Privacy Center

Acai provides AI-powered infrastructure to travel call centers. Our privacy, security, and compliance framework is designed to support enterprise travel operations across jurisdictions, while ensuring customer and traveler data is processed strictly for service delivery.This page outlines how Acai uses data, how we use artificial intelligence, and where to find our enterprise compliance documentation.

AI Use & Data Processing

Acai uses artificial intelligence as a standard software utility to enhance the efficiency, speed, and consistency of travel management operations. AI is used exclusively to support service delivery on behalf of our customers.

How Acai Uses AI

AI-assisted processing may be used for:

• Summarizing, escalating and routing inbound emails, chats, and calls
• Drafting responses for agent review or automated delivery based on customer instructions
• Executing service actions (e.g. changes, refunds, disruptions, etc...)

All AI usage is purpose-limited to delivering the contracted services requested by our customers.

Inference-Only Processing & No-Training Commitment

Acai operates AI systems in inference-only mode:

• Customer and traveler data is processed in real time to generate an immediate output
• Customer and traveler data is not used to train or fine-tune any AI or machine learning model, and personal data is never used for model training of any kind
• Individual customer data is not reused across customers or accounts. Only aggregated, anonymized service statistics that contain no personal data are used to operate and improve the service, as described in Section 9 of the Terms of Service

Any transition from inference-only processing to model training or fine-tuning would require an explicit customer request and separate written agreement.

How Acai Does Not Use AI

To provide clear boundaries and reduce regulatory risk, Acai AI systems are NOT used to:

• Train or fine-tune shared AI models on customer or traveler data
• Profile travelers or employees
• Infer sensitive personal characteristics
• Perform biometric identification (e.g. voiceprints or facial recognition)
• Make discretionary decisions with legal or similarly significant effects without appropriate safeguards

Privacy by Design

Acai applies privacy-by-design principles across its platform and operations:

• Data minimization: only data required to deliver the service is processed
• Role-based access controls and least-privilege access
• Employee and contractor privacy and security training
• Pseudonymization or anonymization where appropriate
• Controls aligned with SOC 2 Type II requirements

Personal data is processed solely on customer instructions and in accordance with applicable data protection laws.

Security

Acai Travel is committed to the utmost security of your personal information through an extensive security program.

• Our data centers, powered by AWS, meet the highest standards.
• We ensure encryption both in transit and at rest, safeguarding data across our platform and at Acai Travel's endpoints.
• Our systems are fortified with advanced firewalls at both the Network and Application Layers.
• Wherever necessary, we employ data pseudonymization and anonymization to further protect your privacy.
• Continuous monitoring and logging for security and audit purposes
• Logical data isolation with separate database deployments per customer
• Optional private deployment models, including customer-specific Private Virtual Cloud (PVC/VPC) environments upon request

Acai is SOC 2 compliant and maintains an active Trust Center for security documentation and controls.

Compliance & Legal Framework

Acai operates as a data processor/service provider on behalf of its customers and supports compliance across key jurisdictions, including the European Union, United States, Canada, and Australia.

Our compliance framework includes:

• GDPR and CCPA/CPRA alignment
• A standard Data Processing Addendum (DPA)
• Defined subprocessor management and notification procedures
• Cross-border transfer safeguards
• AI vendors engaged by Acai are treated as subprocessors and are contractually bound to confidentiality, security, and no-training obligations equivalent to Acai’s own commitments.

SOC II

In July 2025, Acai Travel achieved certification for AICPA’s SOC for Service Organizations Trust Services Criteria, commonly known as SOC 2.

AI & LLMs training

Acai uses an inference-only approach by default.

Customers' data is never used to train or fine-tune any AI model or LLM, and personal data is never used for training. Client-specific fine-tuning happens only at that client's request, under a separate written agreement, on anonymized data, and the resulting model serves that client alone.

We use leading LLM providers such as OpenAI and Anthropic, and we may add new ones from time to time, publishing their names on the list of subprocessors on our website (effective Q1 2024 onwards).

As examples, below are the privacy policies from OpenAI and Anthropic:

• https://support.anthropic.com/en/collections/4078534-privacy-legal
• https://openai.com/security

Data is exchanged with these providers via their APIs and never through their frontend applications. These providers do not train their models on data passed through the API.

We do not fine-tune any third-party LLMs without client's permission. If we fine-tune an internal model hosted on our cloud provider, it will only be used for that specific client and not for other Acai clients; each customer has its own fine-tuned model.

We do not pre-train or fine-tune generic LLMs on customer data.

Processing of special category data

Acai operates as a GDPR Article 28 processor for any special category data we handle, processing it solely on your documented instructions and only for the post-booking servicing tasks you authorize.

