Privacy policy
Current service notice · 2 October 2026
Last updated: 2 October 2026.
Contact and scope
Surfcamps World Inc., Québec, Canada, operates this website. Send privacy questions, access or correction requests, consent withdrawals and complaints to Privacy contact: charles@predictive.company. Please describe the account or interaction concerned without sending passwords, payment-card details or identity documents by email. We may need proportionate information to verify a requester's identity.
This notice covers the platform, including its demo. Third-party camp websites and independently operated services have their own privacy notices. Real bookings are paused, but account, support and demo data can still identify you.
Information and purposes
- Account information: name, email, sign-in-provider identity and profile image when supplied, or a protected password representation for password sign-in. Used to authenticate you, secure your account and communicate about the service.
- Trip and guest information: selected dates, room and package choices, contact details, guest names, date of birth, surf level and optional dietary or arrival information. Used for eligibility, allocation, communication and the relevant booking workflow. Avoid entering health details unless genuinely necessary; do not enter real companions' information into a demonstration.
- Messages, support requests and reviews: content you send, attached material where supported, and related records. Used to deliver the conversation, handle complaints and moderate content. Published reviews are visible to others; private messages are not public reviews.
- Transaction and operational records: booking status, amounts, currency, processor references, refund events, consent records, security events, rate-limit information and audit history. Used to operate, reconcile and protect the service. Card entry is handled through Stripe; our booking database does not store full card numbers or security codes.
- Technical data: requests reaching our hosting and security providers can include an IP address, browser information and request metadata. Necessary cookies support sign-in, security and checkout. See cookies.
Provide other guests' information only with their knowledge and appropriate authority. Optional fields may be left blank. Refusing information needed for a particular feature can prevent that feature from working; it does not require accepting unrelated marketing.
Access, providers and transfers
Authorized platform personnel can access information needed for support, security, administration and financial operations. A participating camp's authorized team receives relevant trip and guest information, not your password or full payment-card details. We may disclose information where legally required or to address fraud, security or legal claims.
The current infrastructure uses Cloudflare for hosting/security, Supabase for database/storage, Stripe for payment workflows and Resend for email. Google sign-in supplies identity information if you choose it. An optional Google Calendar connection authorizes calendar operations separately and can be disconnected through the integration controls; calendar recipients can see information placed in their calendars. The map loads image tiles from OpenStreetMap. These browser requests disclose an IP address and request metadata, including the requested map area, to its tile infrastructure. See the OpenStreetMap Foundation privacy policy.
The production database is hosted in Frankfurt, Germany. Providers and camp operators may process information elsewhere, including outside Québec and Canada, where different laws and lawful access rules apply. A database region does not mean every copy, email, log or provider operation remains in that region.
Retention, protection and choices
Account closure anonymizes selected profile and guest details, removes or hides certain personal content and revokes access. It is not an immediate deletion of every record: transaction, audit, security and backup records may remain. We have not published a universal retention duration; ask us about the categories relevant to your request. Legal obligations, unresolved transactions and disputes can affect removal. Backups do not disappear instantly when a live record changes.
Access controls, protected credentials and encryption are used in the service, but no system can guarantee absolute security. Do not send sensitive information through a public review. Optional notification settings can be adjusted in your profile; essential account, security and transaction messages may still be sent. Contact us to request access, correction, an applicable portable copy, withdrawal of consent or closure. These requests are assessed under applicable law; withdrawal does not undo processing already lawfully performed.
You may raise privacy concerns with Québec's Commission d'accès à l'information or, where applicable, the Office of the Privacy Commissioner of Canada. We will update this notice when relevant practices change. Publication of this notice is not a claim that a regulator has certified the service.
Français
Pour toute question de confidentialité, demande d'accès, rectification, portabilité applicable, retrait de consentement ou plainte, écrivez à charles@predictive.company. Des renseignements peuvent être traités hors Québec, notamment dans notre base de données à Francfort et par nos fournisseurs. Une démonstration peut contenir de vrais renseignements personnels: utilisez des données fictives. La fermeture d'un compte ne supprime pas immédiatement tous les dossiers financiers, journaux ou sauvegardes. Nous pouvons vous aider à comprendre cette politique en français.