Privacy Policy

Who we are

Experiencefront (experiencefront.com) provides software and booking/payment facilitation for independent tour operators, destination management companies (DMCs), and guides. Experiences are supplied and operated by those hosts; we process bookings and payments on their behalf.

What we collect

• Booking information — name, email address, guest count, and any custom fields required by your host for the experience
• Payment details — card details are collected by Stripe on behalf of the host and are never stored by Experiencefront
• Usage data — with your consent only, first-party analytics cookies measuring which experiences travelers browse
• Host information — business registration, insurance documents, and permit documents provided by operators during onboarding
• Security signals — IP addresses and request logs for fraud prevention and platform security

How we use it

• To process your booking and send you a confirmation
• To communicate with you about your booking (updates, host messages)
• To help hosts manage their listings and receive payments
• To improve the platform — analytics only with your consent
• To meet our legal obligations (tax records, fraud prevention)

How long we keep it

• Booking and payment records: retained for the period required by applicable tax and consumer protection laws (typically 7 years for financial records)
• Analytics consent decisions: kept for the duration of your consent plus any legally required retention period after withdrawal
• Server security logs: up to 90 days

Cross-border transfers

Some of your personal information may be processed by our service providers located outside Quebec and Canada, including in the United States. We require contractual safeguards for any such transfer.

AI-assisted features

We use AI to help operators draft listing copy, read trip-update messages, parse RFP emails, and draft guest itineraries. Content submitted to these features — which can include personal information such as names in an email — is processed by third-party AI providers (currently models routed via OpenRouter, such as DeepSeek, and/or Anthropic and OpenAI when configured). AI output is always reviewed by a human before anything is saved or sent.

Service providers

These third parties may process personal information on our behalf. New sub-processors are listed at least 30 days before they begin processing, so you have time to object. View our sub-processors list.

Your rights

Depending on where you are located, you may have the right to access, correct, or request deletion of your personal information, withdraw consent for analytics at any time (via the Cookie preferences button at the bottom of any page), or file a complaint with your local data protection authority.

If you have an Experiencefront account, use the self-service Privacy Center to download your data, request a correction, or request deletion — we respond within 30 days. If you booked as a guest without an account, email us and we will run your request on the same 30-day clock.

To exercise your rights or ask a privacy question, contact: [email protected]

Cookies

For details on the cookies we use and how to manage your choices, see our Cookie Notice.

Changes to this policy

We may update this policy as the platform evolves. Material changes will be accompanied by an updated date above and, where required by law, renewed consent.