Privacy Notice

Effective date: May 2, 2026

This Privacy Notice explains how Upwind Booking ("we", "us", or "our") collects, uses, shares, and protects personal information when you use our website at upwindbooking.com, the operator booking widgets we power, and any related services (the "Service"). By using the Service, you agree to this Notice.

1. Who we are

Upwind Booking is a software platform that lets independent rental businesses ("Operators") accept online reservations and payments from customers ("Customers"). We are a small, owner-operated startup based in Nevada, USA. Some business elements, including licensing in certain jurisdictions, are still being finalized.

For Customers, Upwind Booking typically acts as a data processor on behalf of the Operator you booked with — the Operator is the data controller for your booking relationship. For account holders (Operators and their staff) and for visitors to our marketing website, we act as the data controller.

2. Information we collect

2.1 Information you give us directly

Account information (Operators and staff): name, email, password (hashed), phone, role, operator/business affiliation.
Booking information (Customers): name, email, phone, participant names and emails, date and time of the reservation, item selected, quantity, add-ons, custom notes, waivers signed.
Payment information: handled by our payment processor, Stripe. We receive a tokenized payment method reference and the last four digits of the card, but we do not store full card numbers.
Business and listing data (Operators): business name, address, phone, email, fleet/inventory descriptions, operating hours, photos.
Communications you send us: messages submitted through contact forms, support emails, or in-app conversations.

2.2 Information we collect automatically

Device and log data: IP address, browser type and version, operating system, referrer, pages visited, timestamps, and approximate location derived from IP.
Cookies and similar technologies: essential cookies for sign-in sessions and security. We do not currently run third-party advertising or analytics trackers.

2.3 Information from third parties

Stripe: payment status, charge IDs, refund records, and (for Operators) Stripe Connect account status.
Email providers: delivery and bounce status from Resend or other email services.

3. How and why we use information

Provide and operate the Service (process reservations, charge cards, send confirmations and reminders).
Communicate with you about your account, bookings, waivers, refunds, support requests, and changes to the Service.
Prevent fraud, abuse, and unauthorized access; investigate suspected violations of our Terms.
Diagnose and fix technical issues; monitor performance and reliability.
Comply with legal obligations (tax, accounting, lawful requests from authorities).
Improve the Service based on aggregated, de-identified usage patterns.

We do not sell or rent your personal information, and we do not use it for targeted advertising.

When you make a reservation, the Operator you booked with receives your name, email, phone, participant details, and reservation specifics so they can fulfill the booking, contact you, and meet legal requirements (waivers, licensing, etc.).

We rely on the following third-party service providers to run the Service. They access only what they need to perform their function and are contractually required to handle data securely.

Stripe, Inc. — payment processing, Stripe Connect for operator payouts, and stored payment methods. See stripe.com/privacy.
Supabase, Inc. — database hosting, authentication, and file storage. See supabase.com/privacy.
Resend (Drift Labs, Inc.) — transactional email delivery (confirmations, waivers, password resets). See resend.com/legal/privacy-policy.
Vercel Inc. — web hosting and serverless function execution. See vercel.com/legal/privacy-policy.
Google LLC — web fonts (no account data shared); IP-based logging by Google Fonts is governed by Google's own privacy policy.

We may share information if required by law, valid subpoena, court order, or government request, or where we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

If Upwind Booking is acquired, merged, reorganized, or sells its assets, your information may be transferred to the successor entity. We will provide notice and the successor will be bound by terms no less protective than this Notice.

5. How long we keep information

Account data: as long as the account is active. After closure, we may retain a record of the account for up to seven (7) years to meet legal, tax, and audit obligations.
Booking records: typically retained for seven (7) years from the booking date to support refund/chargeback windows, tax records, and dispute resolution.
Payment records: handled by Stripe per Stripe's retention practices. We retain payment intent IDs and related metadata for the same period as booking records.
Email logs: delivery records retained by Resend per their policy (typically 30 days).
Server / access logs: typically 30–90 days.

6. Your rights and choices

Depending on where you live, you may have some or all of the following rights regarding personal information about you. To exercise any of them, email info@upwindbooking.com from the address associated with your account or reservation. We may need to verify your identity before acting on a request.

Access a copy of the personal information we hold about you.
Correct inaccurate or incomplete information.
Delete your information, subject to legal retention and ongoing-booking exceptions.
Restrict or object to certain uses of your information.
Data portability: receive a machine-readable copy of information you provided to us.
Opt out of marketing emails by clicking the unsubscribe link or contacting us. Transactional emails (confirmations, refunds) cannot be opted out of while you have an active booking.
Withdraw consent at any time where processing is based on consent (without affecting past lawful processing).

6.1 California residents (CCPA / CPRA)

If you are a California resident, you have the right to: know what personal information we collect and how we use it; request deletion or correction; opt out of "sale" or "sharing" of personal information; limit the use of sensitive personal information; and not be discriminated against for exercising any of these rights. We do not sell or share personal information for cross-context behavioral advertising. To exercise these rights, email the address above.

6.2 Other US states

Residents of states with comprehensive privacy laws (including but not limited to Virginia, Colorado, Connecticut, Utah, Oregon, Texas, Montana, and others) may have rights similar to those above under their respective state laws. Email us to exercise them.

6.3 EEA / UK residents

Upwind Booking is based in the United States. If you are in the European Economic Area or United Kingdom and use the Service, your information will be transferred to and processed in the United States. We rely on appropriate safeguards where required. You have rights under the GDPR / UK GDPR including access, rectification, erasure, restriction, portability, objection, and the right to lodge a complaint with a supervisory authority.

7. Security

We use industry-standard safeguards to protect personal information, including TLS encryption in transit, encryption of data at rest by our hosting and database providers, tokenized payment methods, hashed passwords, role-based access controls, and row-level security on our database. No system is perfectly secure; we cannot guarantee absolute security. If you suspect unauthorized access to your account, contact us immediately.

8. Children's privacy

The Service is not directed to children under 16 and we do not knowingly collect personal information from children under 16 without verifiable parental consent. If you believe a child has provided us with personal information, contact us and we will delete it.

9. Third-party links

The Service may contain links to third-party websites (e.g., Operator websites, Stripe checkout). We are not responsible for the privacy practices of those sites. Review their privacy notices before providing personal information.

10. Changes to this Notice

We may update this Notice from time to time. Material changes will be reflected in a new Effective date at the top of this page. Where required by law, we will provide additional notice. Your continued use of the Service after changes constitutes acceptance.

11. How to contact us

Privacy questions, requests, or complaints can be sent to info@upwindbooking.com. Please include enough information for us to identify your account or reservation. We will respond within thirty (30) days, or sooner where required by law.