Privacy Policy

Last updated: May 13, 2026

1. Introduction and Scope

Vacation-Aire LLC, doing business as Best by Locals (BestByLocals.com) ("Company," "we," "our," or "us") is committed to protecting the privacy and security of your personal information. This Privacy Policy ("Policy") describes how we collect, use, process, and disclose your personal information when you access or use our website, mobile applications, and related services (collectively, the "Service").

This Policy applies to all users of our Service, including visitors, registered users, and business partners. By accessing or using our Service, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy and consent to our collection, use, and processing of your personal information as described herein.

This Policy should be read in conjunction with our Terms of Service, which governs your use of the Service. Capitalized terms not defined in this Policy have the meanings given to them in our Terms of Service.

2. Categories of Personal Information We Collect

2.1 Information You Provide Directly

We collect information that you voluntarily provide to us, including:

Account Information: Name, email address, username, password, and profile information when you create an account
Contact Information: Name, email address, phone number, and mailing address when you contact us
Vacation Preferences: Travel dates, destination preferences, accommodation preferences, dining preferences, and activity interests
Payment Information: Credit card details, billing address, and payment history for premium services
Communications: Messages, reviews, ratings, and other content you submit through our Service
Survey and Feedback Data: Responses to surveys, feedback forms, and customer service interactions
Marketing Preferences: Communication preferences and marketing consent information

2.2 Information Collected Automatically

When you access or use our Service, we automatically collect certain information about your device and usage patterns:

Device Information: Device type, operating system, browser type and version, screen resolution, device identifiers
Usage Data: Pages visited, time spent on pages, click-through rates, search queries, and user interaction patterns
Location Data: IP address-based location, GPS coordinates (with permission), and location preferences
Technical Data: IP address, cookies, pixel tags, server logs, and error reports
Referral Information: Referring websites, search engines, and marketing campaign data
Performance Data: Page load times, application crashes, and system performance metrics

2.3 Information from Third Parties

We may receive information about you from third-party sources, including:

Business Partners: Information from restaurants and activity providers listed on our platform
Social Login Providers: Profile information when you sign in with Google or Facebook (see Section 2.5)
Analytics Providers: Usage statistics and demographic information

2.5 Social Login (Google & Facebook)

When you choose to sign in or create an account using Google or Facebook, we receive the following information from those platforms:

Name and Email Address: Used to create or link your Best by Locals account
Profile Picture: Displayed on your account profile (optional)
Provider User ID: A unique identifier from Google or Facebook used solely to authenticate your account — we do not access your friends list, posts, or other social data

We request only the minimum permissions necessary. Connecting a social account does not grant us access to post on your behalf, read your messages, or access your contacts. You can unlink a social login at any time from your Account Settings. If you signed in via Facebook and wish to remove all associated data from our platform, see Section 7: Account & Data Deletion.

2.4 Cookies and Tracking Technologies

We use various tracking technologies including cookies, web beacons, pixel tags, and local storage to enhance your experience and collect usage information. For comprehensive details about our use of cookies and your choices regarding them, please review our Cookie Policy.

3. Legal Bases and Purposes for Processing Personal Information

We process your personal information only when we have a valid legal basis to do so. Our legal bases and purposes include:

3.1 Contract Performance

We process your information to fulfill our contractual obligations to you, including:

Service Delivery: Providing personalized vacation recommendations and planning services
Account Management: Creating and maintaining your user account and preferences
Transaction Processing: Processing payments and managing billing for premium services
Customer Support: Responding to inquiries, resolving issues, and providing technical assistance
Communication: Sending service-related notifications and updates about your account

3.2 Legitimate Business Interests

We may process your information for our legitimate business interests, including:

Service Improvement: Analyzing usage patterns to enhance functionality and user experience
Security and Fraud Prevention: Protecting against unauthorized access, fraud, and security threats
Business Operations: Internal research, development, and quality assurance
Marketing and Advertising: Promoting our services and communicating about new features
Analytics: Understanding user behavior and measuring service effectiveness

3.3 Legal Compliance

We process information to comply with legal obligations, including:

Regulatory Requirements: Meeting industry regulations and compliance standards
Legal Proceedings: Responding to legal requests, court orders, and government investigations
Tax and Financial Reporting: Maintaining records for tax and financial compliance
Data Protection Laws: Fulfilling obligations under privacy and data protection regulations

3.4 Consent

Where required by law or where we rely on consent as our legal basis, we will obtain your explicit consent before processing your personal information. You have the right to withdraw your consent at any time, though this will not affect the lawfulness of processing based on consent before its withdrawal.

