Privacy Policy
Last Updated: July 3, 2026
Effective Date: July 3, 2026
Last Updated: July 3, 2026
Effective Date: July 3, 2026
1. Introduction
1. Introduction
This Privacy Policy explains how Movmo, a brand of B and W Travel Company and a DBA of B & W Travel Company ("Movmo," "we," "us," or "our") collects, uses, discloses, and protects personal data when you use the Movmo platform and related services (the "Service").
This policy is provided to meet transparency requirements under the General Data Protection Regulation (GDPR) and other applicable privacy laws.
This Privacy Policy explains how Movmo, a brand of B and W Travel Company and a DBA of B & W Travel Company ("Movmo," "we," "us," or "our") collects, uses, discloses, and protects personal data when you use the Movmo platform and related services (the "Service").
This policy is provided to meet transparency requirements under the General Data Protection Regulation (GDPR) and other applicable privacy laws.
2. Our Role Under Data Protection Law
2. Our Role Under Data Protection Law
Movmo, a brand of B and W Travel Company and a DBA of B & W Travel Company, is the data controller for personal data processed through the Service.
Movmo, a brand of B and W Travel Company and a DBA of B & W Travel Company, is the data controller for personal data processed through the Service.
Depending on the context:
Depending on the context:
•
•
Movmo acts as a data controller for user account and profile data.
Movmo acts as a data controller for user account and profile data.
•
•
Movmo may act as a processor or joint controller when facilitating bookings with travel partners (including airlines and hotels).
Movmo may act as a processor or joint controller when facilitating bookings with travel partners (including airlines and hotels).
Travel partners act as independent controllers for data they receive and process in connection with reservations.
Travel partners act as independent controllers for data they receive and process in connection with reservations.
3. Personal Data We Collect
3. Personal Data We Collect
You may provide personal data to Movmo directly through our website or applications, or through an AI agent that you have authorized to interact with Movmo on your behalf (see Section 5(d) for further detail on AI-assisted interactions). The categories of personal data we collect, and the purposes for which we process it, are the same regardless of the channel used.
You may provide personal data to Movmo directly through our website or applications, or through an AI agent that you have authorized to interact with Movmo on your behalf (see Section 5(d) for further detail on AI-assisted interactions). The categories of personal data we collect, and the purposes for which we process it, are the same regardless of the channel used.
We may collect the following categories of personal data:
We may collect the following categories of personal data:
a. Contact Information
a. Contact Information
•
•
Full Name
Full Name
•
•
Email address (required to create an account)
Email address (required to create an account)
•
•
Phone number (optional)
Phone number (optional)
•
•
Profile photo (if you choose to add one)
Profile photo (if you choose to add one)
b. Traveler Information
b. Traveler Information
•
•
Traveler names
Traveler names
•
•
Date of birth
Date of birth
•
•
Gender (where required by travel partners)
Gender (where required by travel partners)
•
•
Nationality
Nationality
•
•
Government-issued travel document details, such as passport number, issuing country, and expiration date (and, where you provide them, visa, national ID, driver's license, Known Traveler Number, or redress number details)
Government-issued travel document details, such as passport number, issuing country, and expiration date (and, where you provide them, visa, national ID, driver's license, Known Traveler Number, or redress number details)
•
•
Loyalty program details (transmitted to the travel partner when needed to complete a booking)
Loyalty program details (transmitted to the travel partner when needed to complete a booking)
•
•
Travel preferences, including seating and baggage preferences, meal preferences, and any special assistance needs you choose to share
Travel preferences, including seating and baggage preferences, meal preferences, and any special assistance needs you choose to share
Certain travel preferences (such as some meal preferences or special assistance needs) may reveal information about your health, disability status, or religious beliefs. We process this information only because you choose to provide it, and only to fulfill your travel requests and communicate them to the travel partner you book with.
Certain travel preferences (such as some meal preferences or special assistance needs) may reveal information about your health, disability status, or religious beliefs. We process this information only because you choose to provide it, and only to fulfill your travel requests and communicate them to the travel partner you book with.
c. Booking and Transaction Data
c. Booking and Transaction Data
•
•
Itinerary details (including booking references, ticket numbers, and seat and baggage selections)
Itinerary details (including booking references, ticket numbers, and seat and baggage selections)
•
•
Fare and booking references
Fare and booking references
•
•
Payment card metadata: card brand, last four digits, expiration date, cardholder name, and billing postal code. Full card numbers and security codes are captured directly by our PCI DSS–compliant payment vault provider and are never stored on Movmo systems; payment details are tokenized.
