Privacy Policy

SaunaTrail (“we”, “us”) operates this directory of saunas in Ireland. This policy explains what personal data we collect, why, how long we keep it, and your rights. We aim to collect as little as possible.

Browsing the directory — first-party analytics

You can browse the public directory without an account. We do run our own lightweight, privacy-respecting analytics to understand which pages and listings are popular — but it is cookieless and does not identify you.

What we record for each page view or listing interaction:

• the page or listing seen and the type of action (a view, a card seen, a tap on a phone number or directions link);
• the website you arrived from (the domain only, e.g. “google.com” — never the full address);
• a coarse device type (mobile, tablet or desktop).

To count returning visitors within a single day without identifying anyone, our server converts your IP address and browser into a one-way coded value (a salted hash) and then immediately discards the IP address— we never store it. The code is built differently every day, so one day’s visits are never linked to another’s, and we have no practical way to work back from a stored code to a person. Raw events are deleted within 35 days; only anonymous daily totals are kept. No cookies are set or read. TODO: confirm this description matches the final implementation, and add the lawful basis (we intend to rely on legitimate interest for aggregate, non-identifying analytics).

Owner, staff and admin accounts

People who list or manage a sauna sign in with a magic link — a one-time link sent to their email — so we hold their name and email address, and the listing details they provide. Because signing in requires receiving that link, account email addresses are verified by the sign-in itself; we do not set passwords. TODO: confirm retention of account data and the admin audit log.

Bookings

When the booking feature launches, making a booking will require a name, email address and party size — no account needed. We use the email to send your confirmation and a link to manage or cancel your booking; that confirmation email also acts as your verification, so we do not ask you to verify separately beforehand. Payments will be handled by Stripe and we will never store card details. TODO: complete before the booking/payments launch — cancellation/refund terms, who the booking contract is between (customer and sauna, with us as intermediary), and marketing consent (strictly opt-in).

Cookies

The public directory sets no cookies. When you sign in to a dashboard, we use an essential session cookie to keep you logged in — this is required for the service to work and needs no consent banner. We use no advertising or tracking cookies.

Who processes your data

We use a small number of trusted providers to run the service: Supabase (database, sign-in and photo storage), Vercel (website hosting), Cloudflare (domain/DNS), Resend (sending booking and account emails), and Stripe(payments, at launch). TODO: confirm the final list, each provider’s role and location, and that data processing agreements are in place.

How long we keep it

Raw analytics events are automatically deleted after 35 days; only anonymous, aggregated counts (with no visitor code) are kept beyond that. TODO: define retention periods for account data and bookings (e.g. how long after a booking or account closure).

Your rights

Under GDPR you can ask for a copy of your personal data, ask us to correct it, or ask us to delete it, at any time. Contact us via the contact page and we will respond within the timeframe the law requires. TODO: confirm the contact route, identity checks, and response process, and the export/delete tooling.

Changes and contact

We may update this policy as the service grows; the current version always lives here. Questions or requests: see the contact page. TODO: add a “last updated” date and a contact email once the domain email is set up.