Privacy Policy

GoToRetreats runs the GoToRetreats Partners Program: a referral programme where partners share a personal link, and earn a commission when a retreat provider they referred receives bookings or pays for a subscription. This policy explains what personal information the programme collects, why, who sees it, and what you can do about it. It applies to partners, to people who apply to become partners, and to visitors who arrive through a partner's link.

Questions or requests about your data go to partners@gotoretreats.com.

Only what the programme needs to run. In detail:

• Account: your name, email address and a password (stored only as a one-way hash by our login provider). If you sign in with Google we receive your name, email and profile picture from Google and nothing else.
• Application and profile: the audience size, main platform, website and short description you give when you apply; your bio, photo and social handles if you add them to your profile.
• Payouts: handled by Stripe. We store your Stripe account reference and the status of each payout. We never see or store your bank or card details.
• Referral activity: when someone clicks your link we record the time, the link, the browser type, and the visitor's IP address in a scrambled form that cannot be reversed (it is hashed with a secret and changes daily). The visitor's browser is given a random identifier in a cookie for 90 days so that, if they sign up in that time, the referral is credited to you.
• Referred providers, bookings and subscriptions: the provider's name, email and the booking or subscription details that the company you partner with sends us, so a commission can be calculated and verified.
• Content links: the URLs of posts you submit for verification, and the public statistics of those posts (views, likes, comments) read from the platform they are on.
• Support and assistant: messages you send to the support team and to the AI assistant, so they can be answered and, if needed, reviewed.
• Security: two-factor authentication secrets and backup codes (encrypted), plus the time and device of logins and security changes.
• Notifications: which in-app and email notices were sent to you and when.

We use this information to:

• run the programme — credit referrals to the right partner, calculate and verify commissions, and pay you;
• detect and prevent fraud — self-referrals, click flooding, duplicate signups and unverifiable bookings are checked before any money moves;
• keep your account secure and let you recover it;
• answer your questions and give you an assistant that knows your account;
• tell you about money and activity on your account, and remind you when a content check-in is due;
• meet legal and accounting obligations, including tax reporting where it applies.

The site sets two kinds of cookie and no others:

• A login session cookie once you sign in, so you stay signed in.
• A referral cookie holding a random identifier, set only when someone opens a partner's link, kept for 90 days. It links a later signup back to the partner. It is not used for advertising and is not shared with ad networks.
• We do not use third-party advertising or cross-site tracking cookies. Visitors are shown a short notice about the referral cookie the first time they open a page on this site.

We share personal information only with services needed to run the programme, and only the parts each needs:

• The company you partner with (for example GoToRetreats) sees your partner profile, your referral activity and the providers credited to you, so it can approve your application and pay commissions.
• Supabase — hosts our database and login system.
• Stripe — processes payouts and holds your banking details under its own privacy policy.
• Vercel — hosts the website; Upstash — short-lived cache used for referral attribution and rate limiting.
• Google — only if you choose to sign in with Google.
• Groq — the AI assistant sends your question and the facts needed to answer it to a language-model provider to generate a reply. These messages are not used to train models.
• Resend — sends the programme's transactional emails.
• YouTube, Instagram, TikTok, Facebook and LinkedIn — we read the public statistics of posts you submit; we do not post on your behalf.
• Authorities, when the law requires it, and professional advisers under confidentiality.
• We do not sell personal information.

• Account and profile data: while your account is active, then up to 12 months after it is closed unless the law requires longer.
• Commission, payout and tax records: 7 years, as required for accounting.
• Referral click records: 24 months, then deleted or fully anonymised.
• The referral cookie and its identifier: 90 days.
• Support and assistant conversations: 24 months.

You can see and edit your profile in the dashboard, export your analytics as a CSV file from the Analytics page, and delete your account from Profile → Danger zone. Deleting your account removes your personal data except the financial records we must keep.

Depending on where you live (including under the GDPR in Europe and the UK, and the CCPA in California) you may also have the right to ask for a copy of your data, to correct it, to restrict or object to how it is used, or to complain to a data-protection authority. Write to partners@gotoretreats.com and we will respond within 30 days.

Our database and login system are hosted in Australia (Supabase, Sydney region); the website, cache and payment provider run in the United States. If you are outside those countries your data is transferred there under the providers' standard contractual protections.

All traffic is encrypted in transit. Passwords are never stored in plain text. Two-factor authentication is available to every partner. Access to production data is limited to the people who operate the programme. Money never moves on the strength of a message alone: every commission is verified against the company's own records before it is paid.

The programme is for adults. We do not knowingly collect information from anyone under 18; if we learn we have, we delete it.

When this policy changes in a way that matters, partners are told by email and in the dashboard before the change takes effect. The date at the top is always the version in force.