YOUR INFORMATION · YOUR CHOICES

Privacy policy.

Effective October 12, 2026

WhichWay is a travel-planning service currently operated by Josh Banayan. This policy explains how WhichWay handles information through askwhichway.com, customer accounts, travel-planning communications, emailed confirmations, and the @askwhichway Instagram inspiration feature.

Questions or requests? Email hello@askwhichway.com.

1. Information we collect

• Account information: your name, email address, account identifiers, and sign-in information handled by our authentication provider.
• Travel profile and trip details: destinations, dates, budget, points and loyalty preferences, interests, traveling companions, accessibility or dietary needs you choose to share, itinerary feedback, and requests for help.
• Confirmations and communications: messages you send us, booking-provider details, passenger names, references, routes, dates, times, prices, and text from supported PDF attachments. Source-message identifiers and extraction or review records help us verify information and prevent duplicates.
• Instagram submissions: handles you declare, contributor names, provider sender and message identifiers, message text, shared reel or post links, available captions and creator information, timestamps, and suggested places extracted from the submission. We also retain identity-confirmation and assignment records.
• Optional wishlist recaps: if you request them, your email address, wishlist association, consent version, confirmation and unsubscribe records, and delivery status. We store the delivery address and private wishlist link in an encrypted subscription record.
• Technical information: service providers may process IP addresses, browser and device information, request timestamps, error records, and security logs to deliver and protect the service.

Please share only the information needed for planning. Do not send passwords, API keys, full payment-card details, or passport or government-ID copies through these features. If your confirmation contains sensitive identifiers, remove them before forwarding when possible. Information present in a source email or PDF may be processed even when it is excluded from the resulting booking summary.

2. How we use information

We use this information to provide travel planning, maintain your profile and inspiration collection, organize confirmations and reservations, prepare itineraries and booking guidance, handle requests and changes, verify submitter identities, prevent duplicates, and secure and troubleshoot the service.

WhichWay’s customer-profile and intake features do not sell personal information or use it for targeted advertising. Travel information is not automatically published as marketing content.

We also measure use of WhichWay to understand wishlist returns, itinerary shopping, consultation interest and trip inquiries. Measurement uses a random per-tab session identifier and protected account or wishlist identifiers, not advertising pixels or cross-site cookies. We do not include wishlist contents, points balances or private messages in usage records. Browser Do Not Track and Global Privacy Control signals disable this usage measurement. Operational purchase, inquiry and booking records remain necessary to provide the service.

3. Email and Google access

The confirmation feature uses authorized, read-only access to WhichWay’s business inbox, hello@askwhichway.com. It does not require access to a customer’s personal Gmail account. The worker searches for messages from configured senders and processes messages that match a connected sender and thread or subject reference. Read-only authorization does not permit sending, changing, or deleting Gmail messages. An administrator may separately authorize sending from this same business inbox for optional wishlist confirmation and recap emails. This does not grant access to a customer’s personal inbox.

Supported PDF attachments may be downloaded temporarily for text extraction. Extracted booking details and supporting evidence can be stored in a private review record. Original emails and attachments remain in the business mailbox unless separately deleted there.

WhichWay also uses authorized, read-only access to its connected business calendar for scheduling information. WhichWay’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Google-derived information is used for the relevant service features, not advertising or training general-purpose AI models.

Weekly wishlist recaps are optional and begin only after you confirm your email. They summarize new saves and link back to your private wishlist; weeks with no new saves are skipped. Recap consent does not subscribe you to offers or flight deals and does not create an account. You may separately choose to include WhichWay’s handpicked flight deals for your saved destinations and provide a home airport code. That preference and your additional consent are stored with your encrypted subscription record. You may also separately choose flight-pick alerts (up to one separate email per day), covering any airport and destination. Existing weekly-only preferences are not converted to daily alerts. These choices are confirmed by email and stored encrypted. Relevant deals appear only while published and unexpired. Deal links open the independent airline, booking provider, or deal source you choose to visit; those services handle your activity under their own policies. Prices and availability may change. Use the unsubscribe link in a recap or deal email to stop future recaps. Anyone with a private wishlist link can see and organize that collection, so keep emailed wishlist links private.

4. Instagram inspiration and contributors

You may send travel inspiration to @askwhichway and declare your own or a contributor’s handle in your profile. A declared handle alone does not identify the sender. Josh confirms the first submission and associates the provider’s sender identifier with the appropriate customer. Unidentified senders or identities associated with multiple customers remain in private review until resolved.

