Privacy Policy

This Privacy Policy explains how Vacay Alchemist (“Vacay Alchemist,” “we,” “us,” or “our”), a service operated by HYPERSMARTY LLC, collects, uses, discloses, and protects information when you visit vacayalchemist.com or use our trip-planning service (together, the “Service”). By using the Service, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.

1. Information We Collect

We collect the following categories of information:

a. Trip and questionnaire information

When you chat with the Alchemist to plan a trip, we collect the information you provide, which may include: destination(s), travel dates, budget, travel party size and composition (including ages, where relevant), interests, accommodation and transportation preferences, occasion, daily-rhythm and pacing preferences, risk tolerance, splurge/save preferences, past-trip experience, and any free-text answers you choose to give.

b. Contact information

We collect your email address so we can deliver your itinerary and any requested updates to it.

c. Payment information

Payments are processed by Stripe, Inc. (“Stripe”). We do not collect or store your full credit card number, card verification code, or other sensitive payment card data on our own servers — that information is submitted directly to Stripe on its own secure checkout page. We receive limited transaction information from Stripe (such as confirmation that a payment succeeded, the amount, and the tier purchased) necessary to deliver your itinerary.

d. Post-purchase updates

If you submit confirmed flight, hotel, or rental-car details through our itinerary update feature, we process that information solely to update your itinerary and reflect your actual bookings.

e. Technical and usage information

Our hosting provider (Vercel) and standard web-server processes automatically log limited technical information for security, fraud-prevention, and reliability purposes, such as IP address, browser type, device information, referring/exit pages, and timestamps. We do not currently operate any first-party analytics or advertising tracking on the Service. See our Cookie Policy for details.

f. Communications

If you contact us directly (for example, by email), we collect the information you provide in that communication in order to respond to you.

2. How Your Trip Data Is Actually Stored

Unlike many services, Vacay Alchemist does not maintain a central, persistent database of customer trip records. Instead, your trip questionnaire answers (including your email address) are encoded into an encrypted token (AES-256-GCM) that is embedded directly in the unique URL of your trip page. Your itinerary is generated from that encrypted token when the page is requested. This means there is no separate customer database of trip details for us to lose, leak, or improperly access outside of what is contained in your own trip link and what Stripe and our email provider retain as described below.

Because of this design, if you would like your trip data effectively rendered inaccessible, you can simply stop using or sharing your trip link; without it, your encoded trip data cannot be retrieved. See Section 9 (“Your Privacy Rights”) for how to request deletion of the more limited records we do retain (payment records via Stripe and email-delivery logs via our email provider).

3. How We Use Your Information

We use the information we collect to:

- Generate and deliver your personalized trip itinerary
- Process payment for the service tier you select
- Send your itinerary and any requested updates to your email address
- Respond to your support inquiries
- Maintain, secure, and improve the Service
- Detect, investigate, and prevent fraud, abuse, or security incidents
- Comply with legal obligations

We do not use your trip or contact information for advertising, and we do not sell your personal information.

4. Email Communications

We send transactional emails only — your itinerary and, if requested, updates to it — from info@vacayalchemist.com via our email service provider (Zoho). We do not currently operate a marketing email list or newsletter. If that changes in the future, any marketing emails will include a clear opt-out mechanism, and we will update this policy accordingly.

5. Third-Party Services and Links

The Service relies on and links to third-party services to function, including:

- Stripe— payment processing. See Stripe’s privacy policy at stripe.com/privacy.
- Zoho— transactional email delivery. See Zoho’s privacy policy at zoho.com/privacy.html.
- Vercel— website hosting and infrastructure. See Vercel’s privacy policy at vercel.com/legal/privacy-policy.
- Open-Meteo — weather forecast data. We send only the destination location (not your personal information) to retrieve forecast data.
- Booking, activity, restaurant, and car-rental platforms linked from your itinerary (for example, hotel and flight booking sites, OpenTable, and similar services) — when you click through to book, you leave our Service and that platform’s own privacy policy governs any information you provide there. Some of these links may be affiliate links, meaning Vacay Alchemist may earn a commission if you complete a booking, at no additional cost to you.
- Official government travel-advisory sources linked from safety information on your trip page.

We are not responsible for the privacy practices of these third-party services. We encourage you to review their policies directly.

6. How We Share Information

We do not sell your personal information. We share information only:

- With service providers who process it on our behalf (Stripe, Zoho, Vercel) solely to operate the Service
- If required by law, regulation, legal process, or governmental request
- To protect the rights, property, or safety of Vacay Alchemist, our users, or others
- In connection with a merger, acquisition, or sale of business assets, in which case we will notify you via this policy or other reasonable means

7. Data Retention

Because trip data lives in your own encrypted trip link rather than in a central database, we do not independently retain your trip questionnaire answers once your itinerary has been generated and delivered. Payment records are retained by Stripe in accordance with Stripe’s own policies and applicable financial recordkeeping and tax laws. Transactional email-delivery logs are retained by our email provider for a limited period for deliverability and security purposes. Standard technical server logs are retained by our hosting provider for a limited period for security and operational purposes.

8. Data Security

We use reasonable administrative, technical, and physical safeguards designed to protect information, including encrypting trip data embedded in your trip link (AES-256-GCM) and relying on PCI-compliant payment processing through Stripe so that we never handle your full payment card details directly. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Your Privacy Rights

Depending on your location, you may have rights under applicable privacy laws (such as the EU/UK General Data Protection Regulation or the California Consumer Privacy Act), including the right to:

- Request confirmation of whether we hold information about you
- Request access to, correction of, or deletion of information we hold about you
- Object to or restrict certain processing
- Request a copy of your information in a portable format
- Withdraw consent where processing is based on consent
- Lodge a complaint with your local data protection authority

Because of how the Service is built (see Section 2), most of your trip data exists only in your own trip link, which you control directly. To request deletion or access to the limited records we or our service providers independently retain (such as payment or email-delivery records), contact us at info@vacayalchemist.com. We will respond within a reasonable time and in accordance with applicable law.

10. Children’s Privacy

The Service is not directed to, and is not intended for use by, individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

11. International Users

Vacay Alchemist is operated from the United States by HYPERSMARTY LLC, based in Illinois. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States, where privacy laws may differ from those of your jurisdiction. By using the Service, you consent to this transfer.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the “Effective date” above and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

HYPERSMARTY LLC (Vacay Alchemist)
6615 Grand Ave 1135, Gurnee, IL 60031, United States
info@vacayalchemist.com