Privacy Policy
Your privacy matters. Here is exactly what data we collect, how we use it, and how you can control it.
Overview
What This Policy Covers
This Privacy Policy explains how WKND Company ("WKND," "we," "us," or "our") collects, uses, shares, and protects your personal information when you use the WKND platform at wkndtour.com and our associated city market domains.
We take your privacy seriously. This policy is written in plain language so you can understand exactly what happens with your data. We comply with applicable privacy laws including the California Consumer Privacy Act (CCPA), the General Data Protection Regulation (GDPR) for EU users, and the CAN-SPAM Act for email communications.
Information We Collect
Information You Provide Directly
- Account information: name, email address, phone number, profile photo
- Payment information: processed and stored securely by Stripe (we never store card numbers)
- Booking details: events, travel dates, preferences, group size
- Social content: posts, stories, threads, reviews, photos, and videos you share
- Communications: support messages, feedback, survey responses
- Profile preferences: bio, social links, notification settings, dietary preferences
- Ambassador/vendor onboarding: business name, tax ID (for 1099 reporting), bank details (via Stripe Connect)
Information Collected Automatically
- Device information: browser type, operating system, device model, screen resolution
- Usage data: pages visited, features used, search queries, time spent on pages
- Location data: approximate location from IP address (precise GPS only with your explicit permission)
- Referral data: how you arrived at WKND (referral link, search engine, social media)
- Cookies and similar technologies: see our Cookie Policy at /info/cookies
Information From Third Parties
- Authentication providers: if you sign in with Google or Apple, we receive your name and email
- Payment processors: Stripe provides transaction status and payment confirmations
- Public venue data: venue information from Yelp and Eventbrite APIs to enrich listings
How We Use Your Information
To Provide Our Services
- Process bookings for events, flights, hotels, and experiences
- Facilitate payments, refunds, and escrow releases
- Calculate and pay ambassador commissions
- Send booking confirmations, travel updates, and receipts
- Enable communication between travelers, vendors, and ambassadors
- Maintain trip wallets and itineraries
To Personalize Your Experience
- Recommend events, venues, and experiences based on your preferences and history
- Power AI-generated articles and venue summaries tailored to your interests
- Calculate match percentages on events and experiences
- Curate your social feed and discovery page
To Operate and Improve the Platform
- Analyze usage patterns to improve features and fix issues
- Prevent fraud, spam, and abuse
- Enforce our Terms of Service and community guidelines
- Generate aggregated, anonymized analytics (never sold to third parties)
To Communicate With You
- Send service-related notifications (booking updates, security alerts)
- Deliver marketing emails and newsletters (only with your consent, easy to unsubscribe)
- Notify you of policy changes and platform updates
- Respond to support requests
How We Share Your Information
Service Providers We Work With
- Stripe (stripe.com/privacy) -- payment processing and payouts
- Supabase (supabase.com/privacy) -- database hosting and authentication
- Vercel (vercel.com/legal/privacy-policy) -- application hosting and deployment
- GoDaddy SMTP -- transactional email delivery
- Google Analytics (policies.google.com/privacy) -- website analytics
- Anthropic (anthropic.com/privacy) -- AI content generation
- Yelp API (yelp.com/developers/api_terms) -- venue data and photos
- Eventbrite API (eventbrite.com/platform/api) -- event data
- Duffel (duffel.com/legal/privacy-policy) -- flight search and booking
- Booking.com via RapidAPI -- hotel search
Other Sharing
- With vendors and service providers: your booking details (name, contact, booking specifics) so they can fulfill your reservation
- With other users: your public profile, social posts, and reviews are visible to other platform users
- With ambassadors: limited referral data (that you signed up and made a booking, not your personal details)
- Legal requirements: when required by law, court order, or to protect safety
- Business transfers: in connection with a merger, acquisition, or sale of assets (you would be notified)
We Never Sell Your Personal Data
WKND does not sell your personal information to third parties for advertising or any other purpose. We do not share your data with advertisers for targeted advertising. Period.
