Privacy Policy

The operator of the Service is Surfverse Inc., United States. We provide an online marketplace through which individuals can discover and book surf lessons, surfskate and related training, and selected events, primarily in Bali, Indonesia, offered by independent coaches and operators.

Questions about this Policy or our handling of personal information may be sent to bookings@surfverse.io. We do not publish a registered-agent street address in this Policy.

We collect personal information that you provide directly, information generated when you use the Service, and limited information from service providers that help us operate bookings and payments. The categories we collect include the following.

Account and contact information

When you register, we collect your name, email address, mobile telephone number (used as your WhatsApp contact), Telegram handle, self-reported surfing level, and language preference. We use email to send a one-time passcode (“OTP”) to create or access your account. We do not use a password for client login.

Booking details

When you book a session, we collect the session or service selected, date and time (including the Bali local time of the activity), location, number of participants, training or package information, lesson language where applicable, booking status, and related operational notes needed to fulfill the booking.

Payment information

Payments are processed in United States dollars by Stripe. We receive payment status and related transaction identifiers (for example, whether a booking is unpaid, paid, expired, or cancelled). We do not store full payment-card numbers, card security codes, or complete bank-account numbers on our systems. Card details are submitted directly to Stripe in accordance with Stripe’s terms and privacy notice.

Communications

If you contact us, we collect the content of your message and any contact details you include. We also send transactional messages, including OTP codes, booking confirmations, and service notices.

Technical and usage data

Our hosting provider and the Service may automatically collect standard technical data such as IP address, browser type, device information, approximate request time, referring URL, and pages or API routes requested. This information is used for security, reliability, and operation of the Service.

We use personal information for the following purposes:

1. Accounts and authentication. To create and maintain your account, send and verify email OTP codes, keep you signed in, and prevent unauthorized access.
2. Bookings and payments. To create, confirm, update, expire unpaid holds, and otherwise administer bookings, and to process or record payment status through Stripe.
3. Coordination with coaches and operators. To share the information reasonably needed for an assigned coach or operator to deliver the booked session (for example, first name or full name, session time and place, participant count, and relevant skill or language notes).
4. Customer support and operations. To respond to requests, resolve issues, and communicate about schedule changes.
5. Security and integrity. To detect abuse, enforce our Terms, protect users and providers, and maintain the security of the Service.
6. Service improvement. To understand how the Service is used, fix defects, and improve booking reliability. Optional analytics tools (described in Section 6) run only if you accept analytics cookies.
7. Legal compliance. To comply with applicable law, respond to lawful requests, and establish, exercise, or defend legal claims.

We do not sell your personal information. We share information only as described in this Policy or with your direction, including with the following categories of recipients.

Payment processor

Stripe processes card payments and related checkout data. Stripe acts as an independent controller or processor of payment-card data according to its own terms. We receive confirmation of payment status and identifiers needed to match a payment to a booking.

Hosting and infrastructure

The Service is hosted on Vercel. Vercel and its infrastructure partners may process technical logs and request data as needed to host, secure, and deliver the Service.

Email delivery

We use Resend to send transactional email, including OTP codes, welcome messages, and booking-related notices. Resend processes the recipient address and message content for delivery.

Messaging used for booking operations

We use Telegram to notify coaches and, where applicable, operators about bookings assigned to them. Notifications are limited to information needed to fulfill the session. We may contact you on WhatsApp or Telegram at the handles or numbers you provide to confirm details, share meeting instructions, or communicate about a booking. Those messaging platforms process communications under their own terms.

Coaches and operators

Coaches and operators are independent providers. They receive only the booking information they need to deliver the session. They are not authorized to use guest information for unrelated marketing.

Operations and customer records

We may maintain client and booking records in Airtable or a similar operations tool used as our customer-relationship system of record, so that our team can coordinate sessions and support.

Legal and business transfers

We may disclose information if we believe in good faith that disclosure is required by law, necessary to protect the rights, safety, or property of Surfverse, our users, or the public, or in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality protections.

We use a small number of essential storage technologies to operate the Service. Optional analytics cookies (Section 6) are set only after you press “Accept” in the cookie banner; if you press “Decline” or make no choice, they are not loaded.

