Privacy policy.

Who we are

Waypoint Retreats is a business name used by Raheem Chaudhry, a sole proprietor based in New Jersey, USA ("we", "us", "our"). We're responsible for the personal information described here.

This policy covers this website (waypoint-retreats.netlify.app), the inquiry form, and how we handle information when we plan a retreat with your company.

What we collect

What you send through the inquiry form

Your name, work email, company, group size, retreat type, timing, destinations you're curious about, and anything you write in the "What would make this retreat a success?" box. Only your name and work email are required. Please don't put sensitive information, like health details, in the form.

What's recorded with a form submission

Our host and form provider, Netlify, stores each submission along with the sender's IP address, browser user agent, the page it was sent from, and a timestamp. Netlify uses this for spam filtering, and it lets us see when a message arrived. The form also has a hidden anti-spam field that people never see or fill in.

What our host records when you visit

Like any web host, Netlify processes your IP address, browser and device details, the pages you request, and when you request them. It needs this to deliver the site and protect it from abuse. We don't use these records to identify or profile visitors.

What we don't collect

• No cookies, and nothing else stored on your device.
• No analytics, advertising pixels, social-media trackers, session recording or fingerprinting.
• No third-party requests on page load. Fonts, images and video are served from this site, so visiting it doesn't send your data to font, video or ad networks.

If we ever add a "Book a call" button, it will link to our scheduling provider's site, and that provider's privacy policy will apply there. If we ever add analytics or cookies, we'll update this policy first.

Information about retreat attendees (clients only)

When we plan a retreat, your company may give us attendee details such as names, contact details, arrival times, rooming preferences, and dietary or accessibility needs. Dietary and accessibility details can reveal health information, so we treat them as sensitive. We ask for them only when needed, use them only to plan the retreat, and share them only with the venue or vendor who needs them (for example, the caterer). Your company is responsible for making sure it can share attendee information with us.

How we use it

• To reply to your inquiry and send what you asked for, such as a recommended package, destination ideas and a budget range.
• To prepare proposals and agreements, and to deliver the services you hire us for.
• To coordinate with the venues and vendors you choose.
• To keep business, tax and contract records.
• To keep the site secure and filter spam.
• To meet legal obligations.

We don't send marketing newsletters. If we ever start one, it will be opt-in only. We don't use your information for automated decision-making or profiling.

For visitors in the EU or UK, our legal bases are: taking steps you ask for before a contract, performing our contract with your company, our legitimate interest in running and securing a small business, and complying with the law.

Who we share it with

We share personal information only as needed to run the business:

• Service providers that process it for us: Netlify (website hosting and form handling, USA); Akismet, run by Automattic, which Netlify uses to check form submissions for spam; and our business email, calendar and document providers, which we use to receive form notifications, correspond with you and keep records.
• Vendors you choose for your retreat, such as a venue, caterer, activity or transport company. They get only the details needed to serve your group, and their own privacy policies apply.
• Professional advisers (for example, an accountant or lawyer), and authorities when the law requires it.
• A successor business if Waypoint Retreats is ever reorganized or sold. Your information would stay protected by this policy.

We don't sell personal information. We don't "share" it for cross-context behavioral advertising, and we don't use it for targeted advertising, as those terms are used in US state privacy laws.

How long we keep it

• Inquiry form submissions: if we don't end up working together, we delete them from Netlify within 12 months, or sooner if you ask.
• Client records (proposals, agreements, invoices and related correspondence): for the engagement, then up to seven years for tax and legal purposes.
• Attendee details, including dietary and accessibility information: deleted or returned to your company within 90 days after the final 30/60/90-day check-in, unless the law requires us to keep something longer.
• Hosting logs: kept by Netlify under its own retention schedule.

How we protect it

The site is served only over HTTPS. Access to inquiries and client files is limited to the person who needs them to do the work. We use established providers and protect our accounts with strong passwords and two-factor authentication. No system is perfectly secure, but if a breach affects your information, we'll notify you as the law requires.

Your privacy rights

Wherever you live, you can ask us to:

• Access the personal information we hold about you and get a copy in a portable format.
• Correct information that's inaccurate.
• Delete your information, except what we must keep for legal or tax reasons.
• Opt out of the sale or sharing of your information, or its use for targeted advertising. We don't do any of these, but you can still ask.
• Limit the use of sensitive information. We already use it only to plan your retreat.

Residents of California, Colorado, Connecticut, New Jersey, Virginia and other states with consumer privacy laws have rights like these by law. Some of those laws may not apply to a business our size, but we give everyone the same rights. We won't treat you differently for using them.

How to make a request

Use our inquiry form and write "Privacy request" in the message box, along with what you'd like us to do. Use the email address you've used with us before, so we can check that the request is really from you. To verify you, we'll reply to that address and may ask for a detail only you would know. Requests are free. We'll respond within 45 days, and if we need more time we'll tell you why (by law, up to 45 more days). You can also have an authorized agent make a request for you if you've given them signed permission.

Appeals

If we turn down your request, you can appeal by replying to our decision with the word "Appeal". We'll respond within 45 days. If you're still not satisfied, you can contact your state attorney general. EU and UK visitors can complain to their local data protection authority.

Global Privacy Control and Do Not Track

We don't track visitors across websites, so these browser signals don't change how this site works. We still treat a Global Privacy Control signal as a valid request to opt out of sale and sharing.

Where your information is processed

We're based in the United States, and our providers process information mainly in the US. Netlify's content delivery network may serve pages from servers near you. If you contact us from outside the US, your information will be handled in the US.

Children

Our services are for businesses. This site isn't aimed at children under 16, and we don't knowingly collect their information. If you think a child has sent us information, let us know and we'll delete it.

Changes to this policy

When we update this policy, we'll post the new version here and change the "Last updated" date. If a change materially affects how we use information we already hold, we'll tell current clients directly.

Contact

For questions or requests, use our inquiry form and mention "Privacy". It's our official channel for privacy matters, and we reply within one business day.