Privacy Policy

InnVibes ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our hotel booking services (the "Platform"). Please read this Privacy Policy carefully. If you do not agree with the terms of this Privacy Policy, please do not access the Platform.

We collect information that you provide directly to us and information collected automatically when you use the Platform. **Information You Provide:** • Account information: name, email address, and profile details when you create an account via our authentication provider (Clerk) • Booking information: guest names, contact details, and special requests when making reservations • Payment information: processed securely by our PCI-DSS compliant payment provider—we do not store your full card details • Communication data: messages you send through our contact form or support channels • Referral information: when you participate in our referral program **Information Collected Automatically:** • Device information: browser type, operating system, device identifiers • Usage data: pages visited, search queries, booking activity, and interaction patterns • Location data: approximate location based on IP address to provide relevant currency and destination suggestions • Cookies and tracking technologies: see Section 6 for details

We use the information we collect for the following purposes: • **Provide our services:** Process bookings, manage your account, and deliver customer support • **Personalize your experience:** Show relevant destinations, remember your preferences, and display prices in your preferred currency • **Loyalty program:** Track and manage your Good Vibes Club points, tier status, and rewards • **Communication:** Send booking confirmations, updates, and respond to your inquiries • **Marketing:** With your consent, send promotional offers and travel deals (you can opt out at any time) • **Analytics:** Understand how the Platform is used to improve our services • **Security:** Detect and prevent fraud, unauthorized access, and other harmful activities • **Legal compliance:** Meet our legal obligations and enforce our Terms of Service

We do not sell your personal information. We may share your information with: • **Hotel providers:** To complete your bookings, we share necessary guest information (name, contact details, special requests) with the hotel property • **Payment processors:** To process your payments securely • **Authentication provider (Clerk):** To manage your account and login security • **Database provider (Convex):** To store your account data, bookings, and preferences securely • **Analytics providers:** Aggregated, non-identifiable usage data to help us improve the Platform • **Legal authorities:** When required by law, court order, or governmental regulation • **Business transfers:** In connection with any merger, acquisition, or sale of assets All third-party providers are contractually obligated to protect your data in accordance with applicable data protection laws.

We retain your personal information for as long as your account is active or as needed to provide you services. Specifically: • **Account data:** Retained while your account is active and for up to 2 years after account deletion • **Booking records:** Retained for 7 years for legal and tax compliance purposes • **Communication records:** Retained for up to 3 years • **Usage data:** Retained in aggregated, anonymized form indefinitely You may request deletion of your data at any time by contacting us. Some data may be retained as required by law.

We use cookies and similar technologies to enhance your experience: • **Essential cookies:** Required for the Platform to function (authentication, session management, security) • **Preference cookies:** Remember your settings such as preferred currency and language • **Analytics cookies:** Help us understand how you use the Platform to improve our services • **Marketing cookies:** Used to deliver relevant advertisements, with your consent You can manage your cookie preferences through your browser settings. Note that disabling essential cookies may affect the Platform's functionality. We do not use invasive tracking or sell data to advertising networks.

We implement industry-standard security measures to protect your personal information: • All data transmission is encrypted using TLS/SSL • Payment processing is handled by PCI-DSS Level 1 compliant providers • Access to personal data is restricted to authorized personnel only • Regular security audits and vulnerability assessments • Secure cloud infrastructure with data encryption at rest While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

Depending on your location, you may have the following rights regarding your personal data: • **Access:** Request a copy of the personal data we hold about you • **Correction:** Request correction of inaccurate or incomplete data • **Deletion:** Request deletion of your personal data (subject to legal retention requirements) • **Portability:** Request your data in a structured, machine-readable format • **Objection:** Object to processing of your data for certain purposes • **Withdrawal of consent:** Withdraw consent for marketing communications at any time • **Restriction:** Request restriction of processing in certain circumstances To exercise any of these rights, contact us at privacy@innvibes.com or through our contact page. We will respond to your request within 30 days.

The Platform is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children under 18. If we discover that we have collected personal information from a child under 18, we will take immediate steps to delete that information. If you believe that a child has provided us with personal information, please contact us immediately.

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from those in your country. When we transfer your data internationally, we ensure appropriate safeguards are in place, including standard contractual clauses approved by relevant data protection authorities.

The Platform may contain links to third-party websites or services that are not operated by us. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party websites or services. We encourage you to review the privacy policy of every site you visit.

We may update this Privacy Policy from time to time. We will notify you of any material changes by: • Posting the updated policy on the Platform • Updating the "Last Updated" date at the top • Sending an email notification for significant changes (if you have an account) Your continued use of the Platform after any changes indicates your acceptance of the updated Privacy Policy.

If you have any questions about this Privacy Policy or our data practices, please contact us: • Email: privacy@innvibes.com • Contact page: innvibes.com/contact For data protection inquiries in the EU, you may also contact your local data protection authority.