This Privacy Policy explains what GoToRetreats, LLC ("GoToRetreats", "we", "us") collects when you use https://www.gotoretreats.com and our services, why we collect it, who we share it with and the rights you have. It applies to guests, hosts and visitors. For GDPR purposes we are the data controller.
1. Information we collect
1.1 What you give us
- Account — name, email address, password (stored hashed), profile photo and, if you sign in with Google, the name, email and photo Google shares with us.
- Profile — anything you add to your public profile, such as a bio, location, languages, interests and the retreat types you like.
- Bookings and enquiries — what you book or ask about, dates, number of guests, your phone number, special requests and messages exchanged with the host.
- Host listings — business name, listing descriptions, photos, addresses, pricing, availability and cancellation policy. Most of this is public by design.
- Payouts and verification — hosts connect a Stripe or Payoneer account. Those partners collect identity documents, tax and bank details directly. We receive only your payout status, the partner account ID and whether verification is complete.
- Reviews and content — reviews, replies, photos and any other content you post.
- Support — emails, contact-form messages and conversations with Kaya, our AI support assistant, so we can help you and follow up.
- Preferences — your cookie choices and whether you opted in to marketing emails.
1.2 What we collect automatically
- Device and connection data: IP address, browser, operating system, screen size, language and approximate country derived from your IP.
- Usage data: pages and listings you view, searches you run, buttons you press and how long you stay, so we can improve search, recommendations and the host dashboard.
- Cookies and similar technologies, explained in Section 4.
1.3 What we receive from others
- Google, when you choose Google sign-in.
- Stripe and Payoneer: payment success or failure, refund and chargeback events, and host verification status.
- Hosts, about their guests, and guests, about their hosts, when they message, review or report each other.
- Partner sites that refer a guest to us, which may send a referral tag so the partner can be credited.
We do not ask for, and please do not send us, sensitive information such as health conditions, religious beliefs or government ID numbers, except where a host genuinely needs it to keep you safe during a retreat. Share it directly with the host in that case.
2. How we use it
| Purpose | Examples | Legal basis (GDPR) |
|---|---|---|
| Run the marketplace | Create your account, show listings, process bookings and quotes, hold and release payments, send booking and payout emails. | Contract |
| Keep it safe | Verify hosts, detect fraud and fake reviews, moderate content, resolve disputes, enforce our Terms. | Legitimate interests, legal obligation |
| Support you | Reply to your messages and Kaya conversations, follow up on problems. | Contract, legitimate interests |
| Improve the product | Understand which searches and listings work, test new features, produce aggregated statistics. | Legitimate interests, consent for analytics cookies where the law requires it |
| Find and fix faults | Record errors, slow pages and technical logs. Watch screen recordings of where a visit went wrong. | Legitimate interests in keeping the site working, consent for screen recordings where the law requires it |
| Personalise | Recommend retreats and remember your preferences and currency. | Legitimate interests |
| Marketing | Send our newsletter and offers, show our ads to past visitors. | Consent (you can withdraw any time) |
| Meet legal duties | Tax and accounting records, responding to lawful requests, handling data-rights requests. | Legal obligation |
We use AI systems (see Section 6) to help with support and content, but no decision that has a legal or similarly significant effect on you, such as suspending an account or refusing a payout, is made by automated means alone. A person reviews it.
3. Who we share it with
3.1 Other users
- When you book, the host sees your name, profile photo, contact details, group size and messages so they can deliver the experience.
- When you host, guests see your public profile and listing, and confirmed guests see the contact details you provide for the booking.
- Reviews are public and show your name and photo as they appear on your profile.
3.2 Service providers
These companies process data on our behalf under contracts that limit them to our instructions. All are based in the United States unless stated.
| Provider | What they do for us | Privacy policy |
|---|---|---|
| Stripe | Card payments, Premium subscriptions and host payouts (Stripe Connect). Holds card and bank details; we never do. | https://stripe.com/privacy |
| Payoneer | Host payouts and the identity verification needed to pay hosts in many countries. | https://www.payoneer.com/legal/privacy-policy/ |
| MongoDB Atlas | Hosts our database: accounts, listings, bookings, messages and support conversations. | https://www.mongodb.com/legal/privacy-policy |
| Cloudinary | Stores and serves profile and listing photos. | https://cloudinary.com/privacy |
| Mapbox | Maps and converting typed addresses to coordinates. | https://www.mapbox.com/legal/privacy |
| Resend | Sends transactional email such as verification, booking and payout notices. | https://resend.com/legal/privacy-policy |
| MailerLite | Sends our newsletter and marketing email. Only if you opted in. | https://www.mailerlite.com/legal/privacy-policy |
| Google sign-in, plus Google Analytics and Google Tag Manager to see how the site is used. Analytics follows your cookie choice. | https://policies.google.com/privacy | |
| Meta | Meta Pixel to measure and show our ads to past visitors. Follows your marketing cookie choice. | https://www.facebook.com/privacy/policy/ |
| OpenAI and Groq | Generate responses for Kaya and our other AI features from the text you type. | https://openai.com/policies/privacy-policy · https://groq.com/privacy-policy/ |
| PostHog | If analytics is on: your account ID and role, the pages you visit, what you click, page speed, errors and your approximate location (country and city, with the IP address itself discarded). If screen recordings are on: replays of your visit. Public pages appear as they are. On other pages text, labels and photos are hidden. Anything you type is always hidden, card details are held by Stripe and never recorded, and private messages are not recorded. Follows your cookie choice. | https://posthog.com/privacy |
| Sentry | Records errors, slow pages and technical logs so we can find and fix them. Receives your account ID, email address and role if you are signed in when an error happens, so we can contact you about it, plus your IP address, the page you were on, your browser and request details, and which fields a request contained along with its numbers and IDs. Before sending we remove other email addresses, names, passwords, login cookies, searches, precise location, and anything you typed or wrote. | https://sentry.io/privacy/ |
3.3 Everyone else
- Authorities, courts or regulators when the law requires it or to protect someone's safety or our rights.
