Privacy Policy

Last updated: 9 July 2026

1. Who we are

FlipTrip ("we", "us", "our") operates the website flip-trip.com. We are the data controller responsible for your personal data.

Contact: hi@flip-trip.com

2. What data we collect

Data type	When collected	Purpose	Legal basis (GDPR)
Email address	Tour unlock form, account registration	Send tour link, create account, service communications	Consent (Art. 6(1)(a)), Contract (Art. 6(1)(b))
Name, password	Account registration	User authentication and profile	Contract (Art. 6(1)(b))
IP address, device info	Every page visit (server logs)	Security, abuse prevention, infrastructure	Legitimate interest (Art. 6(1)(f))
Usage data (pages viewed, clicks)	After cookie consent via Google Analytics	Understand site usage, improve content	Consent (Art. 6(1)(a))
Payment data	Purchases via Stripe	Process payments	Contract (Art. 6(1)(b))
Tour content (text, images)	Guide dashboard (tour authors)	Publish self-guided tours	Contract (Art. 6(1)(b))

3. Cookies and tracking

We use cookies and similar technologies. Non-essential cookies are only set after you give explicit consent via our cookie banner.

Category	Provider	Purpose	Consent required
Essential	FlipTrip, Supabase	Authentication, session management, security	No (strictly necessary)
Analytics	Google Analytics 4 (via GTM)	Understand site usage, measure content performance	Yes
Functional	Google Maps JS API	Display interactive tour maps	Yes (loaded on interaction)

You can change your cookie preferences at any time by clicking the "Cookie Settings" link in the footer.

4. Third-party processors

We share personal data with the following processors, each under a Data Processing Agreement:

Service	Purpose	Data transferred	Location
Vercel Inc.	Website hosting	IP address, request data	US (EU-US DPF)
Supabase Inc.	Database and authentication	Email, password hash, tour data	EU / US
Google LLC	Analytics, Maps	IP address, usage data, geolocation	US (EU-US DPF)
Resend Inc.	Transactional email	Email address	US
Stripe Inc.	Payment processing	Payment card data, email, billing address	US (EU-US DPF)

International transfers to the US rely on the EU-US Data Privacy Framework certification of each provider, or Standard Contractual Clauses where DPF is not available.

5. How long we keep your data

• Tour email leads: Until you request deletion or 3 years, whichever is sooner.
• Account data: Until you delete your account.
• Server logs: 90 days.
• Analytics data: 14 months (Google Analytics default).
• Payment records: As required by tax law (typically 7-10 years).

6. Your rights

Under the GDPR, you have the right to:

• Access � request a copy of all personal data we hold about you.
• Rectification � correct inaccurate or incomplete data.
• Erasure � request deletion of your data ("right to be forgotten").
• Restriction � limit how we process your data.
• Portability � receive your data in a machine-readable format.
• Object � object to processing based on legitimate interest.
• Withdraw consent � for any processing based on consent, at any time.

To exercise any of these rights, email hi@flip-trip.com. We will respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority in your country of residence.

7. Security

We protect your data with HTTPS encryption, hashed passwords, access controls, and regular security reviews. No system is 100% secure, but we take reasonable technical and organizational measures to protect your information.

8. Children

FlipTrip is not directed at children under 16. We do not knowingly collect data from children. If you believe we have collected data from a child, contact us and we will delete it promptly.

9. Changes to this policy

We may update this policy from time to time. Material changes will be announced on the site. The "Last updated" date at the top reflects the most recent revision.