Skip to content
Island Mystiq

Privacy Policy

Last updated: May 2026

What We Collect

When you make a booking, we collect your name, email, phone number, and payment information. Payment details are processed by Stripe and never stored on our servers. We also collect usage data to improve our service.

How We Use Your Data

Your personal information is used to process bookings, send confirmation emails, coordinate with drivers, and provide customer support. We do not sell your data to third parties.

Data Storage

Your data is stored securely using Supabase (PostgreSQL) with row-level security policies. Driver KYC documents are stored in private encrypted buckets.

Your Rights

You may request access to, correction of, or deletion of your personal data at any time by contacting us through our contact page.

Cookies

We use essential cookies for authentication and session management. Analytics cookies (Google Analytics 4) are only loaded after you give consent via the banner on this site. You may withdraw consent at any time by clearing your browser's local storage or contacting us.

Data Retention

Booking and payment records are retained for 7 years to comply with legal and tax obligations. Analytics data is retained for 26 months (Google Analytics default). Driver KYC documents are retained while a driver's account is active and deleted within 90 days of account closure.

Your Rights (GDPR & CCPA)

If you are located in the European Union or California (USA), you have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data ("right to be forgotten")
  • Request a portable copy of your data
  • Object to or restrict certain processing

To exercise any of these rights, email us at privacy@islandmystiqtours.com. We will respond within 30 days.

International Data Transfers

Your data is stored using Supabase (hosted on AWS infrastructure in the United States). By using our service, you consent to this transfer. We implement appropriate technical and organisational measures to protect your data during transfer and storage.