Privacy

Who we are

Craft Getaways is run by Sentient Mind Ltd, a company registered in the United Kingdom. Sentient Mind Ltd is the controller of your personal data under UK data protection law (the UK GDPR and the Data Protection Act 2018). That means we decide how it is used, and we are responsible for it. We are registered with the ICO, number ZB992206.

What we collect

• Your account: your email address and, if you give them, your name and phone number.
• Your saved retreats: the retreats you save, kept with your account until you remove them or close your account.
• Your bookings: who is coming, your note to the host, and what you paid. Card numbers go to Stripe, not to us.
• Messages you send a host through our site, and messages you send us through Contact us. We keep them for 2 years.
• If you report a listing, your reason and note, and your account if you're signed in. We keep a report for 2 years after we've dealt with it.
• With each message or report we keep a scrambled form of your internet address, to stop spam. For messages to us and reports, we clear it within about 4 months.
• Your choice about retreat news emails: whether you said yes, when, and the words you agreed to.
• If you host: how guests pay you, which we show to guests after they book.

Why we use it

• To run your account and your bookings, take payment and make refunds. We need your details to do what you ask of us when you book.
• To send you emails about your bookings and your account.
• To keep the site safe and stop spam and fraud. We have a legitimate interest in doing this.
• To keep the records that tax and accounting law requires.
• To send you news about retreats, only if you said yes. You can say no at any time in your email preferences.

Who sees your details

Your host sees your name, email, phone number, the names on your booking and your note, so they can run the retreat. We see them too, to send your receipts and help if something goes wrong. Your card details go to our payment provider, Stripe. Neither we nor the host see your card number. We never sell your details.

We share your name and contact details only with the host of the retreat you booked, and only for that booking. Our terms for hosts say they may use them only to run that retreat. They must keep them safe, and delete them when they no longer need them.

We show a host's payment instructions only to guests who have booked that retreat.

Companies that handle data for us

• Stripe: takes card payments.
• Supabase: stores our database and handles sign-in.
• Vercel: hosts the website.
• Resend: sends our emails.
• Cloudflare Turnstile: checks that forms are sent by people, not spam robots.
• Sentry: tells us when something on the site goes wrong.
• Google Maps Platform: finds venue addresses and shows maps.
• OpenRouter: reads listing text that hosts paste in, to fill in their listing.

These companies handle data only to provide their service to us. Some of them store or handle it in the United States. When data goes from the UK to the US, we rely on the UK-US data bridge where the company has signed up to it. Otherwise we rely on contract terms the UK Information Commissioner has approved: the International Data Transfer Agreement, or the Addendum to the EU's standard terms.

How long we keep it

• Your account details: until you close your account.
• Messages and reports: as the list above says.
• Booking and payment records: for as long as tax and accounting rules require, up to 7 years. When you close your account, we keep them without your name or contact details.

Cookies

We use only the cookies the site needs to work.

Recently viewed is kept only in your browser on this device. We don't store it with your account.

Retreats you save before you sign in are kept only in your browser. When you sign in, we add them to your account.

Your rights

You can ask us for a copy of the details we hold about you. You can ask us to correct them, or to delete them and close your account. You can also ask us to stop using them for a purpose, or object to how we use them. You can ask for a copy to take elsewhere. If you said yes to news emails, you can change your mind at any time. To ask, use Contact us. We'll email you to confirm it's you, and we reply within one month.

If you're unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk. We'd like the chance to put it right first, so please tell us too.

What we delete and what we keep

We'll email you to confirm it's you before we delete anything. Some things need sorting out first, for example, an upcoming booking or being the only owner of a host account. When we close your account, we remove your name, email address and phone number from it and from your bookings, delete your saved retreats and email choices, and clear the messages you sent us or a host. We keep a record of your past bookings and payments, without your name or contact details, because tax and accounting rules require it. A problem you reported about a retreat stays with its booking, and a listing you reported keeps your report without your name. Stripe, our payment provider, keeps its own payment records. Emails a host already got from us may still be in their inbox, and our sign-in provider's security log may still show your email address.