Privacy

What we collect

Three kinds of thing, and nothing else.

1. What you type into a form

• Trip and enquiry forms: your name, email, and anything optional you choose to add — phone, destination, dates, group size, budget range, home airport, and free text about the trip.
• Operator and supplier applications: your name, email, business name, and the optional business details on the form.
• Bookings, once booking is switched on: the guest name, email, phone and anything the operator requires for the trip itself.

2. Basic usage data, first-party only

We record page views and a few actions — which experience was viewed, which form was submitted — along with the page path and the referring site. To tell one visit from another we store a random identifier in your browser's local storage. It is a random number. It is not linked to your name unless you later submit a form, and it is not shared with anyone.

There is no Google Analytics, no advertising pixel, no Meta or TikTok tag, and no cross-site tracking of any kind on either site.

3. Your IP address

Used momentarily to rate-limit our AI assistants so one person cannot exhaust them. It is not written to our database and not kept. Our hosting provider keeps its own standard server logs.

The AI assistants

Both sites offer an AI assistant. What happens to what you type differs between them, so both are described.

• The Xrise Experiences trip assistant sends your message, and a shortlist of our own listings, to Anthropic's Claude API to produce a reply. That conversation is stored in our database so we can improve the assistant and see where it was unhelpful. Don't type anything into it you wouldn't want kept.
• The Xrise Adventures trip planner also sends your messages to Anthropic to produce a reply, but we store nothing from that conversation at all. Close the tab and it is gone from our side. Nothing reaches us until you deliberately submit the form.

We do not use your conversations or your personal information to train AI models, and we do not permit our providers to.

Who else touches your data

We use a small number of vendors to run the service. They process data on our instructions and for no purpose of their own.

• Supabase — our database and sign-in.
• Vercel — hosting.
• Resend — sending the emails we owe you.
• Anthropic — the AI assistants, as described above.
• Stripe — card payments. Payments are not switched on yet. When they are, Stripe handles the card and we never see or store card numbers.
• The operator or supplier you book with. If you book a trip, we pass on what they need to run it — your name, contact details, party size and any requirements. They use it to deliver your trip and are responsible for their own handling of it.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have never done either.

Marketing

We do not run a marketing list. Every email we send is about something you did — a booking, an enquiry you submitted, an application you made. There is nothing to unsubscribe from because there is nothing to be subscribed to. If that ever changes, it will be opt-in and it will say so here first.

How long we keep things

• Enquiries and applications — while we might reasonably still be talking to you, then deleted on request at any time.
• Bookings and payment records — kept as long as tax and accounting rules require.
• Usage data — kept in aggregate.

Your choices

Email hello@xriseexperiences.com and ask us to show you what we hold, correct it, or delete it. We will do it. You do not need to live in a particular state and you do not need to cite a law.

If you are in California, Virginia, Colorado, Connecticut, Texas or another state with a privacy statute, you have specific rights to access, correct, delete and to opt out of sale or targeted advertising. We do not sell data or do targeted advertising, so that last one is already the case for everyone. You may also appeal if we refuse a request.

Children

These sites are not for children under 13 and we do not knowingly collect their information. Minors can of course be guests on a trip — when that happens, the adult making the booking gives us their details, and we only use them to run the trip.

Security, honestly stated

Data is encrypted in transit and at rest with our providers, access is restricted, and the database enforces row-level security so one customer cannot read another's records. No system is perfectly secure and we are not going to claim ours is.

Changes, and who to contact

If we change this materially we will update the date at the top and, where it affects you, say so directly. Questions, requests and complaints: hello@xriseexperiences.com. Xrise, Austin, Texas.