RethinkMyTrip
Privacy Policy
This Privacy Policy covers rethinkmytrip.com and club.rethinkmytrip.com, including travel enquiries, Club accounts and the free beta. For privacy questions or requests, use our contact page or email [email protected].
1. Information we process
- Enquiries: your name, email address, message, request reference and the trip information you choose to provide, such as destinations, dates, budget and preferences.
- Club accounts: your name, email address, account identifier, creation date, email verification status and membership/access status.
- Passwords: your password is processed to create or check a secure Argon2id password hash. We store the hash, not the plaintext password.
- Authentication: session records, expiry times, security tokens for email verification and password reset, and records needed to revoke access. Session identifiers and verification/reset tokens are stored as keyed hashes in the authentication tables. A delivery queue temporarily holds email contents, including a confirmation or reset link, until sent or invalidated.
- Security: timestamps, browser/user-agent information and security event logs. The Club stores a keyed hash of the IP information used for session and audit records. Our hosting and security providers may also process IP addresses and request logs.
2. Why we use this information
We use enquiry details to respond and provide the planning assistance you request. We use account information to create and administer your Club membership, verify your email, authenticate you, recover access and apply membership permissions. We send service emails about these actions and internal notifications about new requests and accounts. Creating an account does not subscribe you to marketing emails.
Where GDPR applies, processing needed to provide your requested service or take steps at your request is based on performance of a contract or pre-contractual steps. Preventing abuse, protecting accounts and maintaining service reliability are legitimate interests. Where a legal obligation requires retention or disclosure, that obligation is the basis. Any optional processing that requires consent will be presented separately; consent can be withdrawn without affecting earlier lawful processing.
Name and email are needed to respond to enquiries. A name, email and password are needed to create a Club account. You may send a travel request without creating a Club account. We do not sell personal information or make advertising profiles from your travel requests.
3. Authentication cookies
The Club uses the strictly necessary rmt_session cookie to keep you signed in. It is marked Secure, HttpOnly and SameSite=Lax and expires after up to 14 days. Logout invalidates that session; password reset, account deletion and administrative access revocation invalidate relevant sessions. Blocking this cookie prevents authenticated Club features from working.
4. Service providers
Cloudflare provides DNS, traffic delivery and security. Cloudflare Turnstile is used on the main site's request forms to prevent automated abuse and may process browser, network and interaction information for that purpose. Resend delivers account verification, password reset, request confirmations and operational notification emails. Email recipients and message contents are shared with the email delivery service as needed to send them.
Access is limited to people and service providers who need information to operate or secure the service, respond to your enquiry, or meet a legal obligation. Providers may process information in countries outside your own, including outside the EEA. Applicable data-protection requirements and transfer safeguards must be considered for these arrangements. Contact us for information about the arrangements relevant to your data.
5. Retention and deletion
We retain an active account while it is needed to provide membership. Verification links expire after 24 hours and password reset links after 30 minutes; they can be used once. Request information is retained for handling the enquiry, follow-up, record-keeping and any applicable legal claims, rather than for an unrelated marketing purpose.
You can delete your Club account from My account. This removes your name, email and password hash from the active account record and revokes sessions, security tokens and membership entitlements. A de-identified account record and limited security/audit information may remain where needed to prevent abuse or maintain record integrity. Unsent account recovery emails are removed. Closing a Club account does not automatically delete a separately submitted travel enquiry or emails already delivered; request those separately through our contact page.
Restricted backups may retain an earlier copy until the backup is rotated or removed. Routine backups rotate according to the configured retention schedule; separately created maintenance backups require review and removal. Security records and correspondence are retained only for as long as needed for their purpose or an applicable legal obligation. You may ask us about the retention criteria applying to your information.
6. Your data-protection rights
Where GDPR applies, you can request access to your personal data, correction of inaccurate data, erasure, restriction of processing and, where applicable, data portability. You can object to processing based on legitimate interests and withdraw consent for processing based on consent. These rights are subject to the conditions and exceptions in applicable law.
Contact us using the details above to exercise your rights. We may need proportionate information to verify your identity. We normally respond within one month; where an extension is permitted, we will explain it. You may lodge a complaint with your competent data-protection supervisory authority, including in the EU country where you live, work or believe an infringement occurred. We do not use solely automated decisions producing legal or similarly significant effects about you.
7. Information you should not send
Please do not include passport numbers, payment card details, passwords or unnecessary sensitive information in an enquiry. No payment card is required or collected for Club membership during the free beta.
8. Updates
We may update this policy as the service changes. The date above identifies the current version. Material account-related changes will be communicated where required.