Privacy Policy

1. Who is responsible for your data

RetreatsMap is operated by Competly, UAB (company code 308157857, VAT number LT100020947016), Svajonių al. 4, Jonučių II k., Garliavos apyl. sen., LT-53272 Kauno r. sav., Lithuania. We are the data controller for the personal data described in this policy.

For any privacy question, or to exercise your rights, write to [email protected].

When you book an event, the organizer of that event receives your booking details and is responsible for how they use them. When you pay online, Stripe processes the payment — see section 5.

2. What personal data we collect

Information you provide

• Account data — name, email address, password (stored only as a one-way hash) and an optional profile image.
• Content you publish — events, places, teacher profiles, descriptions, schedules, images, contact details and social media handles you choose to add.
• Bookings — when you register for an event: your name, email address, phone number (optional), number of participants, the date you chose and your message to the organizer.
• Payments and billing — for online bookings and plan subscriptions: amount, currency, payment status and Stripe reference numbers; for plans also your billing name, address and VAT number. You enter card details on Stripe's secure page — we never see or store your full card number.
• Payout accounts (organizers) — when you set up online payments, Stripe collects your identity, business and bank details directly to verify you. We receive only your Stripe account ID, country and whether payments and payouts are enabled.
• Communications — messages sent through the contact form, messages to organizers or teachers, and support requests.

Information collected automatically

• Technical data — IP address, browser type and version, device type, operating system, language preference and the page that referred you. With a booking we also store the IP address and browser it was made from, to prevent abuse.
• Usage data — pages visited, time spent, searches and clicks. Collected only if you allow analytics cookies.
• Approximate location — derived from your IP address to suggest nearby events. We don't store precise GPS coordinates unless you enter them yourself (for example when you publish a place).

Information from other sources

• Public sources — to make the map useful from the start, we compile listings of retreat centers, studios, teachers and events from publicly available information, such as their own websites and public business directories (including Google Maps). This can include a business name, address, public contact email or phone number, photos and event details. If a listing is about you, you can take it over by signing up with the email shown on it, correct it, or ask us to remove it at any time.
• Sign-in providers — if you sign in with a third-party account, we receive your name and email address from that provider.
• Stripe — the status of payments, refunds and disputes, and, for organizers, the status of their Stripe account.

3. How we use your data and our legal basis

We process personal data only for clearly defined purposes and only on a lawful basis under GDPR Article 6:

• Creating and managing your account — performance of our contract with you.
• Publishing the content you submit — performance of our contract with you.
• Passing your booking to the organizer and sending booking confirmations and status updates — performance of a contract, to take the steps you asked for.
• Processing online payments, refunds and plan subscriptions through Stripe and issuing invoices — performance of a contract.
• Keeping accounting and tax records — legal obligation.
• Compiling public listings of retreat centers, studios and teachers — our legitimate interest in offering a complete directory and theirs in being found. You can object at any time.
• Translating published content into other languages automatically — performance of our contract with you and our legitimate interest in making listings readable for everyone.
• Replying to contact form messages — our legitimate interest in providing support.
• Securing the site, preventing fraud and monitoring errors — our legitimate interest in keeping the service safe and reliable.
• Audience analytics and improving the site — your consent.
• Personalised marketing and measuring advertising — your consent.
• Complying with other legal obligations — when required by law.

4. Cookies and similar technologies

Cookies are small text files placed on your device when you visit a website. We also use similar technologies such as browser local storage; in this section we call them all "cookies".

On your first visit you choose which categories of cookies to allow. You can change your choice at any time through the "Cookie settings" link in the footer. Withdrawing consent does not affect processing that happened before.

Strictly necessary (always active)

• authjs.session-token — keeps you signed in. Provider: RetreatsMap. Duration: up to 30 days.
• cookie-consent-v1 (browser local storage) — remembers your cookie choices. Provider: RetreatsMap. Duration: until you clear your browser storage.
• Cloudflare Turnstile — checks that forms are sent by a person, not a bot. Provider: Cloudflare, Inc. Duration: session.
• Stripe — when you open a Stripe payment or billing page, Stripe sets its own cookies on its domain to process the payment and prevent fraud. They are governed by Stripe's cookie policy.

Analytics (optional — need your consent)

• _ga and _ga_<ID> — distinguish visitors and keep session state. Provider: Google Analytics 4 (Google Ireland Ltd.). Duration: 2 years.
• Sentry session storage — captures error context for debugging. Provider: Functional Software, Inc. (Sentry, EU region). Duration: session.

