Sustainable Travel International Privacy Policy
Updated October 2026
Sustainability International, Inc., doing business as “Sustainable Travel International” (“Sustainable Travel International,” “we,” “us,” or “our”), respect your privacy. This Privacy Policy explains what information we collect, how we use and share it, and the choices and rights you have.
This Policy applies to sustainabletravel.org and to our tools, platforms, applications, and programming interfaces (APIs), including our AI-powered carbon-measurement tools (such as Humi) and any successor or new tools we may launch (together, the “Services”). We describe practices at the level of the Services generally rather than tool-by-tool, so that this Policy continues to apply as our tools evolve.
Our Role: Controller and Processor
Our Responsibilities Depend on How the Information Reaches Us
Where we act as a controller
For our website, marketing and newsletters, memberships, offset purchases, event registrations, account administration, and general business operations, Sustainable Travel International decides how and why personal information is processed.
Where we act as a processor (service provider)
When a business customer uses our tools to measure the footprint of a trip, event, or portfolio, that customer submits content — for example, an itinerary — that may contain other people’s personal information (such as travelers). For that submitted content, the customer is the controller and Sustainable Travel International acts as a processor on the customer’s behalf, processing it only to provide and improve the Services and following the customer’s instructions.
Business customers who require a Data Processing Addendum (DPA) can request one at [email protected].
If you are a traveler whose information appears inside a business customer’s submitted content and you wish to exercise privacy rights, please contact that business customer (the controller); we will assist them as required.
What Information We Collect
Information you provide to us
Name, phone number, email, billing and mailing addresses, payment information, organizational affiliation, survey and form responses, and social-media profile information when you choose to share it.
Account information
When you create an account for our tools, we collect your email address and may collect your name, company, and a password (stored only in hashed form). Accounts may be individual or organizational, and may include multiple users.
Submitted content
When you use our measurement tools, you may submit content for processing — for example, a webpage link (URL) to an itinerary, an uploaded PDF or document, or trip details you enter (such as operator name, group size, dates, and locations). Submitted Content may contain personal information about people other than you — for example, travelers named in an itinerary.
Where a customer chooses to include it
Submitted Content could contain information relating to minors (for example, in student-travel itineraries); see section on “Children’s Privacy”. For our event tools, event attendees may submit their own travel details (such as email, flights, and accommodation) to calculate a per-person footprint.
Measurement and usage data
The reports, calculations, measurement history, and confidence scores generated from your use of the Services, and records of how you interact with the Services.
Information collected automatically
IP address, browser and device type, and similar technical data; cookies, pixels, and analytics data; and session identifiers and tokens used to keep you signed in and to secure your account. See section on “Cookies and Analytics”.
Information from third parties
We may receive limited information from our payment processors (for example, confirmation of a transaction) and from our customer-relationship and email tools.
How We Use Information
We use information to:
- Provide, operate, and improve the Services: Create and manage your account, process the content you submit, generate carbon-measurement reports, deliver results to you, and troubleshoot, test, and improve the accuracy of our tools.
- Perform AI-based and automated processing of Submitted Content: See section on “AI-based processing of Submitted Content”
- Communicate with you: Respond to inquiries, send transactional messages, and (where permitted) send news, program updates, and marketing. You can opt out of marketing at any time.
- Process transactions: Memberships, offsets, subscriptions, and credit purchases.
- Maintain security and prevent abuse: Including fraud prevention and enforcing rate limits and our terms.
- Improve the Services and develop industry insight: We may create de-identified and aggregated data that does not identify you, your company, or your tours, and use it to improve our tools and to develop industry benchmarks and research. We will not attempt to re-identify de-identified data. Business customers may ask us to exclude their account’s data from benchmark datasets by emailing [email protected].
- Comply with law: Meet legal, tax, accounting, and regulatory obligations, and respond to lawful requests.
Our commitments
We do not sell your personal information. We do not disclose your Submitted Content to third parties except to the service providers (sub-processors) listed in the section about “How we Share Information” who help us operate the Services, or as required by law. We do not use your Submitted Content to train artificial-intelligence models, and we use our AI provider(s) for inference only (see section on “AI-based processing of Submitted Content”).
AI-based Processing of Submitted Content
Our measurement tools use artificial intelligence and automated processing. When you submit an itinerary link, document, or trip details, we (and the service providers in the section about “How we Share Information”):
- Retrieve and read the content you provide;
- Use AI to extract structured trip details (such as legs of travel, accommodations, and meals);
- Apply documented standard assumptions to fill gaps where information is missing; and
- Calculate an estimated carbon footprint, with confidence indicators.
This processing is automated, but the results are estimates that you can review and adjust; we do not use this automated processing to make legal or similarly significant decisions about individuals.
Because this processing relies on third-party AI and content-retrieval providers, the content you submit — which may include other people’s information — is transmitted to those providers to perform the analysis. Those providers process it to provide their service to us; we do not permit them to use your Submitted Content to train their models. We do not use your Submitted Content to train any model.
