Privacy Policy

Who we are

Magic Travel is an AI agent in Telegram that finds flights and buys tickets on airlines’ own websites. It is run by QIWI International Payment System LLC, a limited liability company registered in the State of Delaware, USA, file number 4967495, 16192 Coastal Highway, Lewes, DE 19958, USA (“we”, “us”). The product is built by Nuanu AI Lab in Bali.

This policy covers the bot @magictravelbot_bot, the secure pages it opens for you, and this website.

What we collect

• Your Telegram account: your Telegram user ID and the name and username Telegram shares with the bot.
• Your conversation: the messages you send the bot and its replies, and a short list of facts it remembers to serve you, such as the city you usually fly from or whether you travel with a bag.
• Passenger details you enter on the secure page: full name, gender, date of birth, nationality, passport number, issuing country and expiry date, email, phone number and home address.
• Card details you enter on the secure page: card number, expiry date, security code and cardholder name.
• Your orders: the flights you choose, prices, booking codes, order status and the airline’s ticket letter.
• Bank codes: passing a one-time code from your bank through the chat is in development. For now, a purchase that needs one stops for a manual check. A message that looks like a bank code is deleted from the chat, is not stored in our records and is not shown to AI models.

This website uses no cookies, analytics or tracking. Our hosting provider may keep standard technical logs, such as IP address and time of request, to keep the site secure.

Why we use it

• To search for flights and show you offers.
• To buy the ticket you confirm: fill in the airline’s checkout and pay with your card.
• To send you the ticket and tell you how the order is going.
• If you choose to, to remember passengers and cards so your next order is faster.
• To answer your questions, prevent misuse and meet our legal obligations.

We use your data to provide the service you ask for, with your consent where we ask for it, and for our legitimate interest in keeping the service safe.

How we keep it safe

• Passport and card details are entered on a short-lived secure page, never in the chat. If you send a card number in the chat, the bot deletes the message before any AI model reads it.
• AI models never receive the passport and card details you enter on the secure page. They see masks such as “Maya L.” and “Visa •• 4242”; our code types the real values into the airline’s checkout. Please don’t send these details in the chat: card numbers and bank codes are caught and deleted, but anything else you type in a message is processed like any other message.
• Saved details are encrypted record by record (AES-256-GCM), and each record is tied to its owner.

Who receives it

• The airline and its payment provider receive the passenger and card details needed to sell you the ticket. They handle them under their own privacy policies.
• AI model providers (Anthropic’s Claude models, accessed through OpenRouter) process your messages, the facts the bot remembers about you and the airline pages the agent works on, with the details from the secure page masked. Before any of those details is typed in, the agent can also see screenshots of the pages.
• Google receives your flight searches (routes and dates) through Google Flights.
• Telegram carries your conversation with the bot.
• Our email providers receive the airline’s ticket letter, which we pass on to your chat. During the demo, ticket letters may arrive at a Gmail mailbox run by our team (hosted by Google), where our team can see them. Mail sent to addresses at magictravel.bot is received by Resend, which stores it for 30 days in the United States.
• Authorities, when the law requires it.

We do not sell your personal data.

How long we keep it

• Saved passengers and cards are kept until you delete them. If you untick “Remember for next purchases”, details from that page are not saved.
• The copy of details made for a single order is deleted when the order ends, and no later than 24 hours after it was filled in.
• Say “forget everything”, “delete my data” or send /forget to the bot to delete your saved details, the facts it remembers, and the chat lines and decisions stored in the bot’s journal. Deleted records are overwritten. This does not erase your conversation in Telegram or copies held by airlines and email providers.
• Other records, such as your orders and their payment status, are kept as long as we need them to run the service and answer questions about your orders. You can ask us to delete them.
• Airlines keep their booking records under their own rules.

Your rights

You can ask what data we hold about you, ask us to correct or delete it, or object to how we use it. Ask the bot “What do you know about me?”, use the commands above, or write to support@magictravel.bot.

Children

Magic Travel is for adults aged 18 and over, and each order is for one adult passenger.

Where your data is processed

We and our providers work in several countries, including the United States, so your data may be processed outside the country where you live. We protect it as this policy describes wherever it is processed.

Changes to this policy

We may update this policy. The date at the top shows the latest version; for important changes, we will tell you in the bot.

Contact

QIWI International Payment System LLC, 16192 Coastal Highway, Lewes, DE 19958, USA. Email: support@magictravel.bot.