Privacy policy
Pilot version, effective 2026-09-07. Read the full text on request.
Who we are
Viabasis is a brand of Manapar LLC, 6614 Ave U, Unit #694, Brooklyn, NY 11234, United States ("we", "us"). Viabasis is a quote-to-profit and season-money workspace for group tour operators and travel advisors. Our privacy contact is support@viabasis.com. We reply within 1 business day. This policy is written in plain language. It is not legal advice.
What we collect, and why
- Account data — your email address, your name and your company name. We need these to create and run your account.
- Workspace content you bring — the source text of a quote, the facts the AI extracted and you reviewed, your trips, budgets, business rules, logo, obligations and calendar, your question-and-answer log and version history, the contact identities of supplier staff that appear in quotes, and supplier payment details taken from quote text and confirmed by you. We store it so the product can work for you.
- No traveler data. Viabasis has no passenger records. You agree not to enter traveler or client personal data during the pilot. If some slips in, we delete it on request.
- Usage telemetry — counts, durations and statuses only, so we can see where the product fails. Telemetry never contains quote content.
- AI spend ledger — a per-company record of AI usage and cost, so we can apply your quota.
- Support emails — when you write to us, we keep the thread.
- Payment status — if you take the founding offer, we see in Stripe's dashboard that you paid, with the name and email you gave Stripe. We never see or store your card number.
- Cookies — only strictly necessary cookies, to keep you signed in. No tracking cookies, no third-party analytics, no session replay, no advertising cookies.
We use this data to provide the service, to run and protect it, to answer you and to bill you. We send no marketing email unless you opt in later. We do not profile you, and we make no automated decision about you that has a legal or similarly significant effect.
AI processing
When you paste or upload a quote, the text goes to the Viabasis server and from there to Anthropic for AI extraction. When the app drafts questions for a supplier, it also sends Anthropic the relevant quote snippets, the facts you confirmed and your business-rule lines for that trip. You decide what to send to the supplier.
Under Anthropic's commercial API terms, your content is not used to train models, and Anthropic keeps it only briefly, under its own policy. Excel, Word and PowerPoint files are read inside your browser; their bytes never leave it. PDF and image bytes are sent to the AI provider so it can read them. Our API keys stay on the server and are never in your browser.
The AI extracts, you review, and a deterministic engine recomputes the numbers. The engine never calls a model. Outputs are drafts that need professional review.
Where your data lives
Your workspace is stored in a Postgres database at Supabase, region US East, with files and your logo in Supabase Storage. Every table uses row-level security, so one company can never read another company's rows. The app and server are hosted on Vercel. Resend sends sign-in and invite emails. Stripe handles payments.
Your data is stored in the United States. For transfers from the EEA, the UK and Brazil we use the transfer terms the law requires. We send them on request.
How long we keep data
The periods below are the proposed defaults for the pilot.
| What | How long (proposed) |
|---|---|
| Workspace content and account data | While your account is active; deleted within 30 days after you delete your account or ask us in writing |
| Extraction cache (so the same quote is not extracted twice) | 30 days |
| Telemetry, raw events | Up to 12 months |
| Telemetry, aggregated counts | Up to 24 months |
| AI spend ledger, anonymized totals | 13 months after account deletion |
| Support emails | 24 months after the last message |
| Database backups | Point-in-time backups per our Supabase plan; deleted data leaves backups at the end of the backup window |
Anthropic keeps content only briefly, under its own policy. Stripe keeps its own payment records as an independent controller; deleting your Viabasis account does not delete them.
Your rights
You can ask us to give you access to your data, correct it, export it as a JSON file (on request), delete it, restrict or object to a use based on legitimate interest, and withdraw a consent you gave. We make no automated decisions about you.
Email support@viabasis.com. We answer within 1 business day and complete the request within the period your law sets: one month under the GDPR and UK GDPR, 15 days under the LGPD, and otherwise within 30 days (proposed). We may ask you to confirm your identity. You can also complain to your supervisory authority.
If your details as supplier staff appear in a customer's quote, that customer is the controller of that data. Write to us and we will forward your request and help them answer it.
Contact
Manapar LLC, 6614 Ave U, Unit #694, Brooklyn, NY 11234, United States. Email support@viabasis.com. Governing law: Delaware.