Privacy Policy
Last updated: September 2026. How we collect, use, share, and protect your personal information.
1. Introduction
This Privacy Policy explains how Jai's Vital Tour Essences ("we", "us", "our") collects, uses, shares, and protects your personal information when you use our website and services. It is written to a broad standard covering the EU/UK GDPR, the Jamaica Data Protection Act, and US state privacy laws including the CCPA/CPRA. If you have questions, contact us at support@jaisessences.com.
2. Who is responsible for your data (Controller)
The data controller is Jai's Vital Tour Essences. You can reach us by email at support@jaisessences.com or by phone at +1 (876) 237-9203. [PLACEHOLDER — the registered legal entity name and postal mailing address will be published here once confirmed by the business owner. This is required for full GDPR/CCPA compliance and must be completed before launch.] We have not appointed a Data Protection Officer or EU/UK representative; where one becomes legally required, their details will be added here.
3. Information we collect
We collect: (a) information you provide — your name, email, phone, address, travel preferences, occasion details, consultation notes, the details of other travelers you add to a booking, gift-card recipient details, messages you send us, and booking details; (b) account and authentication information needed to sign you in, and records of the consents you give (such as accepting these terms and any marketing opt-in), with a timestamp and policy version; and (c) limited technical information such as device and browser type and general, coarse location, used for security and to operate the site. We only ask for what we need to plan and deliver your travel.
4. Special-category information
If you tell us about dietary needs, accessibility requirements, or health-related requests to arrange a suitable trip, this may be "special-category" / sensitive personal information. We collect and use it only to fulfil your request, only with your explicit consent given at the point you provide it, and you can ask us to delete it at any time. Please do not send us sensitive information you do not want us to use for your trip.
5. How we use your information
We use your information to: create and manage your account; personalize recommendations; prepare, confirm, and manage bookings and consultations; calculate pricing and arrange payment; communicate with you about your trip; provide customer support; keep the platform secure and prevent fraud; and meet legal and accounting obligations. We do not sell or share your personal information for cross-context behavioral advertising, and we do not use it for automated decision-making that produces legal effects about you.
6. Legal bases
Where applicable law requires a legal basis, we rely on: performance of our contract with you (to provide the Services and your bookings); your consent (for optional marketing and for special-category data, each of which you can withdraw at any time); our legitimate interests (to secure and improve the Services); and compliance with legal obligations.
7. Payments
Our current payment methods are PayPal and direct bank transfer. If you pay with PayPal, your payment is processed by PayPal under its own terms and privacy policy; we receive confirmation of payment, not your full financial details. If you pay by direct bank transfer, you send funds to our business bank account using the reference we provide; we record the payment against your booking. We do not collect or store full card numbers on our systems.
8. Email & communications
Authentication emails (such as email verification and password reset) are handled by our authentication provider (Supabase). Where transactional email is enabled, booking and consultation messages are sent through our email-delivery provider (Resend). You control marketing preferences in your account settings and every marketing email includes an unsubscribe link; marketing categories are off by default and require your opt-in. Essential service messages required to operate your account and bookings cannot be switched off while your account is active.
9. Cookies & similar technologies
We use strictly-necessary cookies to sign you in, keep the site secure, and remember your session, and limited local storage to hold a booking or plan draft on your device. Non-essential technologies (such as analytics) do not run unless you opt in through our cookie banner; you can change or withdraw your choice at any time. See our Cookie Policy at /cookies for the itemized list. Disabling essential cookies may prevent parts of the Services from working.
10. Sub-processors — who we share information with
We share personal information only as needed to run the Services, with the following categories of sub-processors who process data on our behalf: Supabase (database, authentication, hosting of your data); Vercel (application hosting/CDN); Resend (transactional email, when enabled); Anthropic (AI travel concierge, only if you use that feature and only if enabled); and PayPal (payment processing, if you pay via PayPal). If you contact us via WhatsApp, that exchange is processed by Meta. We also share data with travel suppliers strictly as needed to fulfil a booking you request, and where required by law or to protect our rights. We require our providers to protect your information and use it only for the services they provide to us. A current, named sub-processor list is maintained and available on request.
11. Data retention
We keep personal information only as long as needed: account and profile data for as long as your account is active; booking, consultation, and payment records for up to 7 years to meet tax, accounting, and dispute-resolution obligations; contact-form and support messages for up to 24 months; marketing-consent records for as long as you are subscribed plus a short period as proof of consent; and technical/security logs for a short period. After the applicable period we delete or anonymize the data.
12. Data security
Your data is protected by authentication, database row-level security, server-side authorization, encryption in transit, and least-privilege access controls: customers can access only their own records, and we do not expose sensitive information through public URLs or client-side code. No method of transmission or storage is completely secure, but we work to protect your information and to limit access to it. If a personal-data breach affects your rights, we will notify you and the relevant authority as required by law.
13. Your rights
Subject to applicable law, you can: update your profile and control your communication preferences from your account settings; request erasure of your account; and request a copy of your data (access/portability), correction, restriction, objection, or portability by contacting us at support@jaisessences.com. We verify your identity and respond within the timeframes required by law. Some financial and legal records may be retained where the law requires. You will not be discriminated against for exercising your rights.
14. Your rights — EU/UK & Jamaica
If you are in the EU, UK, or Jamaica, you have the rights of access, rectification, erasure, restriction, portability, and objection described above, and you have the right to lodge a complaint with your data-protection supervisory authority (for example, the ICO in the UK, your national authority in the EU, or the Office of the Information Commissioner in Jamaica).
15. Your rights — California (CCPA/CPRA)
If you are a California resident, you have the right to know what personal information we collect and how we use and disclose it, to request access to and deletion of your information, to correct inaccurate information, and to opt out of any "sale" or "sharing" for cross-context behavioral advertising — which we do not do. We do not sell or share your personal information, and we do not use or disclose sensitive personal information beyond the purposes permitted by law. You may exercise these rights, including through an authorized agent, by contacting us at support@jaisessences.com; we will not discriminate against you for doing so.
16. International transfers
Your information may be processed on servers located outside your country, including in the United States, by our sub-processors. Where information is transferred across borders, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum), an adequacy decision where one applies, or your explicit consent, so that your information remains protected consistent with this Policy.
17. Third parties whose data you provide
If you give us information about other travelers on your booking, or about a gift-card recipient, you confirm you have their permission to do so and to share their details with us for that purpose. We will use that information only to arrange the relevant trip or gift, and the person concerned may contact us to exercise their privacy rights.
18. Children's privacy
The Services are intended for adults; you must be 18 or older to create an account, and we ask you to confirm this at signup. We do not knowingly collect personal information from children under 18 (or the age of digital consent in your jurisdiction). If you believe a child has provided us with information, contact us and we will delete it.
19. Changes to this policy
We may update this Policy from time to time. Material changes will be reflected by an updated date and version on this page and, where appropriate, we will notify you or ask you to re-confirm your consent.
20. Contact
Questions or requests about your privacy? Contact us through the contact page or at support@jaisessences.com.