We collect the information needed to sell you a trip and get you there — your name, how to reach you, and what you booked. We do not sell it, we do not use it for advertising, and we share it only with the people who have to see it to deliver your experience.
01In short
- We collect what a booking requires, and little else.
- We never see or store your full card number. Stripe handles payment.
- We share your details with the local operator running your experience, because they need them to receive you.
- We do not sell or share your data for advertising, and we run no advertising trackers.
- You can ask us what we hold, correct it, or have it deleted. Write to privacy@elvaryn.travel.
The sections below set this out in full.
02Who is responsible for your data
Elvaryn LLC, a Wyoming limited liability company, decides what personal information is collected on elvaryn.travel and why. In data protection language, we are the controller.
Elvaryn sells travel experiences directly. Your booking contract is with us, and so is the responsibility for your personal information.
03What we collect
When you book
- Your full name, and the names of others in your party
- Email address
- Phone number
- Country of residence
- Your dates, destination, experience type and number of guests
- Anything you tell us in a special request — dietary needs, accessibility requirements, a relevant medical condition, an occasion you are celebrating
Health and dietary information is sensitive, and we treat it accordingly. We collect it only when you volunteer it, use it only to prepare for your visit safely, pass it only to the operator who needs to act on it, and delete it within 90 days of your trip ending.
When you pay
- Billing name and address
- The card type and last four digits
- The transaction amount, date and outcome
When you contact us
The content of your emails and any information you include in them, so we can help you and keep a record of what was agreed.
When you visit the site
- IP address, which indicates your approximate location at city level
- Browser and device type, operating system
- Pages viewed and the site that referred you
If you subscribe
Your email address, and whether you opened our messages. You can unsubscribe from any email, and we will stop.
04What we don't collect
Stating this plainly, because travel companies often ask for more than they need:
- Passport or national identity numbers
- Social security or tax identification numbers
- Full payment card numbers
- Precise GPS location
- Biometric data
- Medical records, beyond what you choose to tell us about a condition relevant to your trip
If an operator ever requires identity documents at check-in under local law, they collect and hold those themselves. We do not receive them.
05Why we collect it
| Purpose | What it uses |
|---|---|
| Creating and confirming your booking | Name, email, phone, dates, party size |
| Preparing your arrival with the operator | Name, phone, dates, special requests |
| Taking payment and issuing refunds | Billing details, transaction record |
| Answering you and resolving problems | Contact details, correspondence |
| Preventing fraud | Transaction data, IP address |
| Meeting tax and accounting obligations | Transaction records |
| Understanding how the site is used | Anonymised usage data |
| Sending you news, if you asked for it | Email address |
We do not use your information for automated decision-making or profiling.
06Payment information
Payments are processed by Stripe, Inc. Your card details go directly to Stripe and are never transmitted to or stored on our systems. We receive only confirmation of the outcome, the last four digits and the card type — enough to recognise your transaction and process a refund.
Stripe maintains PCI DSS Level 1 certification and handles your card data under its own privacy policy, at stripe.com/privacy.
07Sharing with local operators
To deliver your experience, we pass the operator running it the details they need to receive you: your name, contact details, dates, party size and any special request that affects your stay.
Operators receive this to perform the experience on our behalf. They are instructed to use it only for that purpose, and not for their own marketing.
Some operators are outside the United States, in the country where your experience takes place. The transfer is necessary to perform the contract you entered into with us. Where an operator is in a country with weaker data protection law than your own, that is a consequence of travelling there, and we tell you plainly rather than bury it.
If you contact an operator directly — a message on arrival, a question about the property — that exchange is between you and them, and this policy does not cover it.
08Cookies
Necessary cookies
A small number of cookies keep your booking session working and protect the checkout form from cross-site attacks. These cannot be switched off without breaking the ability to book.
Analytics
We use analytics to see which pages are visited and where visitors arrive from, with IP addresses anonymised. This is aggregate measurement, not tracking of individuals. You can opt out through your browser settings or a tracking-blocker without affecting your ability to book.
What we don't run
No advertising cookies. No retargeting pixels. No cross-site tracking. No social media trackers. We do not build advertising profiles and we do not let third parties do so on our site.