Confirmed submissions may appear in that customer’s collection across trips, with the original link, contributor attribution, available location details, and suggested places. Only share on someone else’s behalf with their permission, and tell contributors that their submissions may appear in the customer’s collection. WhichWay stores links, available text, suggested places, and review status. When Instagram provides accessible media, we may temporarily process video frames, images, and audio to identify places. Expiring media links can be held in the processing queue. Temporary downloaded media is removed after processing rather than copied into a customer profile. Nearby messages from the same sender may clarify a shared reel. The feature sends an acknowledgement after intake and may send a second reply with the places found or a review notice. An acknowledgement does not confirm sender matching or venue facts. This feature does not publish an itinerary or make a booking.

Meta and Instagram independently handle activity on their platforms under their own policies. Deleting a WhichWay record does not delete the original Instagram message or post.

5. AI processing and human review

We use OpenAI’s API to help extract booking information from email and PDF text and identify places from Instagram captions, messages, available images and video frames, and speech. Relevant text, frames, images, and audio may be sent to OpenAI for this purpose. This can include names, reservation references, or other information present in the source. We also use AI to help structure planning notes.

Our Responses API requests are configured with response storage disabled. Audio transcription uses a separate API. These settings do not guarantee that a provider retains no operational or security records. Provider handling is governed by its applicable service terms and data policies. WhichWay does not use these submissions to train general-purpose AI models.

AI results can be incomplete or incorrect. Confirmation drafts are privately reviewed before being added to a customer’s trip. Instagram suggestions are inspiration, not verified reservations or automatically approved itinerary changes. Josh can access information needed for planning, support, identity confirmation, and review.

6. Service providers and other sharing

Our service uses Supabase for authentication and database storage, Vercel for website hosting and server processing, Cloudflare for Instagram webhook and queue processing, Google for the business mailbox and calendar, Meta for Instagram integration, and OpenAI for AI processing. Each provider receives the information necessary for its role and may process operational records under its applicable terms.

For booking help you request, relevant traveler and trip details may be shared with travel suppliers as agreed with you. Your customer dashboard is private to the account with access and WhichWay’s authorized administration. Contributors’ shared submissions can be visible to the customer whose collection receives them. We may also disclose information when necessary to comply with law, protect rights or safety, or investigate misuse.

7. Cookies and information on your device

You can use an Instagram wishlist without an account. We ask for a display name and provide a private, unguessable link. Anyone with that link can view and organize that sender’s saved finds, so keep it private. The link does not grant access to trips or bookings. If you choose to create an account, we use a temporary cookie to carry the collection into your verified account, including notes and favorites. Signup does not automatically subscribe you to marketing emails.

We use authentication cookies and browser storage to keep you signed in and support the service. If you choose to save an itinerary for offline use, a copy is stored in that browser on that device for the period shown in the offline reader. Use your own device. You can remove the copy through the reader or clear the site’s browser storage. A server-side deletion request cannot reliably remove a copy from an offline device.

8. Retention and security

Your profile, trip records, communications, and inspiration collection may be retained while needed to provide ongoing planning, preserve your across-trip collection, and handle support, security, accounting, or legal obligations. You can request deletion of an individual submission, the Instagram collection, trip information, or your account. We do not promise a single automatic expiry period for all records.

After a verified request, we remove eligible information from active records and explain any information that must be retained and why. Mailbox copies, provider logs, backup copies, and copies on devices require separate consideration and may remain subject to provider retention or required recordkeeping. We do not promise immediate removal from every backup.

We use access controls, encrypted connections, and protected service credentials. No storage or transmission method is completely secure.

9. Your choices and requests

You can ask to access or correct your information, stop future Instagram routing, remove submissions, or delete your account and eligible associated records. Depending on where you live, you may have additional rights to restrict or object to processing or receive a copy of your information. We assess requests under applicable requirements and may verify your identity before acting.

See data-deletion instructions or contact hello@askwhichway.com. Stopping an integration does not by itself remove information already stored.

10. Children, external links, and changes

The account and planning service is intended for adult trip planners. Parents or guardians may provide limited details about children traveling with them when needed for the trip. Contact us if a child has supplied account information so we can review and remove it where appropriate.

Links to Instagram, maps, booking providers, and other websites take you to independently operated services. Their privacy practices are governed by their policies. We will update this policy when our practices change and provide notice where required.