- A buyer or successor if GoToRetreats is sold, merged or restructured. We would tell you before your data became subject to a different policy.
- Anyone you ask us to share with.
4. Cookies and tracking
- Strictly necessary — sign-in sessions, security, your currency and your cookie choice. Always on, because the site does not work without them.
- Analytics — Google Analytics, Google Tag Manager and PostHog, to see which pages and searches are used, where visitors come from and where they get stuck.
- Screen recordings — PostHog replays of visits, so we can see and fix what went wrong. A separate choice from analytics.
- Marketing — Meta Pixel and MailerLite site tracking, to measure our ads and show them to people who visited us.
In the EU, EEA, UK and Switzerland these three stay off until you opt in: you choose in the cookie banner on your first visit. Elsewhere we may turn them on by default without showing the banner, unless your browser sends a Global Privacy Control signal. Wherever you are, you can change your mind any time using "Cookie settings" in the site footer or your browser settings. Our site does not respond to "Do Not Track" browser signals because there is no agreed standard, but Cookie settings gives you the same control.
5. Payments and payouts
- Card numbers are entered directly into Stripe's secure form and never touch our servers. We keep only the transaction record (amount, currency, date, Stripe reference and status) needed for receipts, refunds and disputes.
- Hosts choose Stripe Connect or Payoneer for payouts. The chosen partner collects identity documents, tax information and bank details under its own privacy policy and know-your-customer rules. We keep the partner account ID, verification status, payout amounts and dates.
- Transaction records are kept for as long as tax and accounting law requires, even if you delete your account.
6. AI features
Kaya, our support assistant, and features that help write or improve listings are powered by OpenAI and Groq. The text you type, and the context needed to answer, is sent to them to generate a reply. Your support conversations are stored on our own systems so you can come back to them and our team can step in. We do not use your conversations to train AI models, and our providers' API terms do not allow them to either.
7. Where your data is stored
GoToRetreats is a US company and our systems and providers are in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, your data is transferred there under the European Commission's Standard Contractual Clauses (and the UK addendum) or another lawful mechanism, and our providers commit to equivalent protections.
8. How long we keep it
| Data | How long |
|---|---|
| Account and profile | While your account is active. Deleting your account deactivates it immediately and permanently erases it after 30 days, unless you sign back in during that time. |
| Bookings, payments and payouts | For the period tax and accounting law requires, then deleted or anonymised. |
| Messages and reviews | While the accounts involved exist. Reviews may stay visible in anonymised form after an account is deleted so other users are not misled. |
| Support conversations | For as long as they are useful to help you and improve support, then deleted. |
| Usage and analytics data | Kept only as long as needed to understand and improve the service, and aggregated wherever possible. |
| Error reports, technical logs and screen recordings | 30 days, then deleted. |
| Marketing consent records | For as long as you are subscribed, plus a record of your unsubscribe so we honour it. |
9. Your rights and choices
Wherever you live, you can do the following. Most of it is self-service from your account settings; for anything else, email us and we will respond within 30 days (45 days for California requests, extendable once by law).
- Access and export — download a machine-readable copy of your data from your settings, or ask us for one.
- Correct — edit your profile and listings at any time, or ask us to fix anything else.
- Delete — delete your account from settings. It is erased after the 30-day grace period, except records we must keep by law.
- Marketing — unsubscribe from any marketing email with the link at the bottom, or change the setting in your account. Booking and account emails still arrive because they are part of the service.
- Cookies — change your analytics, screen recording and marketing choices any time from "Cookie settings" in the footer.
- Object or restrict — object to processing based on our legitimate interests, or ask us to restrict it, and we will consider your situation.
- Withdraw consent — where we rely on consent, you can withdraw it at any time without affecting what was done before.
9.1 If you are in the EU, UK or Switzerland
You have the rights above under the GDPR and UK GDPR, plus the right to lodge a complaint with your local data protection authority. We would appreciate the chance to resolve any concern first.
9.2 If you are in California
Under the CCPA/CPRA you have the right to know what personal information we collect, use and disclose, to correct or delete it, to opt out of "sale" or "sharing", and not to be discriminated against for exercising these rights. We do not sell personal information. Our use of the Meta Pixel may count as "sharing" for cross-context advertising; you can opt out at any time by turning off marketing in Cookie settings, and we treat a Global Privacy Control signal from your browser as the same request. In the last 12 months we have collected identifiers, contact details, commercial information (bookings) and internet activity, for the purposes in Section 2. An authorised agent may make a request for you with proof of your permission.
To exercise any right, email hello@gotoretreats.com from the address on your account. We may ask you to confirm your identity first.
10. Children
You must be at least 18 to hold an account. We do not knowingly collect personal information from anyone under 13, and we delete it if we learn we have. If you are a parent or guardian and believe a child has given us data, contact us. California residents under 18 may ask us to remove content they posted publicly.
11. Security
We protect your data with encryption in transit, hashed passwords, access controls, audit logs and providers that meet recognised security standards (Stripe and Payoneer are PCI-DSS compliant). No system is perfectly secure, so keep your password private and tell us straight away if you notice anything unusual on your account. If a breach affects you, we will notify you and the relevant authorities as the law requires.
12. Changes to this policy
We update this policy when our practices or providers change. The "Last updated" date at the top tells you when. For significant changes we will email you or show a notice on the site before they take effect.