Acai's platform processes limited categories of special category data as defined under Article 9 GDPR — primarily SSR codes, special meal codes, and equivalent fields necessary to fulfill post-booking servicing tasks such as rebooking, schedule changes, and disruption recovery.

Acai acts as a data processor under Article 28 GDPR, operating solely on the documented instructions of its customers (travel management companies, online travel agencies, and airlines), who serve as data controllers and are responsible for establishing the lawful basis for processing under Article 9(2), typically explicit consent at the point of booking.

Acai's processing is strictly purpose-bound to the servicing task defined by the controller and does not extend to analytics or profiling of identifiable data, personalization, model training, or model fine-tuning. Only aggregated, anonymized service statistics that contain no personal data are compiled.

Foundation models used in our agentic workflows are deployed within the customer's own cloud environment (Azure or AWS VPC), so prompt and completion data remain within the controller's perimeter. Customer data is stored in customer-dedicated database clusters subject to automated retention and deletion aligned with the operational purpose (trip completion plus a defined tail for complaints, chargebacks, and regulatory record-keeping). Sub-processors are engaged only with controller authorization and are documented in our DPA, and cross-border transfers are governed by Standard Contractual Clauses and a transfer impact assessment where applicable.

A Data Protection Impact Assessment, prepared in cooperation with the controller as required under Article 28(3)(f), covers our agentic servicing workflows, including pre-engagement processing in involuntary-change scenarios.

Detailed terms are set out in our Data Processing Addendum, available on request.

Google user data

This section applies to the data AcaiDesk receives from Google APIs when a customer connects a Google mailbox (Gmail or Google Workspace) to AcaiDesk. Where it is stricter than the rest of this page, this section applies.

Data we access

• With the gmail.readonly permission: the messages of the connected mailbox (sender, recipients, subject, date, message body and attachments), its labels and its email address, so that the mailbox's email can be shown and handled as tickets in AcaiDesk.
• With the gmail.send permission: AcaiDesk sends, from the connected mailbox, the replies and new emails that the customer's agents write in AcaiDesk.
• AcaiDesk does not ask for permission to modify or delete the mailbox's messages, change its settings, or access the account's contacts, calendar or files.

How we use it

• Only to provide AcaiDesk's help desk features to the customer that connected the mailbox: showing incoming and sent email as tickets, threading replies, sending the agents' replies, search, and the customer's own automation rules and service-level tracking.
• When the customer turns on AI features in AcaiDesk, message content is also processed to classify, route and summarize tickets and to draft replies for an agent to review. This processing is inference only and serves only that customer.
• Never for advertising, never sold, never used to build profiles of people, and never used to determine credit-worthiness or for lending purposes.

Who we share it with

• The customer's own AcaiDesk users (its agents and administrators), within the access the customer configures.
• The infrastructure providers that host AcaiDesk (application hosting and databases in the European Union), as our subprocessors.
• Only when the customer turns on AI features: the AI model providers that process requests through their APIs (for example OpenAI and Anthropic, or the customer's own AI provider account). They process the data only to return a result and do not use it to train their models.
• When required by law, or when necessary to protect against fraud, abuse or security threats.
• We do not transfer Google user data to anyone else, and we never sell it.

How we protect it

• Google user data is encrypted in transit (TLS) and at rest.
• The Google authorization (refresh) token is stored encrypted and is decrypted only to call Google on the customer's behalf.
• Each customer's data is kept in its own isolated database schema, and within a customer, access follows the users and mailboxes the customer grants.
• Acai personnel do not read Google user data, except with the customer's explicit permission (for example to resolve a support request, which is recorded in an audit log the customer can see), when needed for security purposes such as investigating abuse, or to comply with applicable law.

Retention and deletion

• We keep the email of a connected mailbox for as long as the customer uses AcaiDesk and keeps it, to provide the help desk service.
• A customer administrator can disconnect the mailbox at any time in AcaiDesk. Disconnecting deletes the stored Google authorization immediately and stops all access to the mailbox. Access can also be revoked at any time from the Google Account's security settings (myaccount.google.com/permissions).
• When a customer ends its AcaiDesk subscription, or asks us to delete its data at privacy@acaitravel.com, we delete its data, including all Google user data, within 30 days, unless the law requires us to keep it longer.

AI and machine learning

• Google user data, whether raw, aggregated or anonymized, is never used to develop, improve or train any AI or machine learning model, including client-specific or fine-tuned models.
• Google user data is never transferred to a third-party AI service that uses it to train its models.

Limited Use

AcaiDesk's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.

Privacy & Compliance Documents

Please find all our Privacy & Compliancy controls at our Trust Center managed by Vanta

If you need additional information regarding Privacy at Acai Travel, we are there to hear you out at privacy@acaitravel.com