Privacy Policy

Booking information. When you book a trek: your name, preferred name, email, phone number, and city/state/country. We also record whether you checked the marketing-consent box on the booking form — a separate, explicit choice from the booking itself.

Payment information. We never receive or store your card number. Stripe, our payment processor, handles that entirely — see "Third-Party Service Providers" below.

Contact form. Your name, email, the category of your message, and the message itself.

Newsletter signup. Your email address. Signing up for the newsletter is itself your consent to receive it — there's no separate checkbox for this specific form.

Waitlist signup. Your name, email, phone number, and (separately from joining the waitlist) whether you opted into marketing emails.

Analytics.

Draft note — needs a real decision: As of this draft, TCT has not yet activated Google Analytics (GA4) in production — see docs/GOOGLE_SETUP.md. Once it is, this section should be updated to confirm it is live and describe what's tracked (see Section 6, "Cookies and Analytics").

• To create and manage your booking, and to process payment through Stripe.
• To communicate with you about your trip — confirmations, packing lists, pre-trip logistics, balance-payment reminders, and trip updates.
• To respond to questions submitted through the contact form.
• To notify you when a spot opens on a trek you've waitlisted for.
• To send marketing email (newsletter, trip announcements) — only to people who signed up for the newsletter directly, or who explicitly checked the marketing-consent box on a booking or waitlist form.
• To improve the website, once analytics are active (see Section 1).

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes.

We use the following services to run TCT's booking, communication, and website:

• Supabase — hosts our database (bookings, customer records, contact/waitlist/newsletter submissions) and manages secure admin login. Supabase stores this data on its own infrastructure.
• Stripe — processes all payments. Your card details go directly to Stripe; TCT never receives or stores them.
• Brevo — sends transactional email (booking confirmations, balance reminders, contact-form acknowledgments) and, if you opted in, marketing email (our newsletter).
• Google Analytics (GA4) — website analytics, described in Section 1 and Section 6.

  Draft note — needs a real decision: Not yet active as of this draft.

Draft note — needs a real decision: TCT has not yet decided a specific retention period for booking, customer, contact, or marketing-lead records. A common approach is to retain booking/customer records for a set number of years after a trip for tax/business-records purposes, and to retain contact-form/newsletter-lead records until someone unsubscribes or requests deletion — but this needs to be Katie's actual decision, not an assumed default.

We only send marketing email to people who've affirmatively opted in: by signing up for the newsletter directly, or by checking the separate marketing-consent checkbox on the booking or waitlist form. Booking a trek or joining a waitlist does not, on its own, sign you up for marketing email. Transactional email about your own booking (confirmations, reminders) is sent regardless of marketing consent, since it's about a trip you've already booked, not marketing.

You can unsubscribe from marketing email at any time using the link in any marketing email, or by emailing hello@triplecrowntreks.com.

TCT does not currently show a cookie-consent banner.

Draft note — needs a real decision: This is a deliberate choice made during development, based on TCT not currently targeting EU/UK audiences and not running advertising campaigns that would require one. If that changes — EU/UK marketing, paid ad campaigns using tracking pixels — this needs to be revisited with counsel, since it may then be legally required.

Once Google Analytics is active, it will use cookies to distinguish visitors and measure site usage, as described in Section 1.

Payment data never touches TCT's systems — Stripe handles it under its own PCI- compliant infrastructure. Our database (Supabase) uses row-level security so that customer and booking data is only accessible to authenticated TCT administrators, never to the public. The site is served entirely over HTTPS.

You can ask us what personal information we hold about you, ask us to correct it, or ask us to delete it, by emailing hello@triplecrowntreks.com.

Draft note — needs a real decision: If TCT ever markets to residents of jurisdictions with specific statutory rights (California/CCPA, EU/UK/GDPR, etc.), this section needs jurisdiction-specific language from counsel — not included here since TCT's actual customer base and marketing footprint should drive that decision, not a generic template.

Draft note — needs a real decision: TCT trips are not marketed to or designed for children traveling independently, but the actual minimum-age policy for booking is undecided — see Section 2 of docs/LEGAL_CONTENT_REQUIREMENTS.md "Terms inputs needed" (Eligibility). This section should state that policy explicitly once decided.

We may update this policy as TCT's tools or practices change. Material changes will be reflected with an updated effective date.

Draft note — needs a real decision: Effective date to be set when this is actually approved and published.

Questions about this policy or your data: hello@triplecrowntreks.com.