1. Authentication cookie. After you verify your email, we set an HTTP-only session cookie (named sj_session) that stores an opaque session token. The cookie is used to keep you signed in. It does not contain your email address or other profile fields.
2. Legacy or prototype session cookie. In some environments a limited email session cookie (sj-user-email) may still be used for compatibility. It is not used to serve ads.
3. Local storage. The browser may store a cached copy of your profile (surfjoint-client-session), your language preference (surfjoint-locale), and items you mark as favorites (surfjoint-favorites). These values stay on your device unless you clear site data.
4. Maps. When you view the map, the Service loads map tiles through client mapping libraries (Leaflet and MapLibre). The tile provider may receive a technical request from your device (such as IP address) in order to deliver the map.
5. Stripe Checkout. If you pay for a booking, Stripe may set cookies on Stripe’s own domain as part of checkout and fraud prevention.
6. Consent choice. Your answer to the cookie banner is stored in local storage (sv-analytics-consent) so we do not ask again on every page.

You can block or delete cookies through your browser settings. If you block the authentication cookie, you will not remain signed in. Clearing local storage will remove cached profile, language, and favorites data on that device.

With your consent, the Service uses the following analytics tools to measure visits, listing views, and booking steps: Google Analytics 4 (Google), Google Tag Manager where configured, Meta Pixel (Meta Platforms), and PostHog (product analytics). These tools may set cookies or local-storage identifiers and receive technical data such as IP address, device and browser information, pages viewed, and referral source. They are loaded only after you press “Accept” in the cookie banner.

If you decline, these tools are not loaded in your browser. When a booking is paid, our servers may still send a payment-confirmation event (amount, currency, booking reference, and an internal account identifier, but no browser cookies) to these analytics providers so our business records stay accurate. You can withdraw consent at any time by clearing this site’s data in your browser, after which the banner will ask again.

Our hosting provider may also generate aggregated or technical logs that help us understand traffic, errors, and uptime.

We retain personal information for as long as needed to provide the Service and for a reasonable period thereafter for legitimate business, security, accounting, and legal purposes.

Account information is kept while your account remains active. Booking and payment-status records are retained as needed to fulfill sessions, handle cancellations or refunds, prevent fraud, and meet record-keeping obligations. Session cookies expire according to their configured lifetime or when you log out. Unpaid booking holds may expire after a limited period if payment is not completed.

If you request deletion of your account, we will delete or de-identify personal information we no longer need, except where we must retain information to complete a booking, resolve a dispute, comply with law, or protect our rights. Residual copies may remain in encrypted backups for a limited time until those backups cycle.

Subject to applicable United States law and any other law that applies to you, you may request access to the personal information we hold about you, correction of inaccurate information, and deletion of your account or certain personal information.

To exercise these rights, email bookings@surfverse.io from the address associated with your account and describe your request. We may need to verify your identity before completing the request. We will respond within a reasonable period.

You may also update certain profile details by contacting us, and you may log out to end the current session. If you are located in a jurisdiction that grants additional rights (for example, the right to appeal a denial or to lodge a complaint with a supervisory authority), you may exercise those rights to the extent they apply.

We use administrative, technical, and organizational measures designed to protect personal information, including HTTPS in production, hashed session tokens, HTTP-only cookies for authentication, and access limited to personnel and systems that need the information to operate the Service. OTP codes expire and are rate-limited.

No method of transmission or storage is completely secure. We cannot guarantee absolute security of information transmitted to or stored by the Service or by third-party providers such as Stripe, Vercel, Resend, Telegram, or WhatsApp.

Surfverse Inc. is based in the United States. The Service is used by guests who book activities primarily in Bali, Indonesia. Personal information may be processed in the United States, in Indonesia, and in other countries where our service providers (including Vercel, Stripe, Resend, and messaging platforms) operate.

Those countries may have data-protection laws that differ from the laws of your home country. By using the Service, you understand that your information may be transferred to and processed in the United States and other jurisdictions as described in this Policy.

The Service is intended for individuals who are 18 years of age or older. We do not knowingly collect personal information from children under 18. If you believe we have collected information from a person under 18, please contact bookings@surfverse.io and we will take appropriate steps to delete it.

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page will change when we do. The updated Policy will apply to information collected after the effective date and to existing information to the extent permitted by law. Material changes may also be communicated by email or a notice on the Service. Your continued use of the Service after an update constitutes acceptance of the revised Policy.

For privacy requests, questions, or complaints, contact Surfverse Inc. at bookings@surfverse.io. Please include “Privacy” in the subject line and enough information for us to identify your account and respond.