Privacy Policy
Last updated 8 November 2026
Kova helps groups plan trips together. To do that, we hold some of your personal information, and some of it is shared with the people you travel with. This policy explains what we collect, why, who helps us process it, and the choices you have.
This policy covers the website at travelkova.com, the Kova web app at app.travelkova.com, and the Kova mobile apps when they launch (together, “Kova”). Kova is operated by Mesani Group (Pty) Ltd, its parent company; “we”, “us” and “our” mean Mesani Group (Pty) Ltd. If you have questions, email hello@mesani-group.com.
1. This website
travelkova.com is a static marketing site. It has no forms and sets no cookies.
- Analytics. We use Vercel Web Analytics to count page views. It does not use cookies, and it identifies visits using a hash that changes daily and cannot be used to track you across sites or days.
- Fonts. Our typefaces load from Google Fonts, so your browser connects to Google’s servers, which see your IP address. See Google’s privacy policy.
- Hosting. Our host, Vercel, processes standard request data (such as IP address and browser type) to deliver and secure the site.
Because we don’t use cookies or cross-site tracking here, you won’t see a cookie banner.
2. Information you give us in the app
Your account
- Email address and password (passwords are stored hashed by our authentication provider, never in plain text).
- If you sign in with Google: your name, email address and profile picture from your Google account.
- Profile details: display name, avatar colour or photo, default currency.
Traveller details (optional)
You can choose to save details that help with bookings and border paperwork: date of birth, gender, nationality, passport type and passport expiry date, phone number, address, emergency contact, and medical notes. We do not store passport numbers.
Medical notes are sensitive. Only add them if you’re comfortable doing so; you can edit or remove them at any time.
Trips
- Destinations, dates, budgets, activities and votes, expenses (who paid and how it’s split), bookings, reminders and notes.
- Booking confirmations you forward to your Kova inbox address, and documents or images you upload, so we can read out flights, stays and reservations.
- Email addresses of people you invite or add as friends.
3. Who can see your information
Kova is built for sharing within a trip. Members of a trip can see that trip’s plans, bookings, expenses and balances, and each other’s names and avatars. Trip members can also see your emergency contact so the crew can reach someone if something goes wrong. Your other traveller details stay private to you.
Access is enforced in our database with row-level security, so a trip’s data is only returned to people on that trip.
4. How we use your information
- To run Kova: create your account, sync trips across your crew, calculate who owes whom, and show reminders.
- To read bookings you forward or upload, and to provide travel checks such as visa guidance, arrival-declaration windows and flight status.
- To send emails you ask for, such as trip invitations and password resets.
- To keep Kova secure, prevent abuse and fix problems.
- To understand who uses Kova: if you choose to give your gender, we use it in aggregate (never individually) for demographic insights that shape our product and marketing.
We do not sell your personal information or use it for targeted advertising.
We rely on our contract with you to provide the service, your consent for optional and sensitive details, and our legitimate interest in keeping Kova secure and working well.
5. Service providers
We use trusted providers to run Kova. They process data only on our instructions and only for the purposes below.
| Provider | What they do | Data involved |
|---|---|---|
| Supabase | Database, sign-in, file storage, server functions | All account and trip data |
| Vercel | Hosts the website and web app | Request data (IP address, browser) |
| Optional “Sign in with Google”; website fonts | Sign-in details; IP address | |
| Anthropic (Claude) | Reads forwarded bookings and uploads; prepares visa and arrival-declaration guidance | Booking text and documents you send; nationality, passport type and destination |
| Resend | Sends and receives email (invites, forwarded bookings) | Email addresses and message content |
| RapidAPI visa data | Visa requirement lookups | Passport nationality and destination country |
| AirLabs | Live flight status | Flight numbers and dates |
| Unsplash | Destination photos on trip cards | Destination name |
| Photon (Komoot) | Place search as you type | Search text |
These providers may process data outside your country. Where that happens, we rely on their contractual and security commitments to protect it.
6. Storage on your device
The app keeps your sign-in session and an offline copy of your trips in your device or browser storage so it works quickly and offline. This is strictly necessary for the app to function and is not used for tracking. Signing out ends your session; clearing your browser or app data removes the local copy.
7. How long we keep it
We keep your information while your account is open. You can delete your account from your profile in the app; this removes your account and personal details from our active systems. Shared trip records that other members still rely on (for example, an expense you paid) may remain visible to them without your profile details. Residual copies in backups expire on our providers’ standard schedules.
8. Your rights
Depending on where you live (including under South Africa’s POPIA and the EU/UK GDPR), you can ask to:
- access the personal information we hold about you, or get a copy of it;
- correct or update it (most of it you can edit directly in the app);
- delete it (you can delete your account in the app);
- object to or restrict certain processing, or withdraw consent for optional details.
Email hello@mesani-group.com and we’ll respond within 30 days. You also have the right to complain to your data protection authority; in South Africa, that’s the Information Regulator.
9. Security
All traffic to Kova is encrypted with HTTPS. Data is protected by authentication and database-level access rules, and secret keys for our providers live only on our servers, never in the app. No system is perfectly secure, so please use a strong, unique password.
10. Children
Kova is not intended for children under 16, and we don’t knowingly collect their information. If you believe a child has given us personal information, contact us and we’ll delete it.
11. Changes
If we make material changes, we’ll update the date above and, where appropriate, let you know in the app or by email.