Marketing (optional — need your consent)

• _gcl_au — measures the results of Google Ads campaigns. Provider: Google Ireland Ltd. Duration: 90 days.
• _uetsid and _uetvid — measure the results of Microsoft Advertising campaigns. Provider: Microsoft Ireland Operations Ltd. Duration: 1 day and 13 months.
• _fbp — measures Meta (Facebook, Instagram) ads and retargeting. Provider: Meta Platforms Ireland Ltd. Duration: 90 days.
• __kla_id — remembers you for newsletter and email personalisation. Provider: Klaviyo, Inc. Duration: 2 years.

You can also delete cookies in your browser settings. Disabling strictly necessary cookies will break sign-in and other core features.

5. Online payments with Stripe

Online payments on RetreatsMap are processed by Stripe (Stripe Payments Europe, Ltd., Ireland, and its affiliates).

• Booking payments — when you pay for an event, you pay the organizer directly, into the organizer's own Stripe account; the organizer is the seller. RetreatsMap receives a platform fee from the organizer, not from you. Stripe processes your card and payment details as an independent controller for payment processing, fraud prevention and its own legal obligations.
• Plan subscriptions — when an organizer buys a RetreatsMap plan, Stripe processes the payment and billing details, calculates VAT and issues invoices for us. In the Stripe billing portal you can update your card, download invoices or cancel.
• Organizer verification — to receive payouts, organizers verify their identity and business with Stripe under Stripe's own terms. We don't receive ID documents or full bank account numbers.
• Refunds and disputes — organizers handle them in their Stripe account. We receive the refund status so we can update the booking and let you know by email.

You can read how Stripe handles personal data at stripe.com/privacy.

6. Who we share your data with

We do not sell your personal data. We share it only where needed to provide the service:

• Event organizers — the booking details you send them.
• Stripe — online payments, plan subscriptions and invoices (see section 5).
• Hosting — our hosting provider running servers in the EU.
• Email delivery — our email provider, which sends account and booking emails.
• Cloudflare (Cloudflare, Inc.) — content delivery, DDoS protection and bot checks (Turnstile).
• Translation services — published content (not your account details) is translated automatically using AI translation services, including OpenAI.
• Google (Google Ireland Ltd.) — Google Maps place data for public listings; Google Analytics and Google Ads only with your consent.
• Sentry (Functional Software, Inc., EU region) — error monitoring, only with your consent.
• Meta Platforms Ireland Ltd., Microsoft Ireland Operations Ltd. and Klaviyo, Inc. — advertising and email marketing, only with your consent.

Service providers act on our instructions under contracts that require them to protect your data. We may also disclose data when required by law, for example a court order or a valid request from a public authority.

7. International data transfers

Some of our providers are based in the United States or other countries outside the European Economic Area. For such transfers we rely on the safeguards of GDPR Articles 44–49:

• the European Commission's Standard Contractual Clauses;
• the EU-US Data Privacy Framework where the recipient is certified;
• other legally recognised safeguards.

8. How long we keep your data

• Account data — until you delete your account, then up to 30 days in encrypted backups.
• Published content — until you delete it, or up to 24 months after the event has ended.
• Bookings — up to 24 months after the event date; the organizer may keep their own copy under their own policy.
• Payment, invoice and accounting records — as long as accounting and tax law requires (in Lithuania, up to 10 years).
• Public listings — until the business takes the listing over (then the account rules apply) or asks us to remove it.
• Contact form messages — 24 months.
• Server logs and technical data — 30 days.
• Analytics data — 14 months.

9. Your rights

Under the GDPR (and equivalent law in the United Kingdom and Switzerland) you have the right to:

• Access — get a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — ask us to delete your data, subject to legal retention obligations.
• Restriction — ask us to limit processing in specific cases.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interest, including direct marketing and public listings.
• Withdraw consent — at any time, where processing is based on consent, without affecting earlier processing.

To use any of these rights, write to [email protected]. You can also complain to a data protection authority — in Lithuania the State Data Protection Inspectorate (vdai.lrv.lt), or the authority where you live.

10. Children

RetreatsMap is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

11. Security

We protect your data with industry-standard measures: HTTPS encryption, password hashing, role-based access to our database and continuous monitoring. Card payments are handled entirely by Stripe, which is certified to PCI DSS Level 1, the highest level of payment security. No system is 100% secure, but we work to minimise risk and respond promptly to any incident.

12. Changes to this policy

We may update this policy from time to time; the date at the top shows the latest change. For material changes — for example new kinds of data or new recipients — we will tell you by email or with a clear notice on the site before they take effect.