Last updated: 7 November 2026
Sojourn is a free group-travel organiser made by Essnce Ltd ("we", "us"). This policy explains what we collect, why, and the choices you have.
Who we are: Essnce Ltd, a company registered in England & Wales, at 6 Greatorex Street, London E1 5NF. Contact: [email protected]. Data Protection Officer: David Power, [email protected].
1. What we collect
Things you give us:
- Account and profile: name, email address, phone number, and profile details.
- Trips: trip names, destinations, dates, itinerary details, and party information.
- Travel companions: the names and contact details of the people you add to a trip, so we can include them.
- Bookings: structured details from emails you forward to us (flights, hotels, dates, references). We extract only the fields we need; we do not keep your raw emails.
- Spending: amounts, who paid, categories (such as "Dinner out" or "Groceries") and how costs are split. Where you scan a receipt, the photo stays on your device; we keep only the extracted amounts and items.
Things we collect automatically:
- Device and usage: app version, device type, settings, and how you use Sojourn.
- Approximate location from your internet connection, for security and basic analytics.
- Trip-confirmation location: when you book a trip, we make a scoped, one-off check at city or region level during your trip window to confirm you've arrived and to mark your trip as started and completed, and to update your personal travel record. This is not continuous tracking.
- Precise (GPS) location only if you switch on a location feature, such as nearby suggestions — and only while that feature is active.
Things we derive:
- We create simple inferences from your activity (for example, "prefers direct flights") to personalise the app.
- We generate aggregate, anonymised price data from group spending — see Section 8.
2. How we use your information and our legal basis
| What we do | What we use | UK/EU legal basis |
|---|---|---|
| Provide the service: itineraries, booking parsing, money splitting, group chat, trip states | Trips, bookings, spend, companions, scoped location | Contract |
| Keep the service secure and prevent fraud | Device, usage, approximate location | Legitimate interests |
| Product analytics and improvement | Usage, trips, spend, location signals — in aggregate | Legitimate interests |
| Personalise your experience and recommendations | Preferences, inferences, trip history | Legitimate interests |
| Power real-data price guidance (Section 8) | Spend, in aggregate | Legitimate interests |
| Marketing Sojourn to you | Contact details, preferences | Consent |
| Precise-location features (nearby suggestions) | GPS | Consent |
Our legitimate interests are: running and securing the service, improving and personalising it, and understanding usage in ways you would reasonably expect, without significant impact on you. You can object to any legitimate-interests use at any time. Where you are in California or another US state, the rights in Section 13 apply instead.
3. Consent — how and when we ask
We only ask for consent when the law requires it, and only when you reach the feature it relates to. Each consent is separate, optional, and never a condition of using Sojourn as a whole — declining only means that feature stays off:
- AI assistant — asked the first time you use it, because your questions are processed by our AI provider (see Section 10).
- Inbox scan — asked when you connect an email account, because it reads your inbox for booking confirmations (see Section 4).
- Live location sharing (telemetry) — asked per trip, the first time you use it, so others on the trip can see your location during an incident. It is never on by default.
- Marketing — asked separately before we send you marketing.
- Data licensing — asked only if we ever license data beyond the anonymised aggregates in Section 8.
- Analytics — switched on by default and shown in Settings, where you can turn it off any time.
You can review and withdraw any consent in Settings at any time. If this policy changes in a way that affects a consent you gave, we ask again — we never treat your continued use of the app as consent to a new purpose.
4. Email access (Gmail and Microsoft) — restricted use
If you connect an email account, we ask for the narrowest access available: a read-only, restricted scope (gmail.readonly for Gmail, Mail.Read for Microsoft). The scan runs on your device against a bounded, recent search for booking confirmations from known travel senders. Only matched confirmation messages leave your device — your full inbox is never uploaded, and we never store its contents on our servers.
Email data is used for one thing only: adding the booking to your itinerary. We never use it for advertising or analytics, never profile you from it, and never send it to the AI assistant or use it to train AI or machine-learning models. We do not transfer it to third parties except as strictly necessary to provide this feature, or as the law requires.
You can disconnect at any time — in Sojourn settings or in your Google or Microsoft account. When you do, we delete the stored access tokens and scanning stops immediately. Inbox scanning is off unless you switch it on, and it never runs without your consent.
5. Information about your travel companions
When you add companions, you give us their names and contact details so we can include them in your trip — and only for that. If you are a companion who hasn't signed up, we will tell you we hold your information, usually within one month or when we first contact you. Companions have the same rights as everyone else.
