Privacy Policy

• Booking details: name, email, mobile number, the rental, dates and times, party size, add-ons, promo codes and notes.
• Details the law or the rental agreement requires: for some boat rentals, date of birth, home address, emergency contact, boater safety identification, people aboard, and signed forms. Staff may photograph the equipment and record its condition at check-out and check-in.
• Payment information: handled by Stripe. We receive a reference to your card and the last four digits, never the full number.
• Signatures: your typed name, drawn signature, the text you signed, the time, IP address and device details.
• Consent records: what you agreed to receive and when, including the exact wording shown.
• Device and usage data: IP address, browser and pages visited on the booking pages, and error reports that help us fix problems. Error reports are stripped of personal details.
• Staff accounts: name, email, role, sign-in times, and two-step sign-in settings.

• To make, change and run your booking: holds, payments, confirmations, reminders, check-in and check-out, refunds and receipts.
• To meet legal and safety obligations, such as boat livery records and statutory forms.
• To prevent fraud and abuse, such as card testing and fake bookings, and to resolve payment disputes.
• To keep the service secure and working, and to fix errors.
• To send marketing only if you opted in.
• To improve the product using anonymized data with names, contact details, card details and identification numbers removed. Operators can opt out.

If you opt in to texts, we send booking updates, reminders, and weather and safety alerts for your booking on the operator's behalf. Message frequency varies. Message and data rates may apply. Reply STOP to stop or HELP for help. Mobile numbers and text message opt-in information are never sold or shared with third parties or affiliates for their marketing purposes. Text messages are delivered through our messaging provider only to send the messages you asked for.

We do not sell personal information. We share it only as needed to provide the service:

• The operator you booked with, and its staff.
• Service providers working for us: payments (Stripe), email delivery (Postmark), text messages (Twilio), hosting and database (Cloudflare, Supabase), error monitoring (Sentry), and, if the operator uses it, accounting (QuickBooks) and AI assistance for staff (Anthropic). They may use the data only to provide their service.
• A booking channel you used, such as an online travel site, for that booking.
• An insurance partner, only if you choose to buy coverage.
• Authorities when the law requires it, for example boating safety reports, or to protect people's safety.

The booking pages use a few cookies to keep your checkout working. Operators may add their own analytics or advertising tags to their booking pages; those never load on the page where you enter your card. You can block cookies in your browser, though some parts of booking may stop working.

Booking, payment and signed form records are kept as long as the operator needs them for its business and legal obligations, which for boat rentals and tax records can be several years. Marketing consent is kept until you withdraw it. Staff copilot conversation logs are deleted after 90 days. Error reports are kept for up to a year.

You can ask for a copy of your information or ask for it to be deleted. Write to the operator you booked with, or to privacy@wakesync.app. We confirm your identity, usually by replying to the email on your booking, and respond within 30 days.

When information is deleted, your name, contact details and messages are removed. Signed rental agreements, required forms and payment records are kept where the law requires the operator to keep them. A deletion cannot be completed while a booking is upcoming or in progress.

You can stop texts by replying STOP and stop marketing emails with the unsubscribe link.

Data is encrypted in transit and at rest. Each operator's data is kept separate from every other operator's. Card details stay with Stripe. Staff accounts support two-step sign-in, and access by our own support staff requires a stated reason and is logged. No system is perfectly secure; if a breach affects you, we and the operator will tell you as the law requires.

Bookings must be made by adults. We do not knowingly collect information from children under 13.

If we change this policy in a meaningful way, we will update this page and the date above. Questions or requests: privacy@wakesync.app.