Trust, Security & Privacy

VPO Travel runs on Lovable Cloud infrastructure. Lovable provides the underlying hosting, managed database, authentication, and platform-level security controls. The VPO Travel team is responsible for the application code, the data we choose to collect, how that data is displayed, and how we communicate with our community.

Statements on this page describe controls that are currently enabled in the application — they are not certifications and do not constitute legal or regulatory compliance claims.

• Administrative dashboards require email sign-in and a server-validated admin role.
• Role checks run server-side; the client cannot grant itself elevated access.
• Sessions are managed by the platform auth layer and signed bearer tokens.

• We collect the first name, email, and chosen destination of visitors who voluntarily complete the wheel form, plus the campaign or creator they arrived through.
• Creator applicants submit name, email, country, language, social handle, audience size, and motivation. This data is only accessible to admin reviewers.
• The public activity feed displays only an initial (e.g. "L.") plus country and event type — never full first names, emails, or contact data.
• We do not sell personal data. Lead data is used to deliver the membership offer and creator attribution analytics.

The platform relies on Lovable Cloud (hosting, database, authentication). The VPO Travel team will update this section as additional subprocessors (analytics, email, payment) are introduced.

Lead and creator-application records are retained as long as the membership offer and applicant review remain relevant. To request deletion of your data, contact us using the address below and include the email address you submitted.

To report a security concern, vulnerability, or privacy request, email support@vpotravel.com. We aim to acknowledge security reports within 5 business days.