Privacy and cookies
Here is how CanaryPicks uses your information when you explore activities, make a booking or contact us.
CanaryPicks acts as the booking intermediary for these activities and handles the information you provide to arrange your booking and support you. You can contact us using the address below.
See the Legal notice for the controller's full identity.At checkout we ask for your full name and email address, and you may add a phone number. We also record your language choice, selected activity, date and time, passenger categories and quantities, quoted price, booking status and payment outcome. If you contact support, we receive the information you choose to send us.
We use these details to prepare and manage your booking, arrange the activity, handle payment and refunds, send booking updates, answer questions and keep records of the transaction. Limited measurement helps us understand which activity and checkout steps work well.
Your contact details are linked to a booking record with the activity, departure, passenger counts, price and status. This lets us follow the booking from payment through confirmation, changes or cancellation, and contact you about its outcome. Checkout also stores a short-lived draft in your browser so you can complete the process in the same tab.
The activity operator delivers your experience. To arrange and fulfil a booking, CanaryPicks may share the booking details and customer contact information that operator needs. This can include the activity, departure, passenger counts and a way to reach you.
Stripe provides the secure payment form and processes card details when you reach payment. CanaryPicks does not receive or store your full card number. We receive the payment status and references needed to manage authorizations, charges and refunds. Stripe is not loaded while you browse public pages.
Cloudflare delivers the site and handles its edge services and limited measurement. Transactional booking records are stored in a PostgreSQL database. Amazon Web Services, including SES and SNS, delivers transactional booking emails and reports their delivery events. Stripe handles payments as described above.
Activity and checkout pages send a few first-party events, such as an activity view or checkout step, to measure overall use. They include an event name, language, activity and sometimes variant, but no name, contact or payment details, visitor or session ID, or full URL. We also count booking outcomes in aggregate. We do not use marketing pixels, cross-site tracking or fingerprinting, and do not create a persistent visitor ID for analytics.
CanaryPicks does not currently have any approved affiliate or partner links, so this does not apply to an ordinary visit.
These first-party items support language choice, checkout and optional partner attribution. Session storage belongs to the current browser tab and ends with its session. Our cookies use Secure and SameSite=Lax; the checkout and attribution cookies are also HttpOnly.
Remembers your language choice or the language selected from your browser.
Up to 1 year
Keeps your activity selection and checkout progress in this tab; it does not store your raw contact details.
Browser tab session
Keeps a request key so a payment step can be retried safely in this tab.
Browser tab session
Authorizes access to your current checkout booking.
Up to 15 minutes, never past the payment deadline
After acceptance, remembers approved referral details without a visitor ID or browsing history.
30 days
Remembers whether you accepted or rejected partner attribution.
1 year
The browser storage periods are listed above. Cloudflare retains the limited activity and checkout events for three months. Aggregate daily business counters are kept for 25 months. Booking records, including the customer information and payment records linked to them, are kept for as long as needed to deliver the booking, handle payment, refunds and disputes, and meet our accounting and tax obligations. Support correspondence is kept only for as long as needed to handle your request and for a reasonable time afterwards in case you follow up.
Depending on the law that applies, you may ask to access, correct or delete your personal data, restrict or object to its use, or receive a portable copy. You can also withdraw optional affiliate-attribution consent at any time by contacting us. These rights can have legal limits. You can also complain to a data protection authority.
For privacy questions or to exercise your rights, email CanaryPicks. Please tell us enough to locate your booking or request without sending card details.
support@canarypicks.com