Privacy Policy

1. Information we collect

We collect the following categories of personal information.

Account information from your sign-in provider.

When you create an account we receive your email address, first and last name (if provided), and profile photo (if provided) from our authentication partner Clerk. If you sign in with Google or another OAuth provider, Clerk receives the same information from that provider on your behalf, plus the provider's unique identifier for you.

Trip planning information you give us.

When you fill out your trip profile we store your answers (origin city, travel dates, trip length, budget tier, flight tolerance, trip vibes, priorities, weather preference, pace, and any optional practical limits you note). If you invite other people to plan a group trip we store the email addresses you enter so we can send them an invitation.

Tickets you add to a trip.

After booking an activity with one of our partners you can attach the ticket to your trip: the ticket file (a PDF or an image), an optional booking reference, and the date on the ticket. A ticket file may contain the traveler's name and an entry code, so we keep it in a private storage bucket and open it only through short-lived links for people who are part of that trip. In a group trip every member who has joined can see and open the tickets attached to it; the person who added a ticket can remove it at any time.

Communications you initiate.

If you contact us by email, fill in a "Contact us" form, or sign up for our waitlist we keep a record of that contact (your email, the source of the request, and any tags we apply to route your message internally). When you write to us through the form at the bottom of our pages we also log the date, the topic you picked, your email address, the page you sent it from and its language.

Technical information collected automatically.

When you load a page we receive your IP address, browser type, operating system, referring URL, and timestamps. We use cookies and similar technologies described in our Cookie Policy to keep you signed in, measure how the Service is used, and detect errors. If you accept statistics cookies, we may also record how you interact with our pages (session replay) to find usability problems; text you type into form fields is masked.

2. How we use your information

• Provide the Service — match your trip profile to a destination, deliver group recommendations, generate share links and preview images.
• Communicate with you — send transactional emails such as group invitations, sign-in magic links, and important Service notices.
• Send marketing email — only if you opted in to our waitlist or marketing newsletter. You can unsubscribe at any time from any marketing email we send.
• Improve and secure the Service — measure feature use, review session replays, debug errors, prevent fraud and abuse, and develop new features.
• Comply with legal obligations — respond to lawful requests from regulators or law enforcement.

3. How we share your information

We do not sell your personal information. We share it only with the categories of recipients below, each of whom processes the information on our behalf under a written agreement.

• Authentication — Clerk Inc. hosts your account and session information.
• Database & file storage — Supabase (Postgres hosted on AWS in the United States) stores trip data, trip profile answers, recommendations, account profiles, and the ticket files you add to a trip.
• Recommendation engine — OpenAI processes your trip profile answers in order to generate destination recommendations. We send only the structured answers and a curated shortlist of destinations; we do not send your name, email, or any direct identifier to OpenAI.
• Transactional email — Resend delivers group-invite emails, sign-in links, and similar service-critical messages.
• Contact form — Resend delivers the messages you send through the form at the bottom of our pages to our team inbox, and Google Sheets (Google Workspace) keeps the log of them described above. The text of your message stays in the inbox and is not copied to the log.
• Marketing email — Mailchimp stores marketing subscriber lists and sends the waitlist and newsletter emails you opted in to.
• Product analytics — Google Tag Manager and Google Analytics 4 measure aggregate usage of the Service. PostHog records product events and session replays, together with the identifier of your trip profile so we can connect them to the trips you plan, only after you accept statistics cookies; if you are signed in, it also links them to your account identifier, email address, and name. PostHog also receives technical details of our requests to OpenAI (model, token counts, response time), never the content of your trip profile.
• Error monitoring — Sentry receives error reports including the URL of the page where the error happened, browser type, and any redacted user identifier we attach for debugging.
• Hosting & CDN — Vercel hosts the website and serves it through its global edge network.
• Maps & geocoding — Mapbox resolves the city names you enter in your trip profile into coordinates.
• Legal & corporate transactions — we may disclose information when required by law, a court order, or in connection with a merger, acquisition, or financing transaction.

4. Where your data is stored

Our primary database is hosted in the United States (AWS us-east-1 region via Supabase). Some of our service providers (notably Clerk, Mailchimp, Sentry, Resend, Vercel, Google, Mapbox, OpenAI, PostHog) may process information in the United States and other jurisdictions where they operate. If you access the Service from outside the United States you understand and agree that your information will be transferred to and processed in the United States.

5. How long we keep your information

We retain your account information and trip data for as long as your account is active. If you delete your account we delete the associated profile, trip plans, trip profile answers, and recommendations within 30 days, except for the minimum we are required to retain by law (for example, financial records). You can delete your account at any time from Account settings.

Ticket files are kept for 30 days after the date on the ticket. If you did not enter a date, we count 30 days from the end of the trip, or about a year from when the trip was created if the trip has no dates yet. A file is never removed sooner than 30 days after it was uploaded. After that the file itself is deleted automatically, while the booking record (activity, partner, reference) stays with the trip. Removing a ticket, deleting a trip, or deleting your account removes the corresponding files as well.

Messages you send us, and their log entries, are kept for as long as we need them to reply and follow up. Ask us at any time and we will delete them.

6. Your rights

Depending on where you live you may have the following rights with respect to your personal information:

• Access — ask us for a copy of the personal information we hold about you.
• Correction — ask us to fix information that is inaccurate or out of date.
• Deletion — ask us to delete personal information we hold about you.
• Portability — ask us to export your information in a machine-readable format.
• Objection — object to the processing of your information for marketing or other purposes.
• Withdraw consent — withdraw any consent you have given (this does not affect processing already carried out under that consent).

To exercise any of these rights email us at hello@rendezvous.global. We will respond within the timeframes required by applicable law. If you are in the European Economic Area, the United Kingdom, or California, you also have the right to lodge a complaint with your local data protection authority.

7. Children's privacy

The Service is not directed to children under 16. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, please contact us and we will delete it.

8. Security

We use industry-standard administrative, technical, and physical safeguards to protect personal information from unauthorised access, alteration, disclosure, or destruction. No method of transmission over the internet or storage system is completely secure, and we cannot guarantee absolute security.

9. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes we will update the "Last updated" date at the top and, where required, notify you by email or in the Service before the change takes effect.

10. Contact us

Questions, requests, or complaints about this Privacy Policy can be sent to hello@rendezvous.global.