4. Information Sharing, Disclosure, and Transfers

We do not sell, rent, or trade your personal information to third parties. We do not share your personal information for cross-context behavioral advertising. We may share your information only in the specific circumstances described below:

4.1 Service Providers and Business Partners

Technology Partners: Cloud hosting providers, content delivery networks, and analytics services
Payment Processors: Financial institutions and payment service providers for transaction processing
Customer Support: Third-party customer service platforms and communication tools
Marketing Services: Email marketing platforms and advertising networks (with your consent)
Business Partners: Restaurants, activity providers, and service businesses listed on our platform

4.2 Legal and Regulatory Disclosures

Legal Compliance: When required by law, regulation, court order, or government investigation
Safety and Protection: To protect the rights, property, or safety of our users, company, or others
Fraud Prevention: To investigate and prevent fraudulent transactions and illegal activities
Enforcement: To enforce our Terms of Service and other legal agreements

4.3 Business Transactions

In the event of a merger, acquisition, financing, sale of assets, or similar business transaction, your personal information may be transferred to the acquiring entity, subject to appropriate confidentiality and security measures.

4.4 Aggregated and De-identified Data

We may share aggregated, anonymized, or de-identified information that cannot reasonably be used to identify you for research, analytics, and business purposes.

4.5 International Data Transfers

Your personal information may be transferred to and processed in countries other than your country of residence, including the United States. We ensure appropriate safeguards are in place through:

Standard contractual clauses approved by relevant data protection authorities
Adequacy decisions recognizing equivalent levels of data protection
Certification schemes and codes of conduct for international transfers
Your explicit consent for specific transfers where required

5. Data Retention

We retain your information only as long as necessary for the purposes outlined in this policy:

Data Type	Retention Period	Purpose
Account & Profile Data	Until deletion requested + 30-day grace period	Account management and service delivery
Vacation Plans	Until account deletion	Saving and accessing your plans
Reviews & Favorites	Until account deletion	Personalized recommendations
Social Login (Google/Facebook)	Until account deletion or social account unlinked	Authentication
Location Preferences	1 year	Personalized recommendations
Search History	6 months	Service improvement
Technical Logs	30 days	Security and maintenance
Analytics Data	13 months	Usage analysis
Payment Records	7 years	Tax and financial compliance

6. Your Rights and Choices

You have the following rights regarding your personal information:

Access: Request access to your personal information we hold
Correction: Request correction of inaccurate or incomplete information
Deletion: Request deletion of your personal information — see Section 7 for step-by-step instructions
Portability: Request a copy of your data in a structured, machine-readable format
Objection: Object to certain processing of your personal information
Restriction: Request restriction of processing under certain circumstances
Withdraw Consent: Withdraw consent where processing is based on consent

To exercise these rights, please contact us at privacy@bestbylocals.com.

7. Account & Data Deletion

You have the right to permanently delete your account and all associated personal data at any time. We provide an in-app deletion flow so you do not need to contact us to exercise this right.

