Privacy Policy

• Account data — when you create an account we collect your email address and a securely hashed password. We never store your password in plain text.
• Authentication data — login timestamps, session tokens, and IP addresses recorded automatically by Supabase when you sign in. This data is used to secure your account and detect abuse.
• Contact data — name, email address, and message when you submit our contact form. Stored securely in our database and used only to respond to your enquiry.
• Usage data — Vercel Analytics collects anonymised page views, referrer URLs, browser type, and country-level location. This data does not personally identify you.
• Local preferences — ratings and saved favourites are stored in your browser's localStorage only. This data never leaves your device.

• Respond to your enquiries and support requests
• Understand how visitors use our site to improve content and performance
• Comply with legal obligations where required

If you are in the European Economic Area (EEA) or United Kingdom, we process personal data under the following legal bases:

• Contract (Art. 6(1)(b) GDPR) — to create and manage your account and provide the services you have requested.
• Legitimate interests (Art. 6(1)(f) GDPR) — to respond to contact form submissions, secure our platform, and improve our website.
• Consent (Art. 6(1)(a) GDPR) — where you have accepted analytics or optional cookies via our consent banner.
• Legal obligation (Art. 6(1)(c) GDPR) — where processing is required to comply with applicable law.

We use Vercel Analytics to measure site traffic. It is privacy-focused and does not use third-party tracking cookies or build personal profiles. See the Vercel Analytics Privacy Policy for details.

We use localStorage (not cookies) to save your in-app preferences. You can clear this data at any time via your browser's site data settings.

Some pages contain affiliate links. Clicking them may place cookies from those retailers on your device, subject to their own privacy policies. These cookies are only set when you click — not on page load.

We do not sell or trade your personal information. Data may be processed by:

• Vercel — hosting and privacy-focused analytics.
• Supabase — cloud database and authentication provider. Stores account credentials, session tokens, and contact form submissions. Data is encrypted at rest and in transit. See supabase.com/privacy.
• Zoho Mail — email communications related to your enquiry.

We do not share your data with third parties for marketing purposes.

• Account data — retained for as long as your account is active. You may request deletion at any time by emailing contact@pickngotravel.com or by deleting your account from your profile settings. We will permanently delete your data within 30 days.
• Contact form submissions — retained for up to 12 months from the date of submission, then permanently deleted unless required by law.
• Analytics data — anonymised and governed by Vercel's own retention policy.

Depending on your location, you may have the right to:

• Access, correct, or request deletion of your personal data
• Delete your account — email contact@pickngotravel.com and we will permanently remove your account and associated data within 30 days
• Object to or restrict processing of your data
• Request a portable copy of your data (data portability)
• Withdraw consent at any time (where consent is the legal basis)
• Clear locally stored preferences via your browser settings
• Lodge a complaint with your local supervisory authority — for EEA residents, your national data protection authority; for UK residents, the ICO at ico.org.uk

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you additional rights:

• Right to Know — you may request information about the personal data we collect, use, and disclose.
• Right to Delete — you may request deletion of personal information we have collected from you.
• Right to Opt-Out of Sale — we do not sell your personal information to third parties.
• Right to Non-Discrimination — we will not discriminate against you for exercising your CCPA rights.

To submit a CCPA request, contact us at contact@pickngotravel.com.

We use industry-standard practices including encrypted data transmission (HTTPS) and encrypted database storage. No system is 100% secure; we cannot guarantee absolute security of your data.

Our site is not directed at children under 13 and we do not knowingly collect personal data from minors. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

Our site contains affiliate and reference links to external websites. We are not responsible for the privacy practices or content of those sites. Please review their policies before sharing personal information.

We may update this Policy periodically. The “Updated” date at the top of this page will reflect any changes. Continued use of the site after updates constitutes your acceptance of the revised Policy.

For privacy-related questions: contact@pickngotravel.com