass app in ChatGPT, the Visit Pass concierge on WhatsApp, bookings made through Visit Pass, and this website.
1. Who is responsible
For the Visit Pass app, the trip summary and this website, Rethink Labs LLCis the controller. Each WhatsApp concierge is run on behalf of a partner, such as a tourism board, hotel or holiday-home manager. For your conversation with a partner's concierge and for a booking with a property, that partner is also a controller of your data and its own privacy notice applies as well. We process that data on the partner's behalf.
Contact us about privacy at support@visitpass.si.
2. What we collect and why
| When | Data | Purpose | Legal basis |
|---|---|---|---|
| You plan a trip with Visit Pass in ChatGPT | The trip details ChatGPT passes to Visit Pass: destination, travel dates, party size, interests and, if you give it, a first name. Never your phone number, email or payment details. | To draft your plan and create your visit code | Your request (performance of a service you ask for) |
| You send your visit code on WhatsApp | Your WhatsApp phone number and profile name, the messages you send and the replies you receive | To link the code to you, welcome you and answer your questions about the trip | Your consent, given by sending the code |
| You book a stay or activity | The booking (dates, guests, room or home, price) and the name and email you enter on the payment page. Card details go to the payment provider, never to us. | To make and confirm the booking with the property | Performance of a contract |
| You receive a complimentary activity voucher | The voucher, its validity dates and whether it has been used | To issue the voucher and let the venue accept it once | Performance of a service you ask for |
| You use the info form on this website | Name, work email, organisation, type of organisation, location and your message | To answer your enquiry | Your consent and our legitimate interest in replying to enquiries |
| You visit this website | Technical data in server logs, such as IP address, browser and pages requested | To run, secure and fix the website | Our legitimate interest in a secure, working site |
This website sets no advertising or analytics cookies. We do not sell personal data and do not use it for advertising.
3. AI-generated replies
Concierge replies are generated by AI models, using the partner's own information about the destination or property. Your messages are sent to the model provider to produce a reply. We do not use your messages to train AI models, and we use providers whose terms do not allow them to train on this data.
4. Who we share data with
- The partner whose concierge you message or whose property you book, so they can serve you.
- Service providers who process data for us under contract: WhatsApp (Meta) and our messaging provider for delivering messages; AI model providers for generating replies; the payment provider for checkout; our cloud hosting and database providers; Vercel for hosting this website; and Slack for delivering info-form enquiries to our team.
- OpenAI, when you use Visit Pass inside ChatGPT. Your use of ChatGPT is covered by OpenAI's own privacy policy.
- Authorities, when the law requires it.
5. International transfers
Some providers are based outside the European Economic Area, including in the United States. Where data leaves the EEA, we rely on safeguards recognised under the GDPR, such as the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.
6. How long we keep data
- The trip summary behind a visit code is deleted three days after your departure date.
- A visit code that is never sent expires and its trip summary is deleted.
- WhatsApp conversations are kept while the partner's concierge service needs them, and then deleted. You can ask for earlier deletion at any time.
- Booking records are kept as long as accounting and tax law requires.
- Info-form enquiries are kept for up to two years after our last contact with you.
7. Your rights
Under the GDPR you can ask us for access to your data, to correct it, to delete it, to restrict or object to its use, and for a copy in a portable format. Where we rely on consent, you can withdraw it at any time: reply STOP on WhatsApp to stop messages. To use any right, write to support@visitpass.si, with your visit code if you have one. We answer within one month.
You can also complain to a data protection authority. In Slovenia this is the Information Commissioner (Informacijski pooblaščenec).
8. Security
Data is encrypted in transit. Visit codes are random and bind to the first WhatsApp number that sends them, so a forwarded code reveals none of your details. Access to personal data is limited to people who need it to run the service.
9. Children
Visit Pass is not directed at children under 16, and we do not knowingly collect their data.
10. Changes
We will post any change to this policy on this page and update the date above. For a significant change, we will say so on the home page.
See also our terms of service.