7.1 How to Delete Your Account (In-App)

Sign in to your Best by Locals account at www.bestbylocals.com
Go to your Profile (top-right menu) and select Settings
Navigate to the Privacy & Security tab
Scroll to Delete Account and follow the confirmation steps

7.2 What Happens After You Request Deletion

Your account is immediately deactivated and you are signed out of all devices
A 30-day grace period begins — you may cancel the deletion by signing back in during this window
After 30 days, all personal data is permanently and irreversibly deleted, including: your profile, vacation plans, saved favorites, reviews, and social login associations (Google/Facebook)
Anonymized or aggregated data that cannot identify you may be retained for analytics purposes
Financial transaction records may be retained for up to 7 years as required by law

7.3 Deletion via Facebook

If you signed up or signed in using Facebook Login, you can remove access to Best by Locals from your Facebook account at any time by visiting Facebook Settings → Apps and Websites and removing Best by Locals. This revokes our access to your Facebook account but does not automatically delete your Best by Locals account. To permanently delete all your data from our platform, use the in-app deletion flow described in Section 7.1, or contact us at privacy@bestbylocals.com.

7.4 Contact Us for Deletion Requests

If you are unable to access your account to initiate deletion, email us at privacy@bestbylocals.com with the subject line "Account Deletion Request" and include the email address associated with your account. We will process your request within 30 days.

8. Data Security

We implement appropriate technical and organizational security measures to protect your information:

SSL/TLS encryption for data transmission
Regular security assessments and updates
Access controls and employee training
Secure data storage and backup procedures
Incident response and breach notification procedures

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

9. Third-Party Services

Our service integrates with the following third-party providers, each with their own privacy policies:

Meta (Facebook Login): Social authentication — see Meta Privacy Policy
Google (Google Sign-In): Social authentication and maps — see Google Privacy Policy
Stripe: Payment processing for business subscriptions — your payment card data is transmitted directly to Stripe and never stored on our servers
Supabase / PostgreSQL: Secure cloud database hosting for all application data
Cloudinary: Image storage and optimization for business and user photos
SendGrid: Transactional email delivery (account notifications, deletion confirmations)
OpenAI: AI-assisted tag generation for business listings (business data only; no personal user data is sent)
Pinterest: We use the Pinterest Tag (a tracking pixel) and Pinterest Conversions API to measure how users interact with our content shared on Pinterest. This may collect browsing activity, IP address, and device information. If you are logged into Pinterest, your activity may be associated with your Pinterest account. See Pinterest Privacy Policy
Sentry: Error monitoring and performance tracking (may capture anonymized diagnostic data on errors)
Railway / Vercel: Backend and frontend cloud hosting infrastructure

We encourage you to review the privacy policies of these third-party services. We select providers who maintain appropriate data protection standards and contractual obligations.

10. Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with specific rights regarding your personal information.

10.1 Your Rights

Right to Know: You can request what personal information we collect, use, and disclose about you
Right to Delete: You can request deletion of your personal information (see Section 7)
Right to Correct: You can request correction of inaccurate personal information
Right to Opt-Out of Sale or Sharing: You can opt out of the sale or sharing of your personal information
Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

10.2 Sale and Sharing of Personal Information

We do not sell your personal information. We do not share your personal information with third parties for cross-context behavioral advertising.

In the future, Best by Locals may offer businesses the ability to purchase promotional placements on our platform. If we introduce advertising features that constitute "sharing" under the CCPA, we will update this policy and provide an opt-out mechanism before any such sharing begins.

10.3 How to Exercise Your Rights

To exercise any of these rights, contact us at privacy@bestbylocals.com with the subject line "California Privacy Request." We will verify your identity and respond within 45 days. You may also use the in-app account deletion flow described in Section 7.

11. Children's Privacy

Our Service is not intended for children under 13 years of age, and we do not knowingly collect personal information from children under 13. You must be at least 13 years old to create an account or use our Service. We implement age verification measures during account registration to prevent collection of information from children under 13.

If you are a parent or guardian and believe your child under 13 has provided us with personal information, please contact us immediately at privacy@bestbylocals.com. We will take steps to promptly delete such information from our systems.

Users between 13 and 18 years of age should review this Privacy Policy and our Terms of Service with a parent or guardian before using the Service.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Continued use of our service after changes constitutes acceptance of the updated policy.

13. Contact & Privacy Requests

If you have any questions about this Privacy Policy or our data practices, please contact us:

Email: privacy@bestbylocals.com
General Contact: support@bestbylocals.com
Website: www.bestbylocals.com