Privacy

What we ask for, and why

Only what we need to answer you, to run a booking and to keep your trips on one page.

• When you send an enquiry or a question: your name and email, a phone number if you give one, the details of the trip (dates, travellers, interests, a budget range) and your message. We use them to answer you and to plan the trip, and for nothing else.
• When you book a day trip online: the same, plus the date and the number of travellers. Your seats are held for 30 minutes while you pay. If you do not pay, the hold ends and the seats go back on sale.
• When you make an account: your name, your email and a password. The password is stored only as a salted scrypt hash, so nobody here can read it. If you turn on two-factor sign-in we also keep the secret that makes the codes, sealed with a key that is not in the database, and a set of backup codes stored only as hashes.
• When you pay: on this demonstration, a test card: the card brand and the last four digits of a published test card, and a receipt number. A real card number is refused and never stored. When the client connects a payment provider, card details go to the provider's own fields and never touch this site; we keep the provider's reference for the payment, the amount, the date and the receipt.
• When you write a review: your rating, what you wrote and the name you chose to show (for example a first name and a city). Nothing is published until the studio has read it.
• When you join the mailing list: your email address, the time you confirmed it, and where you signed up.
• When you use the site: the pages you open are not tracked. If you arrive through a campaign link, the campaign tags on the address and the site that sent you are kept for that visit in your browser and attached to an enquiry or booking if you make one, so the studio can see which channels bring bookings.

What is kept on your device

Two cookies, and a few small notes in your browser. There are no analytics, no advertising and no third-party scripts: the typefaces, photographs and maps are all served from this site.

• Cookie lt_session: set only when you sign in, so we know it is you. It is httpOnly (scripts cannot read it) and SameSite=Lax, lasts 30 days, and is removed when you sign out. Each sign-in is also a row in your account's list of devices, with a browser and system label and the time it was last used, so you can end any of them.
• Cookie lt_2fa: set for a few minutes between a correct password and the second step, only for people who have two-factor sign-in on.
• Session storage (gone when you close the tab): your unfinished plan form, the campaign tags described above, whether you closed the notice at the top of the page (lt-notice), and flags that remember whether the opening animation and the 3D terraces have already run.
• Local storage (stays until you clear it): the currency you chose (lt-currency), your shortlist of saved trips if you are not signed in (lt-saved), the things you ticked on a trip's pack list (lt-pack, one note per trip), whether you turned the ambient sound on (lt-sound), and whether you chose the normal pointer instead of the soft ring (lt-cursor).
• Cache storage: only if you press “Keep this trip offline” on a trip page of yours. It holds a copy of that one page so you can read it with no signal in the highlands, and it is cleared when you sign out.

Who else receives it

This demonstration runs without any outside service connected, so your details stay in the database it is running on. Each service below is switched on only when the client adds its key. When it is on, it receives only what it needs:

• A database host (Neon): everything described above, stored encrypted at rest on the provider's servers.
• An email service (Resend): your address and the text of the emails we send you.
• A card payment provider (Stripe): the amount, the booking reference and what the provider's own form collects. We never see a card number.
• A shared rate limiter (Upstash): a short-lived counter per network address and per email, so that sign-in and forms cannot be hammered. It stores no content.
• An error alert (a webhook the client chooses): the text of an error, the page it happened on and a reference. No names, emails or message text are sent.
• A weather source (Open-Meteo): our server asks it for the island's weather once in a while and shows the result. Your browser never contacts it.

Emails

We always email you about what you do here: a confirmation of an enquiry or booking, a receipt for a payment, a quote and the notes that go with it, reminders of a balance and of the days before your trip, security notices about your account, and a reply when someone writes to you. You cannot unsubscribe from those while you have something with us, because they are the booking itself.

Everything else is marketing, and goes only to people who said yes: the mailing list (confirmed by email, with a welcome and then occasional letters), a ticked box on an enquiry or an account (a note about the trip after you come home, and if you went quiet, a gentle one or two). Every marketing email has an unsubscribe link that works without signing in, and once you unsubscribe the address is kept on a suppression list so it is never written to again by mistake.

How long we keep it

An enquiry with no payment on it is deleted 24 months after the last message about it (the client may choose a different period). Anything with a payment on it is kept as the accounting record it is, for as long as the client's accountant says the law requires. Sessions you ended and sessions that expired are cleared within a month. A published review stays until you ask for it to be taken down. The activity log the studio keeps of its own changes (who edited a price, who issued a refund) holds staff names, not travellers' details beyond a reference.

Your rights: download it, correct it, delete it

You may ask what we hold about you, ask us to correct it, and ask us to delete it. Which laws apply is for the client's lawyers to confirm: for example Indonesia's Personal Data Protection Law (Law No. 27 of 2022, fully in force since 17 October 2024), and the GDPR for guests who live in the European Union.

You do not need to write to us to do most of it. From My trips you can download everything we hold about your account as a single file, change your name and email, switch marketing off, and see and end every device that is signed in. Deleting your account removes it, your saved trips and every enquiry that has no payment on it. An enquiry that has a payment on it cannot be erased, because it is an accounting record; it is kept without the link to your account and nothing else is added to it. For an enquiry you sent as a guest, or a mailing-list address, write to us and we will delete it or remove you.

Children

We ask how many children are travelling, as a number. We do not ask for any detail about a child. Accounts are for adults.

Who we are

LuxeTide is a fictional company made for a design showcase, so there is no real controller of this data and no real address to write to. These are the words a real operator would start from.