Privacy Policy

This Privacy Policy describes how LFG Getaway, LLC, a Florida limited liability company ("LFG," "we," "us," "our"), collects, uses, and shares information when you use the LFG platform at lfgetaway.com and related services (collectively, the "Platform"). By using the Platform, you agree to the practices described in this Policy.

1. Information We Collect

We collect the following categories of information:

Account Information

Name, email address, profile photo, bio, travel preferences, experience level, languages spoken, and other information you provide during registration or when updating your profile.

Trip and Travel Data

Destinations, itineraries, dates, activities, accommodation details, expenses, and any other content you create, upload, or share within the Platform.

Communications

Messages, chat content, poll responses, comments, votes, and announcements you send or receive through the Platform.

Payment Information

Billing name, billing address, and payment method details. Full payment card numbers are processed and stored exclusively by Stripe and are never stored on LFG's servers.

Location Data

Approximate location when you use map or location-based features. Precise GPS location only if you grant explicit permission through your device settings. You may revoke location permission at any time through your device or browser settings.

Usage and Technical Data

Pages visited, features used, session duration, clicks, search queries, device type, operating system, browser type, IP address, and unique device identifiers. This data is collected automatically when you use the Platform.

Social Login Data

If you register or log in using Google, Facebook, or Apple, we receive basic profile information from those providers as permitted by your settings with them. We do not receive your password from these providers.

User-Generated Content

Photos, reviews, trip highlights, and other media you upload to the Platform.

2. How We Use Your Information

We use the information we collect to:

Provide, operate, and maintain the LFG Platform and its features.
Create and manage your account and authenticate your identity.
Facilitate trip coordination, group communication, and expense splitting.
Process payments and manage subscription billing.
Connect users with travel advisors and facilitate advisor services.
Personalize your experience with relevant recommendations and content.
Generate AI-powered features including trip summaries, planning assistance, conflict detection, and packing suggestions (see Section 5 for AI processing details).
Send transactional notifications about your trips, payments, and account.
Send marketing communications with your consent, which you may withdraw at any time.
Detect, investigate, and prevent fraud, abuse, and security incidents.
Analyze usage patterns to improve the Platform.
Comply with legal obligations.

Lawful Basis for Processing (GDPR)

For users in the European Economic Area, our lawful bases for processing are: (a) performance of a contract — to provide services you have requested; (b) legitimate interests — to improve the Platform, prevent fraud, and ensure security; (c) legal obligation — to comply with applicable law; and (d) consent — for marketing communications and certain optional features.

3. Data Sharing

We do not sell your personal data to third parties.

We share information only in the following circumstances:

With Trip Members

Profile information (name, photo, travel preferences) and trip-related content are shared with other members of your trips as necessary for coordination. You control what information is visible in your profile through your privacy settings.

With Travel Advisors

If you engage a travel advisor through the Platform, relevant trip details and preferences are shared with that advisor to facilitate their services. Advisors are required to handle your data in accordance with this Policy.

Service Providers

We share data with trusted third-party service providers who process data on our behalf:

Supabase — database hosting, authentication, and file storage
Stripe — payment processing and subscription management
Google (Maps, Places, Analytics) — mapping features and usage analytics
Vercel — platform hosting and content delivery
Sentry — error monitoring and crash reporting
OpenAI — AI-powered features including trip planning and conflict detection (trip content and preferences may be processed)
Anthropic — AI-powered features including trip summaries and packing lists (trip content and chat data may be processed)
Amadeus — flight and hotel search data

These providers are contractually required to use your data only to perform services on our behalf and may not use it for their own purposes.

Legal Requirements

We may disclose your information when required by law, regulation, valid legal process, or to protect the rights, property, or safety of LFG, our users, or others.

Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of our assets, your information may be transferred to the successor entity. We will notify you via email before your data is transferred and becomes subject to a different privacy policy.

With Your Consent

We may share your information for other purposes with your explicit consent.

4. Data Security

We implement industry-standard security measures including:

Encryption in transit via TLS for all data transferred between your device and our servers
Row-level security (RLS) policies on our database ensuring users can only access data they are authorized to see
Secure authentication with support for multi-factor authentication
Regular security testing and monitoring via automated CI pipelines
Payment data handled exclusively by Stripe, a PCI DSS Level 1 certified processor — LFG never stores full card numbers

No security system is impenetrable. In the event of a data breach that affects your rights, we will notify you as required by applicable law.

