Privacy Policy — Swellbooking

Swellbooking(“we”, “us”) provides a booking-engine platform used by independent camps, retreats, and small hospitality businesses to take reservations. This page explains what personal data we collect, why, and the rights you have under the EU General Data Protection Regulation (GDPR).

1. Who is the data controller?

When you book a stay through a business that uses Swellbooking, the camp itself is the data controller for your booking data. Swellbooking acts as a data processor on behalf of the camp under a data processing agreement.

When you create an account as a camp operator (owner, manager, or staff), Swellbooking is the controller for your account data.

2. What data do we collect?

From guests booking a stay: name, email, phone number, dates of stay, number of guests, selected room, packages, add-ons, any special requests or custom field answers you provide, and, if paying online, a payment-processor token (we do not store your card number).

From camp operators: email, a hashed password, the name of your camp, and operational data you enter about your business (rooms, pricing, bookings, team members).

Technical data: IP address (used only to rate-limit booking requests, not stored with your booking), browser session cookies required to keep you signed in.

3. Why do we collect it?

To process your booking and communicate about your stay.
To take payment via our payment processor.
To operate the camp admin dashboard if you are a camp operator.
To keep a record of transactions where legally required (accounting, tax).
To prevent fraud and abuse of the booking endpoint.

4. Lawful basis

We process guest booking data on the basis of performance of a contract (GDPR Art. 6(1)(b)) — we need it to fulfil the booking you asked for. We process operator account data on the basis of legitimate interest in running our service and contract performance for paid subscriptions. Transactional records are kept to comply with our legal obligations (GDPR Art. 6(1)(c)).

5. Sub-processors

We share data strictly as needed with the following sub-processors:

Supabase (database and authentication) — hosts the booking data.
Stripe (payments) — receives the amount, currency, and a reference to your booking when you pay online. Card details go directly to Stripe; we never see them.
The camp's own email provider — each camp configures its own SMTP server to send booking confirmations, so your email address is passed to that provider when you book.
Vercel (hosting) — serves the application.
Sentry (error tracking) — may receive a limited error trace if something goes wrong; we avoid logging personal data.

6. International transfers

Some sub-processors are based outside the EU/EEA. Where that is the case, transfers are covered by Standard Contractual Clauses or equivalent safeguards required by GDPR Art. 46.

7. Retention

Booking records are kept for as long as the camp needs them to operate its business and meet local accounting requirements (typically 7–10 years in EU jurisdictions). When you exercise your right to deletion, we anonymise the booking record so that the financial trail is preserved but your personal data is removed.

8. Your rights

Under GDPR you can:

Access the personal data we hold about you.
Correct inaccurate data.
Request erasure (“right to be forgotten”).
Request a portable copy of your data.
Object to or restrict processing.
Lodge a complaint with your local data protection authority.

To exercise any of these rights, email the camp directly (it is the controller) or contact Swellbooking at privacy@swellbooking.com. We will forward the request to the relevant camp if needed and respond within 30 days.

9. Cookies

We only set cookies that are strictly necessary to keep you signed in and to preserve your booking selections between steps of the booking flow. We do not use advertising, tracking, or cross-site profiling cookies.

10. Changes to this policy

We may update this policy to reflect changes in our service or in the law. The “last updated” date at the top tells you when the current version was published. Material changes will be notified by email to active camp operators.

11. Contact

Questions about this policy: privacy@swellbooking.com. See also our Terms of Service.