Privacy Policy

Introduction

WingItGuide ("Company," "we," "us," "our," or "our business") operates a platform for activity booking and vendor management. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and services, including all related pages, features, and content (the "Service").

We are committed to protecting your privacy and ensuring you have a positive experience on our website. If you have any questions about our practices, please review the sections below or contact us using the information at the end of this policy.

Data We Collect

Information You Provide Directly

• Registration Data: First name, last name, email address, password, phone number
• Booking Information: Activity preferences, dates, special requirements, dietary restrictions
• Payment Information: Processed securely through our payment processor (we never store full card details)
• Profile Information: Avatar, bio, location, preferences
• Communication: Messages, reviews, ratings, feedback

Information Collected Automatically

• Device Information: Browser type, operating system, device type
• Usage Data: Pages visited, time spent, links clicked, search queries
• Location Data: IP address (anonymized for privacy)
• Cookies & Similar Technologies: Used for authentication, preferences, analytics

Information from Third Parties

• Payment Processors: Transaction verification, fraud detection
• Analytics Services: Aggregated usage statistics (privacy-respecting)
• Bot Protection: Cloudflare Turnstile (see section below)

How We Use Your Data

We use the information we collect for the following purposes:

• To provide, operate, and improve the Service
• To process registrations, bookings, and payments
• To send transactional emails (confirmations, receipts, password resets)
• To communicate about updates, policies, or service changes
• To detect and prevent fraud, abuse, and security threats
• To analyze usage patterns and improve user experience
• To comply with legal obligations (tax, dispute resolution)
• With your consent, to send marketing communications (optional, you can unsubscribe anytime)

We do not sell your personal data. We may share anonymized, aggregated data with partners for analytics and improvement purposes only.

Data Retention

We retain your data according to legal requirements and operational necessity:

Your Privacy Rights

GDPR (if you're in the EU)

• Right of Access: Request a copy of your data
• Right to Rectification: Correct inaccurate information
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restrict Processing: Limit how your data is used
• Right to Data Portability: Receive your data in a portable format
• Right to Object: Opt out of marketing or analytics

CCPA (if you're in California)

• Right to Know: What personal information is collected about you
• Right to Delete: Request deletion of collected information
• Right to Opt-Out: Opt out of the sale or sharing of your personal information
• Right to Non-Discrimination: We won't discriminate against you for exercising your rights

How to Exercise Your Rights

To exercise any of these rights, contact us with your request. We will respond within 30 days (or as required by applicable law). We may ask for verification of your identity to protect your privacy.

Bot Protection: Cloudflare Turnstile

We use Cloudflare Turnstile to protect our login and registration pages from automated abuse and bots. This service may collect visitor data to determine whether you are human or a bot.

What Cloudflare collects:

• Your IP address (anonymized)
• Browser and device information
• Interaction patterns on the page
• Cookies and similar identifiers

How it's used: Cloudflare uses this data solely to verify that you are human and to prevent abuse of our service. This is a legitimate security interest under GDPR.

For more information, see Cloudflare's Privacy Addendum and Cloudflare's Privacy Policy.

Guest Identity (No Account Required)

Several features work without creating an account: the AI Trip Planner, AI Discovery Match, and saving/favouriting activities. When you use one of these as a guest, we identify you using a random identifier generated in your browser and stored in localStorage, not a cookie. It carries no personal information — it's a random value that lets us recognise the same browser on a later visit, nothing more.

What it enables: if you plan a trip, save an activity, or use AI Discovery Match as a guest, this identifier lets the same browser see that same content again on a later visit. If you create an account or sign in afterwards, anything tied to this identifier — saved activities, in-progress trips — is automatically attached to your new account, so signing up doesn't cost you what you'd already found.

Retention: unclaimed guest data ages out on a schedule rather than being kept indefinitely — see the retention table above for the specific windows (drafts, saved activities).

How to clear it: clearing your browser's site data for WingItGuide removes this identifier. Your next visit starts fresh, as a new guest, with no memory of the previous one.

AI Trip Planner

Our AI Trip Planner ("Plan my trip") builds a day-by-day activity itinerary from what you tell it — a starting point, dates, and, if you choose to write one, a free-text description of what you feel like doing.

What's sent to our AI provider:

• Any free-text description you write (e.g. "relaxing coastal trip with great food")
• Your starting location, dates, party size, and any vibe/interest chips you select

How it's used: This information is processed by OpenRouter and the underlying language model solely to generate your itinerary and its descriptive copy. We do not use it for advertising, and it is not sold or shared with third parties beyond the AI provider needed to generate your trip.

Guest use: You can use the planner without an account — see Guest Identity above for how we identify your drafts without one. Publishing a trip so others can view it is always something you opt into — trips are private by default.

Retention: unpublished draft trips are automatically deleted after 90 days. The raw AI request/response text behind any trip is cleared after 30 days, regardless of whether the trip itself is kept (see the retention table above) — only the finished itinerary is retained after that point.

AI Assistant Access (Model Context Protocol)

We provide a connector that lets AI assistants — such as Claude — search and browse WingItGuide's published activities on a person's behalf, similar to how other travel platforms already integrate with AI assistants today.

What it can do:

• Search activities, browse categories, view an activity's public details, and check date availability
• Every result links back to the relevant page on WingItGuide.com, where a booking is completed directly with us

What it cannot do:

• It cannot create a booking, take a payment, create an account, or log anyone in — those only ever happen on our own website
• It does not expose anything beyond what is already publicly visible on the site to any visitor. It also deliberately withholds certain details we display on the site itself — such as a vendor's direct phone number — that we don't think belong in an AI conversation transcript

What we receive: a request from the AI assistant's own infrastructure containing the search terms or filters it is looking up (for example, an activity category or a date) — the same kind of information any search on our website would use. We do not receive the person's name, account details, or the surrounding conversation they had with their AI assistant.

For how a given AI assistant itself handles a person's conversation, refer to that provider's own privacy policy.

Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us:

Policy Changes

We may update this Privacy Policy from time to time. We will notify you of any changes by updating the "Last updated" date above. Your continued use of the Service after changes constitutes your acceptance of the updated Privacy Policy.