5. AI Data Processing

LFG uses artificial intelligence features to enhance your experience. These features are powered by third-party AI providers:

OpenAI processes trip content, preferences, and group data to generate itinerary suggestions, detect scheduling conflicts, and surface group consensus.
Anthropic processes trip room chat activity, itinerary data, and preferences to generate trip summaries, packing lists, and post-trip recaps.

By using AI-powered features on the Platform, you acknowledge that relevant content may be transmitted to these providers for processing. We do not send AI providers your payment information, government-issued identification, or passwords.

You may opt out of AI-powered features by disabling them in your account settings. Disabling AI features does not affect your core access to the Platform.

6. Cookies and Tracking

We use cookies and similar tracking technologies to operate the Platform and understand how it is used. We use the following categories:

Essential Cookies

Required for the Platform to function. These cannot be disabled. They include session management, authentication tokens, and security cookies.

Analytics Cookies

Used to understand how users interact with the Platform. We use Vercel Analytics and Google Analytics. Google Analytics data is anonymized. You can opt out of Google Analytics tracking at tools.google.com/dlpage/gaoptout. You can also adjust cookie preferences through your browser settings.

Do Not Track

We currently do not respond to "Do Not Track" browser signals. We will update this Policy if our practices change.

7. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal data:

All Users

Access and download a copy of your personal data
Correct inaccurate information in your profile
Delete your account and associated data through account settings
Opt out of marketing communications at any time via the unsubscribe link in any email or by contacting info@lfgetaway.com
Withdraw consent for optional data processing

California Residents (CCPA/CPRA)

If you are a California resident, you have the following additional rights:

Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, our business purpose for collection, and the categories of third parties with whom we share it.
Right to Delete: Request deletion of personal information we have collected, subject to certain exceptions.
Right to Correct: Request correction of inaccurate personal information.
Right to Opt Out of Sale or Sharing: We do not sell personal information. We do not share personal information for cross-context behavioral advertising.
Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise California rights, contact info@lfgetaway.com with the subject line "California Privacy Request."

EEA and UK Residents (GDPR/UK GDPR)

If you are located in the European Economic Area or United Kingdom, you have additional rights including: the right to restrict processing, the right to data portability, and the right to object to processing based on legitimate interests. You also have the right to lodge a complaint with your local data protection authority.

To exercise any privacy right, contact info@lfgetaway.com. We will respond within the timeframe required by applicable law (generally 30–45 days).

8. Children's Privacy

The LFG Platform is not directed to children under 18 years of age. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected personal information from a minor without verification of parental consent, we will delete that information promptly.

If you believe we have inadvertently collected information from a minor, please contact info@lfgetaway.com immediately.

9. International Data Transfers

LFG Getaway, LLC is based in the United States. If you access the Platform from outside the United States, your information may be transferred to, stored, and processed in the United States and other countries where our service providers operate.

We use our service providers' standard data protection mechanisms (such as Standard Contractual Clauses for transfers from the EEA) to ensure your data receives adequate protection regardless of where it is processed.

10. Data Retention

We retain your data for as long as your account is active or as needed to provide services. Upon account deletion:

Profile and account data: deleted within 30 days
Trip data you created: deleted within 30 days, except content that has been shared with or incorporated into other users' trips, which may be retained in anonymized or de-identified form
Payment records: retained for 7 years as required by financial regulations
Security and fraud prevention logs: retained for up to 2 years
Legal hold data: retained for the duration of any applicable legal obligation

Backups may retain data for up to 90 days after deletion from active systems before being purged.

11. Third-Party Links and Services

The Platform may contain links to third-party websites or integrate with third-party services (such as booking platforms, activity providers, or social networks). This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you interact with through the Platform.

12. Social Media and Third-Party Login

If you connect your LFG account to a third-party service (Google, Facebook, Apple, Instagram), that provider may share certain profile information with us as described in their privacy policies. We receive only the information necessary to create or link your account. We do not post to your social media accounts without your explicit action.

13. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email to registered users at least 14 days before taking effect, and we will update the "Last updated" date at the top of this page. Continued use of the Platform after the effective date of changes constitutes acceptance of the updated Policy.

14. Contact

For all questions, privacy requests, or concerns regarding this Privacy Policy or your personal data, contact us at info@lfgetaway.com.

Include a clear description of your request and, if applicable, your account email address to help us locate your data and respond promptly.