Privacy Policy

1. Who is responsible for your data

Puerto Dolphin, based in Puerto Escondido, Oaxaca, Mexico, is responsible for the personal data described in this notice. You can reach us about anything related to your data at admin@puertodolphin.com.

When you book a tour, the tour business you book with (and, if a hotel or other collaborator made the booking for you, that collaborator) also receives your booking details so they can run your tour.

2. Information we collect

• Tour operators (boat tours, fishing, surf schools): owner name, email, WhatsApp/phone number and password (stored hashed, never in plain text); business name, type and destinations; description, meeting point, social media links, logos and photos; experiences, prices, boats, surf gear and transport settings; crew members' names, positions and photos; the bank-transfer details you choose to show clients; invoice details (legal name, RFC, address); documents you upload; and your plan and subscription payments.
• Collaborators (hotels, agencies and other partners): business name, contact name, email, WhatsApp/phone number, password (hashed), logo, the operators you work with, your commission or price terms, and the reservations you make for your guests.
• Clients and guests: name, email, WhatsApp/phone number, password (hashed) if you create an account, optional profile photo; your bookings (tour, date, time, adults and children, preferred language, extras, transport choice and pickup place, notes); messages with operators, cancellation requests, saved operators and payment status.
• Surf lessons also ask for each person's age and weight, sports they practice, and any medical condition or injury (see "Health information" below).
• Liability waivers: the signer's name, optional email, time of signing and the IP address it was signed from, as a record that the waiver was signed.
• Bookings a business or collaborator enters for a client: whatever information they enter (name, contact, guests, notes).
• Technical data: the cookies described below and standard server logs (such as IP address and pages requested) used for security and troubleshooting.

We never receive or store card numbers (see "Payments").

3. Health information (sensitive data)

Surf lessons ask for each person's age and weight and any medical condition or injury, so the instructor can choose the right board and keep the lesson safe. Health information is treated as sensitive personal data, so we only collect it with your express consent, given through the checkbox on the booking form. We record when you gave your consent.

This information is shown only to the surf school or instructor you book with (and is stored on the platform so they can see it). It is not used for anything else. You can ask us to delete it at any time. We do not ask for any other sensitive data.

4. Why we use your information

We use personal data only for these purposes, all of which are needed to provide the service:

• to create and manage accounts and let you log in;
• to publish operators' public profiles and experiences on the marketplace;
• to make, confirm, change and cancel bookings and reservations, and check availability;
• to send booking messages by email and WhatsApp (request received, confirmed, payment received, cancelled) and new-booking alerts to operators;
• to take card payments through Stripe and record cash and bank-transfer payments;
• to create invoices (notas de venta);
• to sync bookings with an operator's Google Calendar, only when the operator connects it;
• to run the collaborator program (requests, reservations, commissions);
• to manage plans and subscription payments, including notices when a plan changes;
• to provide support, keep the platform secure, prevent fraud and meet legal obligations.

We do not use your data for secondary purposes: no advertising, no marketing for other companies, no profiling, and we never sell it. If that ever changes, we will update this notice first and ask for your consent where the law requires it.

5. How we use Google user data

Connecting Google is always optional. Google shows you exactly what access is being requested on its own consent screen before anything is granted.

• Sign in with Google (any account type): we receive your name and email address only to create your account or sign you in.
• Google Calendar (operators who connect it; permission to view and edit events on your calendars, calendar.events): we read the events on the connected calendar to show them in your dashboard calendar and to pause instant booking when you're busy at a departure time. We add an event for each confirmed booking (tour, date and time, guests, client name and contact, notes and a link to the booking) and remove it if the booking is cancelled. We only change or delete events we created. We also store the email address of the connected Google account.

Puerto Dolphin OS's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• we use Google user data only to provide the features above, which you can see in the app;
• we do not sell it, use it for advertising, or transfer it to anyone except as needed to provide these features, for security, or to comply with the law;
• no person at Puerto Dolphin reads it unless you ask us to (for support), it is needed to investigate security or abuse, or the law requires it;
• we do not use Google user data to develop, improve or train generalized artificial intelligence or machine learning models.

Google access tokens are stored only to keep the connection working. Clicking "Disconnect" in your dashboard deletes them right away and revokes our access with Google; you can also remove access at any time from myaccount.google.com/permissions. Events already added to your calendar stay there because they are yours.