Payment card metadata: card brand, last four digits, expiration date, cardholder name, and billing postal code. Full card numbers and security codes are captured directly by our PCI DSS–compliant payment vault provider and are never stored on Movmo systems; payment details are tokenized.
d. Technical and Security Data
d. Technical and Security Data
•
•
Authentication and account-security events (e.g., sign-in and sign-up events)
Authentication and account-security events (e.g., sign-in and sign-up events)
•
•
Device and browser information (browser, operating system, device type)
Device and browser information (browser, operating system, device type)
•
•
IP address and user agent (stored encrypted), and approximate location (city/country) derived from IP address for security monitoring
IP address and user agent (stored encrypted), and approximate location (city/country) derived from IP address for security monitoring
•
•
Records of your acceptance of terms and your consent choices, including the specific permission categories you grant to each authorized third-party application or AI agent and when you granted them
Records of your acceptance of terms and your consent choices, including the specific permission categories you grant to each authorized third-party application or AI agent and when you granted them
4. Lawful Bases for Processing (GDPR Article 6)
4. Lawful Bases for Processing (GDPR Article 6)
Movmo processes personal data under the following lawful bases:
Movmo processes personal data under the following lawful bases:
a. Performance of a Contract — Article 6(1)(b)
a. Performance of a Contract — Article 6(1)(b)
We process personal data that is necessary to provide the Service, including:
We process personal data that is necessary to provide the Service, including:
•
•
creating and managing your Movmo account,
creating and managing your Movmo account,
•
•
authenticating users,
authenticating users,
•
•
storing traveler profiles, including profiles created or updated through AI-assisted interactions,
storing traveler profiles, including profiles created or updated through AI-assisted interactions,
•
•
transmitting booking data to travel partners (including airlines and hotels) to complete reservations,
transmitting booking data to travel partners (including airlines and hotels) to complete reservations,
•
•
processing payments and bookings.
processing payments and bookings.
This processing is required to perform the contract you enter into when using the Service.
This processing is required to perform the contract you enter into when using the Service.
b. Legal Obligations — Article 6(1)(c)
b. Legal Obligations — Article 6(1)(c)
We may process data to comply with legal, accounting, or regulatory obligations.
We may process data to comply with legal, accounting, or regulatory obligations.
c. Legitimate Interests — Article 6(1)(f)
c. Legitimate Interests — Article 6(1)(f)
We may process limited data for:
We may process limited data for:
•
•
fraud prevention,
fraud prevention,
•
•
security monitoring,
security monitoring,
•
•
service reliability and improvement.
service reliability and improvement.
These interests are balanced against your rights and freedoms.
These interests are balanced against your rights and freedoms.
d. Consent — Article 6(1)(a) (When Applicable)
d. Consent — Article 6(1)(a) (When Applicable)
We rely on consent only for optional processing activities, such as:
We rely on consent only for optional processing activities, such as:
•
•
marketing communications,
marketing communications,
•
•
non-essential analytics,
non-essential analytics,
•
•
cross-merchant personalization.
cross-merchant personalization.
Where consent is required, it is obtained separately and may be withdrawn at any time.
Where consent is required, it is obtained separately and may be withdrawn at any time.
5. Data Sharing and Disclosure
5. Data Sharing and Disclosure
We may share personal data with:
We may share personal data with:
a. Travel Partners
a. Travel Partners
Personal data necessary to complete bookings is shared with the travel partner (airline or hotel) you choose to book with. This sharing is required to perform the reservation contract.
Personal data necessary to complete bookings is shared with the travel partner (airline or hotel) you choose to book with. This sharing is required to perform the reservation contract.
b. Service Providers
b. Service Providers
Trusted vendors supporting:
Trusted vendors supporting:
•
•
authentication,
authentication,
•
•
payment processing,
payment processing,
•
•
infrastructure hosting,
infrastructure hosting,
•
•
security and fraud prevention.
security and fraud prevention.
•
•
third-party AI and conversational-agent providers.
third-party AI and conversational-agent providers.
c. Legal Authorities
c. Legal Authorities
Where required by law or to protect rights and safety.
Where required by law or to protect rights and safety.
d. AI-Assisted Interactions
d. AI-Assisted Interactions
For purposes of this policy, "AI agent" refers to third-party conversational AI services (including large language model providers) that you have authorized to interact with Movmo on your behalf.
