Coastal Travel Company ("we," "us," or "our") operates the website at coastaltravelcompany.com and related services. This policy explains what information we collect, why we collect it, who we share it with, and your rights under the California Consumer Privacy Act (CCPA).
When you submit the contact form we collect your name, email address, and message. This information is forwarded directly to our inbox via Resend (our email delivery provider) and is not stored on our servers. It is retained only within the recipient's email client.
If you create an account we collect your email address and either a bcrypt-hashed password or a Google OAuth token (we never see or store your Google password). We also store your account role (client or admin). This data is stored in a Cloudflare D1 database indefinitely until you request deletion.
When you access a client gallery we issue a short-lived session token (a random UUID) stored in Cloudflare KV with a 4-hour expiry. No IP address, browser fingerprint, or personally identifiable information is associated with gallery sessions. Photos are fetched from our NAS through the Cloudflare Worker and are not cached server-side.
As part of our booking process we collect your name, email address, and invoice and contract data. This information is stored in a Cloudflare D1 database. Payment is processed by Stripe — we receive a confirmation token from Stripe but never see or store your card number or full payment details. Stripe's handling of payment data is governed by their own privacy policy.
With your consent (see "Cookies and Local Storage" below), we collect anonymized analytics about how visitors use this site — pages viewed, navigation paths, referrers, device/browser type, and approximate location derived from IP address. This is gathered through:
None of these tools load, and no associated cookies or identifiers are set, until you actively opt in to "Analytics" via the cookie-consent banner. You may withdraw consent at any time through "Manage Preferences" in the banner, which stops these tools from running on future page loads.
We also use the following privacy-friendly tools that do not require consent because they do not use cookies or collect personal information:
Our planned real estate property pages will collect anonymized room engagement events and hotspot interactions for property owners. A session identifier (a random UUID) is generated in your browser and stored in sessionStorage only — it is cleared when you close the tab and is never linked to your identity. No personally identifiable information is collected. Analytics events are only sent if you grant consent via the on-page consent banner.
If you voluntarily submit your email address through a lead capture form on a property page, that email is shared only with the listing agent and is not sold or shared with any other third party.
We use the following third-party services. Each processes data according to their own privacy policy, linked below.
We use a cookie-consent banner to let you choose whether we may set analytics cookies and identifiers. Until you actively accept "Analytics" (or "Accept All"), no analytics cookies, scripts, or tracking identifiers are loaded — only strictly necessary items run, such as your authentication session.
Depending on your choice, the following may be set:
auth_token). These are always active and cannot be disabled, as the site cannot function securely without them.We use browser storage as follows:
ctc_cookie_consent), and is used in the client portal to store your authentication token and in the admin panel to store saved settings. This data persists across sessions until you sign out, withdraw consent, or clear your browser data.We do not use advertising cookies or cross-site tracking technologies, and we do not sell or share your data with advertisers.
If you are a California resident, you have the following rights under the California Consumer Privacy Act:
To exercise any of these rights, contact us at the address in Section 5 below. We will respond within 30 days.
For privacy questions, data deletion requests, or to exercise any CCPA rights, please email us at:
We aim to respond to all privacy requests within 30 days.
We may update this privacy policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Material changes will be communicated to registered users by email.