Privacy Policy

1. Who this policy covers

This policy applies to bluepass.co and the Bluepass booking service, operated by Bluepass Pty Ltd, registered at [registered address] (“Bluepass”, “we”). It covers travellers booking trips, operators listed on Bluepass, and creators/referral partners.

2. What we collect

We collect only what the service in front of you actually needs:

• Account details: name, email, phone number, and a hashed password when you register.
• Booking details: traveller name, email, and phone shared with the operator you book with, plus trip dates, guest count, and price — necessary to actually run your trip.
• Payment details: handled entirely by Stripe. Bluepass never receives or stores your card number — see §5.
• Conversations with Kai: messages you send our chat assistant, whether on bluepass.co or via WhatsApp, are stored so we can pick up where a conversation left off and so an operator can see the enquiry that led to a booking.
• Referral data: if you arrive via a partner's link, we record which link and which partner, so commission can be attributed correctly.
• Session cookie: one functional, HTTP-only cookie that keeps you signed in. No advertising or tracking cookies are set by Bluepass itself.

3. Why we collect it

To create your account, process and fulfil a booking, let you message Kai and pick up a past conversation, pay operators and referral partners correctly, and meet our own legal and accounting obligations. We do not sell your data, and we do not use it for third-party advertising.

4. Who we share it with

Only the parties needed to deliver the trip or run the platform:

• The operator you book with — your name, contact details, and trip details, so they can run your booking.
• Stripe — payment processing. Stripe's own privacy policy governs your card details.
• Rezdy — the booking/availability system some Australian operators use; trip and guest details pass through it to hold your spot.
• Supabase — our database host, where account and booking records are stored.
• WhatsApp Business (Meta) — only if you choose to message Kai over WhatsApp rather than the website.

We do not share your data with data brokers or advertising networks.

5. Payments

All payments are processed by Stripe. Bluepass's servers never see or store your full card number, expiry, or security code. Stripe's own privacy and security practices apply to that data — see stripe.com/privacy.

6. How long we keep it

We keep account and booking records for as long as your account is active and for a reasonable period after, to meet accounting, tax, and dispute-resolution obligations. [Bluepass to confirm an exact retention period per record type.]

7. Your rights

You can ask to see, correct, or delete the personal data we hold about you, or ask us to stop processing it, by contacting admin@bluepass.co. Deleting your account does not retroactively remove records we are legally required to keep (e.g. completed transaction records).

8. Where your data is stored

Bluepass's databases are hosted on Supabase infrastructure, split across two regions: account, booking, and payment records in Singapore (AWS ap-southeast-1), and Kai chat conversation records in Tokyo (AWS ap-northeast-1). Depending on which part of the service you use, your data is processed outside your home country as a result. [Bluepass/legal to confirm the specific cross-border transfer basis this relies on.]

9. Children

Bluepass accounts are for adults booking travel. The service is not directed at children, and we do not knowingly collect data from anyone under 18 who is not travelling as part of an adult's booking.

10. Changes to this policy

If this policy changes materially, we will update the date at the top of this page. We encourage checking back periodically.

11. Contact

Questions about this policy or your data: admin@bluepass.co.