Effective November 10, 2026 · Travelspan Amrals Manager
Travelspan Amrals Manager is an internal application used to organize customer-service activity for participating Travelspan and Amrals social-media Pages. We believe that people asking a travel question should be able to understand what information we receive, how we handle it, and how to ask us to remove it. This notice describes our current practices, not merely what the application may do in the future.
1. Who is responsible and what this notice covers
The application is administered by Travelspan Vacations, 108-09 Liberty Avenue, South Richmond Hill, New York 11419, United States, for authorized staff supporting Travelspan New York and Amrals Travel. Travelspan Guyana is a participating business in the wider project, but its Page is not currently connected to the live comment inbox. Each travel business is responsible for its own customer-service interactions.
This notice covers information the application receives from authorized Facebook Page integrations, information used to administer the private staff dashboard, and limited information associated with visits to this app-information website. It does not replace the privacy terms that apply when you book flights, hotels, tours or other travel services through our separate business websites or offices.
2. Information received through Meta
For Pages that have authorized the integration, Meta may send us notifications when someone adds a public Facebook comment. The application may process or store the following information:
- Customer comment information: the text of a public comment (up to 4,000 characters), its comment ID, the related post ID, the Page ID, the associated travel business, and comment and receipt timestamps.
- Information processed briefly: an event may contain a sender or profile identifier, which can be checked to distinguish customer comments from comments made by the Page itself. The current comment inbox does not intentionally save the person's profile name or Facebook user ID.
- Technical delivery records: the application creates a cryptographic fingerprint from certain received events to recognize duplicates, along with the Page or asset ID, platform, event category (such as comment or message), and receipt time. A fingerprint is not readable comment text, but it is still treated as information requiring appropriate protection.
Signed webhook notifications may include additional fields supplied by Meta. The application processes these transiently to check authorization, select the supported event type and create limited technical records; it does not retain full webhook payloads as customer profiles. The current customer-comment inbox is designed for public Facebook Page comments, not for storing private Messenger or Instagram conversation text.
Public comments can nevertheless include information people voluntarily disclose, such as names, email addresses, travel details or other sensitive information. Please avoid sharing passport details, payment information, health information or other sensitive data in public comments.
3. Staff accounts, application records and website visits
For authorized employees and administrators, we process work email addresses, password verification records, multi-factor authentication configuration, session information, test or review drafts, account activity, and security audit records. Passwords are stored using one-way verification methods rather than in readable form, and the authenticator secret is encrypted.
The public website at apps.travelspan.com provides information about this application. It does not currently use advertising pixels, third-party analytics scripts, contact forms or optional tracking cookies. The private staff dashboard uses essential, security-protected session cookies to keep authorized personnel signed in. Hosting and security infrastructure may independently produce routine technical access logs, which can include IP address, browser or device information, request times, URL paths and error or response details.
4. Why we process information
We use information for the following limited purposes:
- To identify the relevant travel business and public post, and present inquiries to authorized staff for customer-service follow-up.
- To prepare, review and manage internal response drafts and avoid handling the same event repeatedly.
- To authenticate staff, secure access to the management dashboard, troubleshoot technical problems and maintain accountability records.
- To comply with applicable legal obligations or respond to valid requests concerning security, privacy and our services.
Where applicable law requires a legal basis for processing, the relevant basis depends on the interaction and may include our legitimate interests in providing customer service and securing the application, complying with a legal obligation, or another lawful basis available in the circumstances.
5. What the application does not currently do
The present application does not automatically publish Facebook or Instagram replies, like comments, initiate private messages, or send customer comment text to an external generative-AI model for automated response drafting. Instagram integration, dedicated paid-ad comment attribution and reply workflows, AI-assisted drafts, customer messaging and travel-offer matching are potential future capabilities, not live features described as operating today. If those capabilities become operational and change our processing, we will update this notice before or when implementing them as required.
We do not sell information received through the application. We do not use Meta Platform Data collected by this application to build advertising profiles or deliver targeted advertising to individuals.
6. Who may receive the information
- Authorized staff and participating businesses: personnel assigned to administer the application or manage the relevant customer-service inquiry, subject to access controls.
