Privacy Policy
What we collect
From operators: account details (name, email, business details) and settings. From guests, on behalf of operators: the details needed to make a booking — name, email, phone, booking notes and pickup choice. Card details are collected by Stripe and never touch our servers.
How we use it
To run bookings: show availability, take payments through Stripe, send confirmations and reminders, and give operators their manifests and reports. We don’t sell personal data and we don’t use guests’ details for our own marketing.
Operators control guest data
For guest data, Wayflower acts as a service provider (processor) for the operator, who decides how it’s used. Guests with privacy requests should contact the operator; we’ll help them respond.
Sharing
With Stripe (payments), our email provider (sending messages), and our hosting provider. Each is bound to protect the data. We disclose data if legally required.
Retention
Booking records are kept while the operator’s account is active and deleted within 90 days of cancellation, except where the law requires longer retention.
Security
Data is encrypted in transit, passwords are hashed, access is limited to people who need it, and operators can export or delete their data.
Your rights
Depending on where you live (e.g. under GDPR or the CCPA), you can access, correct, export or delete your personal data. Contact hello@wayflower.org.
Cookies
We use a single essential cookie to keep operators signed in. No advertising trackers.