Privacy Policy
Version 2026-10-01 · Last updated: 1 October 2026
The short version
- We collect only what we need: your email for the waitlist, and your booking details if you book.
- We don’t use analytics trackers, advertising pixels or tracking cookies, and we never sell your data.
- When bookings open, card details will go straight to Stripe. We never see your full card number.
- You can ask us to see, correct or delete your data at any time: [email protected].
1. Who is responsible for your data
Alma Escapes is operated by Alexander Costa, 1057 Saratoga St, Boston, MA 02128, USA (“we”, “us”), who is responsible for the personal data described in this policy. Contact us about anything privacy-related at [email protected].
When you book a retreat, the Host who runs it also receives your booking details. The Host is an independent business, not our employee or processor. They decide how to use your details to run the retreat and are responsible for it under data-protection law. Their own privacy notice applies to what they collect from you.
2. What we collect and why
| When | What we collect | Why | Legal basis (EU/UK) |
|---|---|---|---|
| You join the waitlist | Email address; whether you’re looking for a retreat or host retreats | To tell you when we launch and, for hosts, to invite you to list | Consent (you can withdraw it at any time by emailing us or asking us to unsubscribe you) |
| You book a retreat (when bookings open) | Name, email, phone number (optional), dates, number of guests, the retreats you selected, any message you write for the Host, and a payment reference from Stripe | To make and manage your booking, share it with the Host, send confirmations and handle cancellations and refunds | Performance of a contract |
| You pay (when bookings open) | Stripe collects your payment details directly. We receive only the payment status, amount and a reference | To take payment and prevent fraud | Contract; legitimate interests (fraud prevention) |
| You host with us | Name, email, a securely hashed password, your listing content, a record of your Host Agreement acceptance (version, date and IP address), and your Stripe account ID and payout status. Stripe collects your identity and bank details for payouts directly | To run your account, publish your listings, pay you, and keep evidence of what you agreed to | Performance of a contract; legitimate interests (keeping evidence of what you agreed to) |
| You host with us and tax reporting applies | Tax details you give us: legal name, address, date of birth (for individuals), country of residence, tax identification number and VAT number | To meet tax-reporting laws (for example the EU’s DAC7 rules) and prevent fraud | Legal obligation |
| You email us | Your email address and what you write | To reply and help you | Legitimate interests |
| You visit the site | Technical data your browser sends automatically, such as IP address, browser type and pages requested, processed by our hosting provider for security and delivery | To deliver the site, keep it secure and stop abuse | Legitimate interests |
Health information. We don’t ask for health or medical information. Please don’t put health details in the message box for your Host (the Host sees it) or in emails to us, and if you need to cancel for a medical reason, tell us only as much as you’re comfortable with. If a Host needs health information to keep you safe, they ask you directly on their own form. Hosts must use it only to run your retreat, keep it secure, and delete it when they no longer need it. If you give a Host an emergency contact, make sure that person knows you have shared their details. Tell us if a Host asks for more than seems reasonable.
Payments stay with Stripe. Your card number and security code are entered on Stripe’s payment page and never reach our servers.
3. Cookies and tracking
Our website does not use analytics tools, advertising pixels or tracking cookies. If you sign in to an account, a login token and your basic account details (name and email) are kept in your browser’s local storage so you stay signed in. They are removed when you log out. We may also remember your chosen display currency on your device, along with a short-lived copy of currency exchange rates so prices load quickly. Stripe may set cookies on its own payment page for security and fraud prevention; see Stripe’s privacy policy.
We don’t track you across other websites, so we don’t respond to “Do Not Track” signals: there is nothing to switch off.
The pages of our public website serve their fonts and images from our own site, so loading them doesn’t send your data to font or image providers. When you use our booking pages (once bookings open), they may load fonts and photos from outside providers (for example Google Fonts and Unsplash), which can see your IP address and browser details. If you use a “near you” feature and allow your browser to share your location, we may send approximate coordinates to a map service (for example geocode.maps.co) to name your nearest city. You can say no to the location prompt and still use the site.
4. Who we share data with
We never sell or rent your personal data, and we don’t share it for advertising. We share it only with:
- The Host of your retreat: your booking details, so they can deliver it.
- Service providers that process data on our behalf under contract:
- Cloudflare, Inc.: website hosting, database and security (our database is hosted by Cloudflare)
- Stripe, Inc.: payment processing, identity verification and payouts for Hosts, and fraud prevention (when bookings open)
- Resend (Plus Five Five, Inc.): sending booking confirmation emails (when bookings open)
- Font, image and map providers used by our booking pages, as described in section 3
- Banks and card networks, if you open a payment dispute: we may share booking records with Stripe, your card provider and the Host so they can respond.
- Tax authorities where the law requires it (for example under DAC7), and authorities or advisers where the law requires it otherwise, to protect rights and safety, or in connection with a sale or reorganization of our business (the buyer would be bound by this policy).
5. International transfers
Some of our providers are based in the United States or process data there. Where personal data from the EU, EEA or UK is transferred outside those regions, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or the provider’s certification under the EU–US Data Privacy Framework.
Hosts may be located outside the EU/UK. We send them only what they need to deliver your booking, which is necessary for your contract with them.
6. How long we keep data
- Waitlist: until you unsubscribe or ask us to delete it, and no longer than 24 months after you join if you haven’t booked or created an account. We clear out older entries by hand at least twice a year.
- Bookings and payment records: for as long as required for accounting, tax and legal purposes, generally up to 7 years after the retreat.
- Host accounts: while the account is open, then for up to 7 years for legal and accounting records.
- Host tax details: for 10 years after the end of the year they relate to, where tax-reporting laws require us to keep them.
- Emails with us: up to 3 years after the conversation ends.
7. Your rights
Wherever you live, you can ask us to:
- tell you what personal data we hold about you and send you a copy by email;
- correct data that is wrong or incomplete;
- delete your data, unless we must keep it by law (for example booking records for tax);
- stop emailing you, or remove you from the waitlist.
If you are in the EU, EEA or UK, you also have the right to restrict or object to certain processing, to data portability, and to withdraw consent at any time without affecting earlier processing. You can complain to your local data-protection authority, though we’d appreciate the chance to help first.
We are not currently required to comply with California’s CCPA, but we apply the same rights to everyone: if you are a California resident, you can ask to know, delete and correct your personal information, and we won’t treat you differently for doing so. We do not sell or share personal information for advertising.
To use any of these rights, email [email protected]. We handle requests by email, reply within 30 days, and may need to confirm your identity first (for example by replying from the address we hold for you).
8. Security
We protect your data with encryption in transit (HTTPS), hashed passwords, restricted access and reputable infrastructure providers. No system is perfectly secure; if a breach affects your data, we will tell you and the relevant authorities as the law requires.
9. Children
Alma Escapes is not intended for anyone under 18, and we don’t knowingly collect personal data from children. If you believe a child has given us data, contact us and we will delete it. A parent or guardian may book on behalf of a child who travels with them; we ask only for what the booking needs.
10. Changes to this policy
We will post any changes here with a new “Last updated” date, and tell you by email if a change significantly affects how we use your data.
11. Contact
Alma Escapes, operated by Alexander Costa, 1057 Saratoga St, Boston, MA 02128, USA
[email protected]