When you interact with Movmo through an AI agent, the agent may transmit information you provide (including the personal data described in Section 3) to Movmo so that Movmo can create or update records on your Movmo profile.
You may authorize an AI agent to access your Movmo account through Movmo's authorization flow, in which you sign in to Movmo directly (the agent never receives your sign-in codes). Where an agent requests access to specific categories of your data, Movmo presents a consent screen describing each requested permission in plain language — for example, viewing your profile, viewing and managing saved travelers, viewing saved payment method summaries (card brand, last four digits, and expiration date only; never full card numbers), or searching for and booking flights — and the agent's access is technically limited, and enforced by Movmo's servers on every request, to the categories you approve. If the same agent later requests additional categories, you are asked to approve only the new ones; prior approvals are never silently expanded. Where an agent does not request specific categories, completing the authorization flow authorizes it to act on your account within your own account permissions. Movmo keeps a record of the permission categories you grant to each agent and when you granted them. Agent access credentials are time-limited and expire automatically; you may withdraw an agent's access at any time by contacting privacy@movmo.io, after which the agent's existing credentials stop working within minutes and any renewed access requires you to sign in and consent again.
AI agents are operated by third parties under their own terms and privacy policies, which govern how those providers process the information you share with the agent before it is transmitted to Movmo. Personal data Movmo receives through AI-assisted interactions is subject to Movmo's retention, deletion, and data-subject-rights practices described in Sections 7 and 9.
Movmo does not use AI-assisted interactions for automated decision-making or profiling that produces legal or similarly significant effects on individuals (within the meaning of GDPR Article 22). The AI agent acts as a data-transmission channel; decisions regarding your Movmo profile are made by Movmo's service based on the data you provide.
California residents and other users with rights under applicable state laws regarding sensitive personal information (including government-issued identification numbers such as passport numbers, and dates of birth) may exercise those rights as described in Section 9 or by contacting privacy@movmo.io.
For purposes of this policy, "AI agent" refers to third-party conversational AI services (including large language model providers) that you have authorized to interact with Movmo on your behalf.
When you interact with Movmo through an AI agent, the agent may transmit information you provide (including the personal data described in Section 3) to Movmo so that Movmo can create or update records on your Movmo profile.
You may authorize an AI agent to access your Movmo account through Movmo's authorization flow, in which you sign in to Movmo directly (the agent never receives your sign-in codes). Where an agent requests access to specific categories of your data, Movmo presents a consent screen describing each requested permission in plain language — for example, viewing your profile, viewing and managing saved travelers, viewing saved payment method summaries (card brand, last four digits, and expiration date only; never full card numbers), or searching for and booking flights — and the agent's access is technically limited, and enforced by Movmo's servers on every request, to the categories you approve. If the same agent later requests additional categories, you are asked to approve only the new ones; prior approvals are never silently expanded. Where an agent does not request specific categories, completing the authorization flow authorizes it to act on your account within your own account permissions. Movmo keeps a record of the permission categories you grant to each agent and when you granted them. Agent access credentials are time-limited and expire automatically; you may withdraw an agent's access at any time by contacting privacy@movmo.io, after which the agent's existing credentials stop working within minutes and any renewed access requires you to sign in and consent again.
AI agents are operated by third parties under their own terms and privacy policies, which govern how those providers process the information you share with the agent before it is transmitted to Movmo. Personal data Movmo receives through AI-assisted interactions is subject to Movmo's retention, deletion, and data-subject-rights practices described in Sections 7 and 9.
Movmo does not use AI-assisted interactions for automated decision-making or profiling that produces legal or similarly significant effects on individuals (within the meaning of GDPR Article 22). The AI agent acts as a data-transmission channel; decisions regarding your Movmo profile are made by Movmo's service based on the data you provide.
California residents and other users with rights under applicable state laws regarding sensitive personal information (including government-issued identification numbers such as passport numbers, and dates of birth) may exercise those rights as described in Section 9 or by contacting privacy@movmo.io.
6. Cookies and Similar Technologies
6. Cookies and Similar Technologies
Movmo uses only cookies that are strictly necessary to operate the Service:
Movmo uses only cookies that are strictly necessary to operate the Service:
•
•
Session and refresh cookies — keep you signed in to your Movmo account.
Session and refresh cookies — keep you signed in to your Movmo account.
•
•
Security cookie — protects your account against cross-site request forgery.
Security cookie — protects your account against cross-site request forgery.