Data Retention
How Long We Keep Your Data
- Active account data: retained while your account is active
- Deleted account data: purged within 30 days of account deletion, except as noted below
- Booking and transaction records: 7 years (required for tax and legal compliance)
- Points and loyalty data: 12 months after point expiration
- Support communications: 3 years after resolution
- Analytics data: 26 months, then anonymized
- Email logs: 2 years for deliverability tracking
Your Rights
All Users Have the Right To
- Access: request a copy of the personal data we hold about you
- Correction: update or correct inaccurate information
- Deletion: request deletion of your account and associated data
- Export: receive your data in a portable, machine-readable format
- Opt-out: unsubscribe from marketing emails at any time
- Object: object to certain processing activities
Additional Rights for California Residents (CCPA)
- Right to know what personal information we collect and how it is used
- Right to delete personal information we have collected
- Right to opt-out of the sale of personal information (we do not sell data, but you can still make this request)
- Right to non-discrimination for exercising your privacy rights
- To make a CCPA request, email privacy@wkndtour.com with subject line 'CCPA Request'
Additional Rights for EU/EEA Users (GDPR)
- Right to data portability: receive your data in a structured, commonly-used format
- Right to erasure (right to be forgotten): request complete deletion of your data
- Right to restrict processing: limit how we use your data
- Right to withdraw consent at any time
- Right to lodge a complaint with your local data protection authority
- To make a GDPR request, email privacy@wkndtour.com with subject line 'GDPR Request'
How to Exercise Your Rights
For any privacy request, email privacy@wkndtour.com. We will respond within 30 days (45 days for complex CCPA requests). We may ask you to verify your identity before processing your request. You can also update most information directly in your account settings.
Children's Privacy
Age Requirements
WKND is not intended for users under 18 years of age. We do not knowingly collect personal information from anyone under 18. If we discover that we have inadvertently collected data from a minor, we will delete it promptly. Parents or guardians who believe their child has provided information to WKND should contact us at privacy@wkndtour.com.
Data Security
How We Protect Your Data
- HTTPS/TLS encryption for all data in transit
- Encryption at rest for database storage (via Supabase/AWS)
- PCI-compliant payment processing through Stripe (we never handle raw card data)
- Rate limiting and abuse detection on all API endpoints
- Role-based access controls for internal team members
- Row-Level Security (RLS) policies in our database ensuring users can only access their own data
- Regular security reviews and dependency updates
Breach Notification
In the unlikely event of a data breach affecting your personal information, we will notify affected users within 72 hours via email and platform notice, as required by applicable law.
International Data Transfers
Where Your Data Is Stored
WKND's primary infrastructure is hosted in the United States (AWS us-west-2 region via Supabase). If you are accessing WKND from outside the US, your data will be transferred to and processed in the United States. We rely on standard contractual clauses and other approved transfer mechanisms for international data transfers as required by applicable law (including GDPR). By using WKND, you consent to your data being processed in the United States.
Email Marketing (CAN-SPAM Compliance)
Our Email Practices
- We only send marketing emails to users who have opted in (newsletter subscriptions, account preferences)
- Every marketing email includes a clear unsubscribe link
- Unsubscribe requests are processed within 24 hours
- We do not use misleading subject lines or deceptive headers
- Our emails clearly identify WKND as the sender
- Service-related emails (booking confirmations, security alerts) are not marketing and may be sent without opt-in
Changes to This Policy
How We Handle Updates
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by email and update the "Last Updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of WKND after changes are posted constitutes acceptance of the updated policy.
Contact Us
Privacy Team
For any privacy-related questions, requests, or concerns:
Email: privacy@wkndtour.com
General Support: support@wkndtour.com
Address: WKND Company, 2711 E Jefferson Ave, Detroit, MI 48207
We aim to respond to all privacy inquiries within 5 business days.
Have questions about your privacy?
Our privacy team responds to all inquiries within 5 business days.