Privacy Policy

1 Data Controller

The data controller — the entity responsible for deciding how and why your personal data is processed — is:

Once Experiamo S.r.l. is incorporated, data controllership will transfer to the company. Affected individuals will be informed of this transfer through an update to this policy and, where required by applicable law, through direct communication.

If you are located in the European Economic Area (EEA) or the UK, Experiamo acts as a data controller under the GDPR and UK GDPR respectively. Where we use third-party service providers that process data on our behalf, they act as data processors.

2 Scope of This Policy

This policy applies to all personal data collected through:

• Our website at experiamo.com and related sub-pages;
• Our waitlist and pre-registration forms (for travellers and experience providers);
• Email correspondence and customer support interactions;
• Marketing communications, where you have opted in;
• Any future application, platform or service we operate under the Experiamo brand.

This policy does not cover third-party websites, apps or services linked from our pages. Please review their own privacy policies separately.

3 Data We Collect

We collect only the information necessary for the purposes described in this policy. We group the data we collect into the following categories:

3.1 Data you provide directly

• Identity data: first name, last name.
• Contact data: email address.
• Preference data: experience categories of interest, preferred destination or region (optional).
• Provider data (if you register as an experience provider): business/brand name, country, region, city, description of your experience, social media profile URLs, website URL.

3.2 Data collected automatically

• Usage data: pages visited, time spent, actions taken (e.g. toggle between panels), referring URL.
• Technical data: IP address, browser type and version, operating system, device type, screen resolution, language preferences.
• Analytics data: aggregated, anonymised or pseudonymous data collected via Google Analytics 4 (see Section 8).

3.3 Survey data (optional)

If you choose to complete our optional pre-launch survey, we additionally collect: your experience category preferences, how you typically discover travel experiences, frustrations you have encountered when booking online, difficulties booking local experiences abroad, your typical budget per experience, the factors that would give you confidence in a new platform, and optional demographic information (country, region/city, age range). Age is collected as a bracket (e.g. "25–34") rather than a specific date of birth, and does not constitute special category data under Article 9 GDPR.

Your detailed survey answers are stored in Supabase and are also synced to Brevo (see Section 6), matched to your email address, so we can tailor follow-up communications based on your stated interests, budget and trust factors.

3.4 Data we do not collect

We do not collect, and have no interest in collecting, special categories of personal data (such as health data, racial or ethnic origin, political opinions, religious beliefs, biometric data, or sexual orientation) unless you explicitly volunteer such information in a free-text field — in which case we ask you to refrain from doing so.

We do not collect payment card or financial data at this pre-launch stage. Any future payment processing will be carried out by certified third-party payment processors.

4 How We Use Your Data

We use your data strictly for the following purposes:

• Waitlist management: to record your interest, send you a confirmation, and notify you when Experiamo launches or when relevant updates arise.
• Provider onboarding: to evaluate and process partner applications, and to contact you to progress your application.
• Platform improvement: to analyse how visitors interact with our website and forms, so we can improve user experience and prioritise features.
• Product research: to analyse responses to our optional survey, so we can understand traveller needs and habits and use those insights to inform platform design ahead of launch.
• Legal compliance: to comply with applicable laws, respond to regulatory requests, and exercise or defend legal claims.
• Communication: to respond to your direct enquiries sent to our email addresses.
• Marketing: to send newsletters or updates about Experiamo — only where you have given clear consent, and with an easy unsubscribe mechanism in every message.

5 Legal Bases for Processing

For users in the EEA and UK, we process your personal data on the following legal bases under Article 6 of the GDPR:

• Consent (Art. 6(1)(a)): when you complete our waitlist or provider form, take part in our optional survey, submit your email address, or opt in to marketing communications. You may withdraw your consent at any time.
• Legitimate interests (Art. 6(1)(f)): to analyse website performance, prevent fraud, improve our services, and manage our business operations — where these interests are not overridden by your rights and freedoms.
• Legal obligation (Art. 6(1)(c)): to comply with applicable law, including tax and accounting requirements.
• Contract (Art. 6(1)(b)): to take steps at your request prior to entering into a contract (e.g. onboarding as a provider).

For users in the United States (California), Brazil, India, Japan, and other jurisdictions, equivalent lawful bases apply under the respective local legislation, including the requirement to provide notice at or before collection and to offer meaningful opt-out rights.

6 Data Sharing and Third-Party Processors

We share your data only to the extent necessary, and only with trusted parties under appropriate contractual and security obligations:

6.1 Current processors

• Supabase, Inc. (database and backend infrastructure) — your form submissions are stored in our Supabase database hosted on AWS infrastructure. Supabase acts as a data processor under a Data Processing Agreement (DPA) with us. Data may be stored in regions including the United States and/or the EU. See Supabase Privacy Policy.
• Brevo SAS (email delivery and contact management) — we use Brevo to send transactional emails (such as your waitlist confirmation) and to store a copy of your contact details (name, email, category preferences, provider details where applicable, and — for those who complete it — your survey answers) so we can manage waitlist and partner communications, including any newsletter you opt in to. Brevo acts as a data processor under a Data Processing Agreement with us. Brevo primarily hosts data on servers located in the EU. See Brevo Privacy Policy.
• Google LLC (Google Analytics 4) — we use GA4 to analyse website traffic. IP addresses are anonymised or truncated. Data may be transferred to Google servers in the United States. See Section 8 and Google's Privacy Policy.
• Google Fonts — our pages load fonts directly from Google servers. This involves the transmission of your IP address to Google. See Google Fonts Privacy FAQ.