09Our processors
These are the companies that handle your data on our instructions:
| Who | What for | What they get |
|---|---|---|
| Stripe | Payment processing | Billing details, transaction data |
| Cloudbeds | Lodging reservations | Name, contact, dates, requests |
| WeTravel | Day visit reservations | Name, contact, date, party size |
| Email provider | Confirmations and correspondence | Email address, booking details |
| Analytics provider | Site measurement | Anonymised usage data |
| Local operators | Delivering your experience | See section 07 |
We may also disclose information where the law requires it — a court order, a tax authority, a regulator, or a genuine emergency involving someone's safety. If Elvaryn is ever sold or merged, customer data may transfer as part of that business, and we will say so here before it happens.
10We do not sell your data
Elvaryn does not sell personal information, and does not share it for cross-context behavioural advertising. We have not done so in the past twelve months and have no plans to.
Sharing with the processors named in section 09 is not a sale. They act on our instructions, for the purposes we set, and may not use your data for anything else.
11How long we keep it
| What | How long | Why |
|---|---|---|
| Booking and transaction records | 7 years | Tax and accounting law |
| Health and dietary notes | 90 days after your trip | No longer needed |
| Email correspondence | 3 years | Service history and disputes |
| Site analytics | 14 months | Trend comparison |
| Newsletter subscription | Until you unsubscribe | You asked for it |
When a period ends we delete the data or strip it of anything that identifies you.
12Your rights
We honour these requests from everyone, wherever you live. We would rather apply one clear standard than sort people by jurisdiction.
- Know — ask what we hold about you, where we got it, and who we shared it with.
- Access — get a copy.
- Correct — have inaccurate information fixed.
- Delete — have your information erased, except records we must keep by law, such as transaction records within their retention period.
- Opt out — stop marketing email at any time, through the unsubscribe link or by writing to us.
- Take it with you — receive your data in a portable format.
How to ask
Email privacy@elvaryn.travel from the address you booked with, and tell us what you want. We may need to confirm your identity before releasing or deleting anything, to protect you from someone else making the request.
We aim to respond within 30 days and will not exceed 45. If a request is genuinely complex we may need longer, and we will tell you before the deadline rather than after it.
Exercising these rights costs nothing and changes nothing about the service you receive. We will not refuse you a booking, charge you differently, or treat you worse for asking.
13California residents
If you live in California, the California Consumer Privacy Act as amended by the CPRA gives you specific rights over your personal information — to know, to access, to correct, to delete, to opt out of sale or sharing, to limit the use of sensitive information, and not to be discriminated against for exercising any of them.
The rights in section 12 cover all of these, and we apply them to every customer.
The disclosures the statute asks for
| Category collected | Sold or shared? |
|---|---|
| Identifiers — name, email, phone, IP address | No |
| Customer records — billing address, transaction data | No |
| Commercial information — what you booked | No |
| Internet activity — pages viewed, referring site | No |
| Geolocation — approximate, city level from IP | No |
| Sensitive information — health or dietary notes you volunteer | No |
We collect these from you directly and, for transaction outcomes, from our payment processor. We disclose them for business purposes only, to the processors named in section 09. We use sensitive personal information solely to deliver the service you booked, and never to infer characteristics about you.
You may use an authorised agent to make a request. We will ask for proof of their authority and may ask you to confirm it directly.
If you are unhappy with how we have handled a request, you can complain to the California Privacy Protection Agency. We would appreciate the chance to put it right first.
14Security
The site runs over encrypted connections. Stored data is encrypted. Access is limited to the people who need it to do their work, and payment data never enters our systems at all.
No system is perfectly secure, and we will not claim otherwise. If a breach ever affects your personal information, we will notify you and the relevant authorities as the law requires, and tell you what happened and what to do about it.
15Where your data is held
Elvaryn operates from the United States, and your information is processed there. Where your experience takes place abroad, the details in section 07 are transferred to the operator in that country so they can receive you.
By booking, you understand that your information will be handled in the United States and in your destination country, whose data protection laws may differ from those where you live.
16Children
Elvaryn does not sell to children and does not knowingly collect information from anyone under 13. Bookings are made by adults, who provide the details of any minors travelling with them.
If you believe a child has given us information directly, write to privacy@elvaryn.travel and we will delete it.
17Changes to this policy
We will update this policy when our practices change. The current version and its date are shown at the foot of this page.
If a change materially affects how we handle your information, we will say so prominently on the site, and email you where we hold your address.
18Contact
Privacy questions and requests
privacy@elvaryn.travel
Everything else
support@elvaryn.travel
Postal address
Elvaryn LLC
c/o Registered Agents Inc.
30 N Gould St, Ste R
Sheridan, WY 82801
United States
We answer written enquiries within ten business days, and privacy requests within the timeframe in section 12.