How We Share Information
We Share Personal Information Only as Described Here
Service providers (sub-processors)
We use trusted vendors to operate the Services. They may process personal information only to provide services to us and are bound by contractual confidentiality and security obligations. Our current providers include:
- Artificial intelligence / large-language-model processing: Google (Gemini) and Anthropic (Claude), used to interpret content you submit.
- Content retrieval: Jina AI and Firecrawl, used to fetch the content of a link you submit.
- Cloud hosting, network security, storage, and email delivery: Amazon Web Services (compute, database, file storage, and email), hosted in the United States. Cloudflare (network security and content delivery); Vercel and Supabase (hosting and databases for some of our tools and our website); and Resend (email delivery).
- Payment processing: Stripe and PayPal (your card details are entered directly with them; we do not store full card numbers).
- Customer relationship management and invoicing: Zoho.
- Email marketing: Mailchimp.
- Analytics: Google (Google Analytics / Tag Manager).
- Bot protection: Google reCAPTCHA (on checkout).
- Staff authentication: Google (single sign-on for our internal team only).
We may add or change providers as the Services evolve; a current list is available on request at [email protected].
Carbon-calculator partners
When you use a carbon calculator that a partner hosts, we may share your name, sales total, and metric tons offset with that partner. We do not share your email or payment information with partners without your express permission.
Legal and safety
We may disclose information if required by law or legal process, or to protect the rights, property, or safety of Sustainable Travel International, our users, or others.
Business transfers
If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this Policy.
We do not sell your personal information.
Cookies and Analytics
We use cookies and similar technologies to keep you signed in, secure your account, remember your preferences, and understand how the Services are used. We use Google Analytics / Tag Manager for usage analytics, Google Ads to measure the effectiveness of our advertising, and Mailchimp to understand email engagement. You can control cookies through your browser settings, and you can opt out of Google Analytics using Google’s opt-out tools. Some cookies are strictly necessary for the Services to function (for example, authentication tokens) and cannot be disabled.
Data Retention
We keep personal information for as long as needed to provide the Services and for legitimate business and legal purposes:
- Account information is retained while your account is active.
- Submitted Content and measurement data are retained to provide the Services to you (and, where we act as a processor, in accordance with the customer’s instructions).
- Following account closure or a verified deletion request, we will delete or de-identify the associated personal information, except where we must retain it to meet legal, tax, accounting, security, or dispute-resolution obligations, where it exists in de-identified or aggregated form, or where it remains in backups or logs until they are deleted in the ordinary course.
To request deletion, see the next section.
Your Privacy Rights and Choices
General choices
You can opt out of marketing emails using the unsubscribe link in any message, manage cookies through your browser, and update account information within your account or by contacting us.
How to exercise your rights
Email [email protected]. We will verify your request and respond within 30 days (or as required by applicable law). If we act as a processor for the content in question, we will refer your request to the relevant business customer (the controller) and support them in responding. We will not discriminate against you for exercising your rights.
U.S. state privacy rights (including California)
Depending on your state of residence, you may have the right to: know/access the personal information we hold about you; correct inaccurate information; delete your information; obtain a portable copy; and opt out of the “sale” or “sharing” of personal information and of certain targeted advertising. We do not sell personal information, and we do not use sensitive personal information for purposes that require an opt-out. California residents may also request details about our information practices. You may use an authorized agent to submit a request.
EEA/UK (GDPR) rights
If you are in the European Economic Area or the United Kingdom, you have the right to access, rectify, erase, restrict, or object to processing of your personal information, and to data portability. Our lawful bases include performing a contract with you, your consent (which you may withdraw), and our legitimate interests in operating and improving the Services. Where we act as a processor on a business customer’s behalf, please direct requests to that customer. You have the right to lodge a complaint with your local supervisory authority.
If required, we will designate an EEA/UK representative under Article 27 and list them here.
Security
We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, encryption of stored data where appropriate, password hashing, access controls, and hosting with a reputable cloud provider. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information or Submitted Content, we will notify affected customers without undue delay and as required by applicable law.
Children's Privacy
The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13 through our website. Separately, our tools allow business customers to submit content that they control. Customers must not submit personal information about minors unless they have the legal right and any necessary consents to do so, and where such information is included in Submitted Content, we process it only as a processor on the customer’s behalf and in accordance with the customer’s instructions. If you believe a child’s information has been provided to us improperly, contact us, and we will take appropriate steps.
International Data Transfers
We are based in, and host the Services in, the United States. If you access the Services or provide information from outside the United States, your information will be transferred to, stored in, and processed in the United States and other countries where we or our service providers operate, which may have different data-protection laws than your country. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for cross-border transfers. By using the Services, you understand that your information may be processed in the United States.
Third-party Services and Linked Websites
The Services may link to or integrate with third-party websites and services that we do not control. This Policy does not apply to those third parties, and we are not responsible for their practices. We encourage you to review their privacy policies.
Changes to this Policy
We may update this Policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, provide additional notice as appropriate. Your continued use of the Services after an update means you accept the revised Policy.
Contact Us
Sustainability International, Inc.
DBA Sustainable Travel International
3523 Burke Ave. N
Seattle, WA 98103, USA
Email: [email protected]