- Infrastructure providers: Railway and its underlying service providers, which host the application and its PostgreSQL database and may process limited technical information necessary to run, secure, back up and maintain the service.
- Meta: Facebook and Instagram continue to handle information on their own platforms under their own terms and privacy practices. Any future authorized interaction through Meta APIs would be subject to Meta's platform requirements.
- Legal and safety purposes: appropriate recipients if disclosure is required by applicable law, a valid legal process, or is reasonably necessary to protect the security of the service and the rights of others.
We do not give access to customer comments to unrelated data brokers. Service providers may only handle information for service operation and related authorized purposes, subject to applicable contractual and legal requirements.
7. Security safeguards
We apply security controls appropriate to the current application, including HTTPS transport, a restricted internal dashboard, password and multi-factor authentication, limited administrator access, verification of Meta webhook signatures, protected application secrets, and encryption of stored customer comment text. We review operational security as the application evolves. No online service or storage method is completely risk-free.
For a possible security vulnerability or misuse of information, contact us using the privacy email addresses in Section 12 and include Security concern — Travelspan Amrals Manager in the subject line. Please do not transmit sensitive credentials or customer information in an initial report.
8. How long we keep information
- Facebook comment records: the encrypted comment text and associated Page, post and comment identifiers are scheduled to be deleted from the active application database after 30 days from receipt. Cleanup runs periodically; a record may remain for a short additional processing interval before removal.
- Technical Meta event receipts: limited metadata and hashed event fingerprints used for deduplication and troubleshooting are scheduled to be deleted from the active database after 90 days.
- Staff accounts, sessions, drafts and audit records: staff sessions expire after a defined period; account, test-draft and audit information is retained as needed for access administration, support, security or compliance and removed when no longer needed. These records are not covered by the 30-day comment rule.
- Hosting logs and backups: service-provider logging and backup systems may have separate retention and restoration cycles. Deletion from the live application does not necessarily erase every residual backup copy immediately.
We will also delete applicable personal information earlier when it is no longer needed, a valid deletion request applies, or Meta or applicable law requires it, subject to any lawful retention obligation.
9. Your privacy choices and rights
Anyone whose information may have been processed through the application, regardless of country of residence, may contact us to request access to, correction of, or deletion of their information. Depending on applicable law, other rights may include objection, restriction, or information about how personal information is used. We will consider requests under the laws that apply and the information we actually hold. Where applicable, you may also raise a privacy concern with your local data-protection regulator if you believe your rights have not been respected.
For an actionable deletion request, please follow the Data Deletion Instructions. You do not need to register for an account on this website, sign in with Facebook, or pay a fee to submit a request. To find a specific comment, we may need the Page name, approximate date, and the comment link or ID, if available. We will not ask for a Facebook password, passport scan or payment card information.
Deleting a record from this application does not automatically delete the original comment from Facebook or Instagram. You may separately use Meta's platform controls to edit or remove your content there. If you wish to change information in a travel reservation, contact the travel business through its normal customer-service channels.
10. International operations
Our participating travel businesses and support teams operate in the United States, Trinidad and Tobago, and Guyana. Application information may be accessible to authorized staff in those locations and processed or stored in countries where our hosting providers operate. Privacy and data-protection laws may differ between locations. We seek to apply appropriate safeguards and handle cross-border access in accordance with applicable requirements.
11. Children and changes to this notice
The application is intended for travel-business customer service, not to solicit information from children. If a parent or guardian believes that a child's information has been collected through the application, they can contact us using the request process above.
We may revise this policy when our application capabilities, service providers or legal requirements change. The effective date will be updated when revisions are posted. Material changes affecting the use of Meta-supplied information will be reflected in this policy before implementation where required.
12. Contact and responsible business
Travelspan Vacations
108-09 Liberty Avenue, South Richmond Hill, NY 11419, United States
Customer Support: customerservice@travelspan.com
Telephone: +1 (718) 845-0437
Amrals Travel
Customer Support: support@amralstravel.com
For a faster referral, include Travelspan Amrals Manager — Privacy Request and identify the business Page you contacted. Please use our deletion request instructions if you want information removed.