What we collect

Depending on the features you use, we may handle the information below.

• Account and profile: email address, sign-in method (email code or Google account), nickname, name, optional gender and location, optional short bio, and your language, currency and time-zone preferences.
• Inquiries and bookings: traveler names, contact phone, party size, preferred departure date, any notes you send us, plus order status, amounts and payment results.
• Payments: payments are processed by a third-party payment provider. We do not store full card numbers or payment passwords, only the payment identifiers and status we need for reconciliation.
• Support: the questions you send through the support chat, the journey or order they relate to, and the replies. When you use the AI assistant, your question and the related public journey material are sent to a model provider to select answer sources, generate an answer and review it in a separate model call.
• Email: your subscription state, unsubscribe records and delivery results, for example whether a message was delivered or bounced.
• Usage and statistics: the pages you view, the referring source, device and browser type, and the country or region resolved from your IP address. The analytics service does not use cookies and separates visits with an anonymous session identifier; the same lookup selects your default currency.
• Server logs: for security and troubleshooting we record request time, path, status code and the IP address the request came from.
• Local storage: the cookies that keep you signed in, plus preferences such as language, currency, time zone, waitlist entries and saved items.

How we use it

We use this information only for the purposes below:

• running the service: sign-in, your profile, and showing journeys and photographers;
• managing bookings: quotes, deposits and balances, orders, departure arrangements and reminders;
• support: answering inquiries and handling changes or refunds, including AI-assisted answers and human follow-up;
• email: sending subscription and journey messages after you opt in;
• security and compliance: spotting abnormal requests, preventing abuse, and meeting accounting and legal duties;
• improving the product: understanding feature usage in aggregate so we can improve content and experience.

We do not use this information for third-party advertising, and we do not sell personal information.

Who we share it with

We do not sell personal information. To run the service we share data only where necessary with the providers below, and require them to process it under contract and on a least-privilege basis:

• cloud hosting, database and identity providers (Supabase, Oracle Cloud Infrastructure);
• the payment provider (Airwallex) for taking and refunding payments;
• Twilio provides phone verification and important order SMS; Cloudflare Turnstile provides human verification and abuse prevention and may process device and network information. These services are used when the corresponding features are enabled;
• the email delivery provider (Resend) for contact verification, order access recovery, transactional notices, opted-in marketing messages, and unsubscribe and bounce handling;
• the AI model provider (DeepSeek), only when you use the AI assistant, to select answer sources, generate an answer and review it in a separate model call;
• disclosures required by law or necessary to protect our rights and those of others, for example a lawful request from an authority.

Some of these providers are outside your country or region. Our contracts, access control and least-privilege rules limit what they can do with the data.

How long we keep it

• account details: kept while your account is open, then deleted or anonymized;
• orders and payment records: kept longer to meet reconciliation, tax and accounting rules;
• support and email records: kept for the period needed for after-sales care and disputes;
• analytics and server logs: rotated on an operational schedule for security, performance and troubleshooting.

After these periods we delete or anonymize the data.

How we protect it

We use HTTPS, access controls and permissions limited to what each role needs. Only authorized staff can access the administration tools. Credentials are stored securely and kept out of the code repository. Please keep your sign-in credentials safe. No system can guarantee complete security. If a security incident could affect your rights, we will notify you as required by law and take steps to address it.

Your choices and rights

You can:

• view and correct your profile on the profile page;
• ask for a copy of your data, ask us to delete it, or ask us to restrict processing, except where we must keep it by law or contract;
• withdraw your email consent at any time or use the unsubscribe link in any message, without affecting processing that already happened;
• skip the AI assistant: if you do not submit a question, nothing is sent to the model provider;
• clear local storage and cookies in your browser, which may sign you out and reset preferences.

Send requests through the support chat. To protect your account we may first confirm who you are, and we reply within a reasonable period.

Children

The website is intended for adults. Anyone under 18 should use it with a guardian's consent and supervision. We do not knowingly collect children's personal information; if we learn we hold it, we delete it promptly.

Changes to this policy

We may update this policy. The current version is always published on this page with its date; if a change materially affects your rights we will highlight it on the site and, where appropriate, tell you by email.

Contact us

If you have a question about this policy or how we handle personal information, contact us through the support chat: Contact support