We also use browser storage (localStorage/sessionStorage) for functional purposes such as remembering your language and currency settings, preserving search and booking progress, and preventing duplicate booking submissions.
When Movmo Express Checkout is embedded on a travel partner's website, we use the browser's Storage Access API to ask your browser for permission to recognize your existing Movmo session within the partner's site. This access is granted only through a browser-mediated permission and is used solely to sign you in to your Movmo account — not to track your activity on the partner's site.
Movmo does not currently use any advertising, analytics, or marketing cookies or trackers. If we introduce non-essential cookies in the future, we will request consent where required by law (see Section 4(d)).
We also use browser storage (localStorage/sessionStorage) for functional purposes such as remembering your language and currency settings, preserving search and booking progress, and preventing duplicate booking submissions.
When Movmo Express Checkout is embedded on a travel partner's website, we use the browser's Storage Access API to ask your browser for permission to recognize your existing Movmo session within the partner's site. This access is granted only through a browser-mediated permission and is used solely to sign you in to your Movmo account — not to track your activity on the partner's site.
Movmo does not currently use any advertising, analytics, or marketing cookies or trackers. If we introduce non-essential cookies in the future, we will request consent where required by law (see Section 4(d)).
7. Data Retention
7. Data Retention
We retain personal data only for as long as necessary to:
We retain personal data only for as long as necessary to:
•
•
provide the Service,
provide the Service,
•
•
comply with legal obligations,
comply with legal obligations,
•
•
resolve disputes,
resolve disputes,
•
•
enforce agreements.
enforce agreements.
In general, account, profile, and traveler-identity data is retained for the duration of your active Movmo account and may be retained for a limited period following account closure as necessary to satisfy the purposes listed above. Booking and transaction records are retained for periods required by applicable tax, accounting, and consumer-protection laws.
In general, account, profile, and traveler-identity data is retained for the duration of your active Movmo account and may be retained for a limited period following account closure as necessary to satisfy the purposes listed above. Booking and transaction records are retained for periods required by applicable tax, accounting, and consumer-protection laws.
8. Security Measures
8. Security Measures
Movmo implements industry-standard security measures, including:
Movmo implements industry-standard security measures, including:
•
•
encryption of personal data at rest and in transit,
encryption of personal data at rest and in transit,
•
•
additional field-level encryption of sensitive identifiers (such as travel document numbers, dates of birth, and IP addresses),
additional field-level encryption of sensitive identifiers (such as travel document numbers, dates of birth, and IP addresses),
•
•
tokenization of payment data through a PCI DSS–compliant vault provider,
tokenization of payment data through a PCI DSS–compliant vault provider,
•
•
access controls and audit logging.
access controls and audit logging.
9. Your Rights (GDPR)
9. Your Rights (GDPR)
Depending on your jurisdiction, you may have the right to:
Depending on your jurisdiction, you may have the right to:
•
•
access your personal data,
access your personal data,
•
•
correct inaccurate data,
correct inaccurate data,
•
•
request deletion (subject to legal limitations),
request deletion (subject to legal limitations),
•
•
restrict or object to certain processing,
restrict or object to certain processing,
•
•
data portability,
data portability,
•
•
withdraw consent where processing is based on consent.
withdraw consent where processing is based on consent.
These rights apply to all personal data Movmo holds about you, regardless of how it was collected (including via AI agents).
These rights apply to all personal data Movmo holds about you, regardless of how it was collected (including via AI agents).
Requests can be made at: privacy@movmo.io
Requests can be made at: privacy@movmo.io
10. International Transfers
10. International Transfers
Personal data may be processed in jurisdictions outside your country of residence, including by AI service providers and other vendors operating outside the European Economic Area. Where required by applicable law, appropriate safeguards are applied to such transfers.
Personal data may be processed in jurisdictions outside your country of residence, including by AI service providers and other vendors operating outside the European Economic Area. Where required by applicable law, appropriate safeguards are applied to such transfers.
11. Changes to This Policy
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated appropriately.
We may update this Privacy Policy from time to time. Material changes will be communicated appropriately.
12. Contact Us
12. Contact Us
Movmo (a brand of B and W Travel Company, DBA B & W Travel Company)
131 Continental Dr, Suite 305
Newark, Delaware 19713
Email: privacy@movmo.io
Movmo (a brand of B and W Travel Company, DBA B & W Travel Company)
131 Continental Dr, Suite 305
Newark, Delaware 19713
Email: privacy@movmo.io