6. Who we share information with
- Service providers that process data on our behalf: our hosting and database provider (Supabase), content delivery (Akamai, Cloudflare), email delivery (Postmark), analytics (PostHog), push notifications (Firebase/Apple), real-time services (Upstash) and cloud storage (Google Cloud). They may use your data only to provide services to us, under contract. Our current list is kept at essnce.io/sojourn/subprocessors.html.
- Legal and safety: where the law requires, or to protect rights and safety.
- We do not sell your personal information, and we do not share it for cross-context behavioural advertising. If that ever changes, we will update this policy and give you the choices the law requires.
7. International transfers
Your information is processed on servers in the UK and EU and, where necessary, with providers outside those regions — including the United States and, for the AI assistant, our AI provider (DeepSeek). Where UK or EU personal data is transferred, we rely on the EU Standard Contractual Clauses and/or the UK International Data Transfer Agreement. Contact us for a copy.
8. Price guidance from real data
When you log a trip's spending, we combine it with other trips' spending — always in aggregate — to show real-world price guidance in the app ("average dinner in Marrakech", "drinks at a bar", "groceries", "tours"). We rely on legitimate interests for this; you can object. Published figures are aggregated and rounded so that no individual, trip or small group can be identified, and they cover only everyday spending categories. They never include health, religious or similarly sensitive categories.
9. How long we keep information
- Account and trip data: while your account is active. When you close your account or ask us to delete your data, we delete or anonymise it within 30 days.
- Trip-confirmation location: 30 days after your trip, then deleted.
- Live location sharing: points are kept for up to one year to support safety incidents, then deleted.
- Chat: messages exist only on the devices of the people in the conversation; the server keeps no message history, and any transient copies are deleted once delivered or within 30 days.
- We keep data required by law for the required period.
10. Automated decisions and the AI assistant
Our AI assistant and recommendations use automated processing. They do not make decisions with legal or similarly significant effects about you without human involvement. You can ask for a person to review any decision we make about you. The assistant only receives the limited trip context needed to answer your question — never your messages, contacts or expense details beyond that, and never your email.
11. Security
- Encryption in transit and at rest. All traffic uses TLS 1.2 or newer, and stored data is encrypted at rest (AES-256). Group chat is end-to-end encrypted between members' devices — our servers hold no readable message history, and any transient copies are deleted on delivery or within 30 days. Documents you attach are encrypted on your device before they leave it.
- Access control. Production data is accessible only to authorised staff on a need-to-know basis, behind role-based access controls. Credentials live in a secrets manager, and direct database access is logged and audited.
- Monitoring and testing. We run automated security monitoring and regular vulnerability assessments.
- Incident response. We maintain an incident-response plan. If a breach affects your personal data, we will notify you and the relevant regulators as required by law.
12. Children
Sojourn is not directed at children under 13 in the UK and US (under 13–16 in EU countries, per local law). We do not knowingly collect personal information from children below the applicable age without the required parental consent, and we never sell or share the personal information of anyone we know to be under 16.
13. Your rights
UK and EU: access a copy of your data; correct it; delete it; restrict or object to our use of it; move it to another service; and withdraw consent at any time. Email [email protected]. To have your data deleted, you can also use our request form at essnce.io/sojourn/data-deletion.html. You can also complain to the Information Commissioner's Office (ico.org.uk) or your EU regulator.
United States (including California): depending on your state, you may have the right to know what personal information we collect, use, disclose or share (categories and specific pieces, over the prior 12 months); delete it; correct it; opt out of the sale or sharing of personal information (we do not sell or share for advertising); limit the use and disclosure of sensitive personal information; and be free from discrimination for exercising your rights. Email [email protected] or use the request form at essnce.io/sojourn/data-deletion.html. We verify your identity before acting and honour the Global Privacy Control signal.
California notice at collection: we collect identifiers (name, email, phone); commercial information (trips, bookings, spending); internet or electronic activity (usage); geolocation (approximate; city/region-level trip confirmation; precise only with your permission); and inferences (travel preferences). We use them for the purposes in Section 2.
14. Changes and contact
We update this policy when our practices change. We will tell you about material changes before they take effect where the law requires, and if a change affects a consent you gave, we will ask for it again. Questions or requests: [email protected]. Data protection: David Power, [email protected]. Company: Essnce Ltd, 6 Greatorex Street, London E1 5NF.