6. Payments

Operators can take card payments through Stripe. Card details are entered directly on Stripe's secure checkout page: Puerto Dolphin OS never receives, sees or stores card numbers. We store the amount, the processing fee, whether the payment succeeded and Stripe's reference numbers, so the booking and the operator's dashboard are correct. Each operator connects its own Stripe account and is paid by Stripe directly; we do not hold clients' money. Stripe's own privacy policy (stripe.com/privacy) covers how Stripe handles payment data.

For cash and bank-transfer payments, the operator records the payment in the platform. For subscription payments to Puerto Dolphin, we record the amount, date, method and status.

7. Email and WhatsApp messages

Email: booking emails are sent from noreply@puertodolphin.com through Google Workspace. Replies go to the operator.

WhatsApp: we send messages through the official WhatsApp Business Platform (Meta) from Puerto Dolphin's number: booking updates to clients who leave the WhatsApp box ticked when booking, and new-booking alerts and plan/billing notices to operators and collaborators. To deliver them, Meta receives the phone number and the message content (for example, your name, the tour, the date and an invoice PDF). We store each message's delivery status. If you reply, we store your number and send one automatic reply pointing you to the operator's own WhatsApp. To stop booking messages, untick the box when you book, or write to us.

"Chat on WhatsApp" buttons only open your own WhatsApp app with a pre-filled message; we don't send any data to Meta through them.

8. Who we share information with

• The tour business you book with, and the collaborator who made a reservation for you, receive your booking details so they can provide the tour.
• Operators and collaborators who work together see each other's business details, terms and the reservations between them.
• What an operator publishes on its public profile (business name, photos, description, crew names and photos, meeting point, social links and any documents it chooses to show) is public.
• Service providers that process data for us, only to run the platform: Railway (hosting and database), Cloudflare (domain and network security), Google (Workspace email, sign-in, and Calendar when connected), Meta (WhatsApp Business Platform) and Stripe (card payments). Some of them are outside Mexico, for example, in the United States.
• Authorities, when the law requires it.

We do not sell personal data and do not share it with advertisers or data brokers. Sharing with the providers above, who act on our behalf, and with the business that provides your tour is part of providing the service.

9. Your rights

You can ask to access your personal data, correct it, delete it (cancellation) or object to its use (the "ARCO" rights). You can also withdraw your consent (for example, for the health information) or ask us to limit how your data is used or shared.

To do so, email admin@puertodolphin.com from the email address on your account (or tell us how we can confirm it's you) with your name, the account or booking it's about, what you're asking for, and anything that helps us find the data. We will reply as soon as we can, within the time limits that apply.

You can do many things yourself at any time: edit your profile, delete your account from your settings or profile page, disconnect Google Calendar, and untick WhatsApp messages when booking. Some records may have to be kept after a request, such as invoices and payment records we need to keep for tax purposes. If you believe your rights were not respected, you can contact the data protection authority in Mexico.

10. Cookies

We only use cookies that the site needs to work: session cookies that keep you logged in (separate ones for operators, collaborators, clients and administrators), one that remembers your English/Spanish choice for a year, and a short-lived one that shows a one-time message after an action. We do not use advertising, analytics or tracking cookies. Stripe's checkout page may set its own cookies when you pay by card.

11. How long we keep data

We keep account data while the account is active. When you delete your account, we delete your login and profile data. The operator keeps its own record of bookings you made with it (without your login), and we keep invoices, payment records and signed waivers for as long as we need them for tax, accounting or legal purposes. Surf health answers are deleted upon request. Google tokens are deleted as soon as an operator disconnects Google. Server logs are kept only for a short time.

12. Security

Passwords are stored hashed, never in plain text. The whole site uses HTTPS. Each dashboard, its bookings and its connected accounts can only be opened by someone logged in to that account, and only a small number of Puerto Dolphin administrators can access the admin console. Card payments happen entirely on Stripe's secure checkout page, never on our servers.

13. Children

Accounts are for adults. Children can join a tour booked by a parent or guardian, who gives the number of children and, for surf lessons, their age and weight. We do not knowingly create accounts for children.

14. Changes to this notice

We will post any change on this page with a new date. If a change is important, especially one about how Google user data is used or about new purposes, we will tell you by email or with a notice in your dashboard before it takes effect.

15. Contact

Questions about this notice or your data: admin@puertodolphin.com. Puerto Dolphin, Puerto Escondido, Oaxaca, Mexico.