6.2 Future processors

When the platform launches, additional processors may include payment processors, email service providers, and customer support tools. We will update this policy and, where required, seek your renewed consent before engaging new processors that handle your data in a materially different way.

6.3 Legal disclosures

We may disclose your personal data if required to do so by law or in response to valid requests by public authorities (e.g. a court order or government agency), or to protect the rights, property, or safety of Experiamo, our users, or the public.

7 International Data Transfers

Experiamo is a global platform and your data may be transferred to and processed in countries outside your country of residence, including countries that may not provide the same level of data protection as your home jurisdiction.

For transfers of EEA and UK personal data to third countries, we rely on the following safeguards:

• Adequacy decisions issued by the European Commission or the UK ICO, where applicable;
• Standard Contractual Clauses (SCCs) approved by the European Commission (2021 version), including the UK Addendum where required;
• Processor agreements containing appropriate data transfer clauses with all third-party providers.

8 Cookies and Tracking Technologies

We use cookies and similar tracking technologies on our website. Below is a summary of the cookies currently in use:

We do not currently use advertising, remarketing, or third-party tracking cookies beyond Google Analytics. As we launch additional features, we will update this table and, where required by law, seek your consent via a cookie banner before placing non-essential cookies.

Managing cookies

You can control or delete cookies at any time through your browser settings. You may also opt out of Google Analytics data collection by installing the Google Analytics Opt-out Browser Add-on. Note that disabling cookies may affect the functionality of our website.

9 Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law:

• Waitlist leads: retained until the platform launches and you have been onboarded, or for up to 24 months from registration if the platform has not launched, unless you request deletion earlier.
• Provider applications: retained for 36 months from submission, to allow us to re-contact you about partnership opportunities, unless you request deletion earlier.
• Email correspondence: retained for 12 months after the matter is resolved.
• Analytics data: Google Analytics data is retained for 14 months (default GA4 setting), after which it is automatically deleted from Google's servers.
• Survey responses: retained until the platform launches and for 12 months thereafter. Beyond that period, responses are kept only in aggregated, anonymised form for internal statistical purposes.
• Legal and compliance records: as required by applicable law, which may extend up to 10 years in some jurisdictions.

When retention periods expire, we securely delete or anonymise your data so that it can no longer be attributed to you.

10 Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data. We respond to all verified requests within 30 days (or within the timeframe required by your local law).

California residents (CCPA / CPRA)

In addition to the rights above, California residents have the right to:

• Know what categories of personal information are collected, used, disclosed or sold;
• Opt out of the sale or sharing of personal information for cross-context behavioural advertising (we do not currently sell or share personal information as defined under CCPA);
• Limit the use of sensitive personal information;
• Non-discrimination — we will not deny you services or treat you differently for exercising your privacy rights.

To exercise any California rights, email privacy@experiamo.com with the subject line "CCPA Request".

How to exercise your rights

To exercise any of the rights listed above, please contact us at privacy@experiamo.com. We may ask you to verify your identity before processing your request. We will not charge a fee for reasonable requests unless they are manifestly unfounded or excessive.

11 Children's Privacy

Experiamo is not directed at children under the age of 16 (or the applicable minimum age in your jurisdiction — 13 in the US under COPPA, 16 in the EEA by default). We do not knowingly collect personal data from children. If you are a parent or guardian and believe that a child under the applicable age has provided us with personal data, please contact us immediately at privacy@experiamo.com and we will delete that information promptly.

12 Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction or disclosure. These include:

• Encryption in transit using TLS/HTTPS for all data communications;
• Access controls and role-based permissions within our database (Supabase);
• Regular review of access logs and security configurations;
• Use of API keys and environment variables to protect service credentials (never exposed in client-side code in production).

No method of electronic transmission or storage is 100% secure. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware, and will notify affected individuals without undue delay where required by applicable law.

13 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. When we make material changes, we will:

• Update the "Last updated" date at the top of this page;
• Where required, notify registered users by email before the changes take effect;
• Where required, seek your renewed consent if the changes affect the legal basis of processing.

We encourage you to review this policy periodically. Your continued use of our website after any changes constitutes acceptance of the revised policy, to the extent permitted by law.

14 Contact Us

If you have any questions, concerns or requests regarding this Privacy Policy or the way we handle your personal data, please contact us:

If you are in the EEA and are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority. A list of EEA supervisory authorities is available at edpb.europa.eu. For UK residents, the relevant authority is the Information Commissioner's Office (ICO).