GoSmart Travel Privacy Policy

Effective Date: October 14, 2026

Last Updated: October 14, 2026

This Privacy Policy explains how Smooth Sailing Travel, LLC, a Florida limited liability company doing business as GoSmart Travel ("GoSmart," "we," "us," or "our"), collects, uses, and shares information about you when you use our websites, including app.gosmart.travel and gosmart.travel, our booking engine, our discovery and social features, our AI-assisted tools, and all related applications and services (collectively, the "Services").

By using the Services, you agree to the collection, use, and sharing of your information as described in this Privacy Policy. If you do not agree, please do not use the Services. This Privacy Policy is incorporated into our Terms of Use.

1. Information We Collect

1.1 Information You Provide to Us

Account information. When you create an account, we collect your name, email address, and password or sign-in credentials, and, if you provide them, your phone number, mailing address, and travel preferences (for example, through contact forms or newsletter signups). If you sign in through a third-party sign-in option (such as a Google or other social media account), we receive information that provider makes available to us, such as your name, email address, and profile photo.

Booking and traveler information. When you book travel, we collect the information needed to complete the booking, such as the lead guest's name and email address, the names and general age ranges of accompanying guests, stay dates, room and occupancy details, destination, and any preferences or special requests you provide. If you book for other people, you are responsible for having their permission to share their information with us. When a booking includes children or other companions, we collect only the limited information needed to complete that booking (such as a name, an age range, and, if you save it to a traveler profile, a date of birth). We do not create accounts or personality profiles for children, and the person making the booking must have authority to share each traveler's information with us.

Traveler profile information. To make future bookings faster, you can save traveler details to your account, such as your legal name, date of birth, contact details, mailing address, passport issuing country and passport expiration date, and loyalty or rewards program numbers. We use your passport issuing country and expiration date to check travel-document validity against your trip dates. We do not collect or store passport numbers.

Payment information. Payments are processed by a third-party payment processor. We do not receive or store your full card number. We receive and retain limited transaction information, such as confirmation that payment was authorized or captured, the amount, currency, transaction identifiers, and refund records.

Content you upload or create. We collect the content you submit through the Services, such as photos, videos, reviews, board names, trip notes, comments, messages, shares, and profile content, along with related information (like captions and the time of posting). When you upload a photo, we read its embedded metadata in your browser, including any GPS location and the date it was taken, and show you the location so you can keep or remove it. If you keep it, we store the location rounded to about one kilometer and the day the photo was taken with your post; we strip the remaining embedded metadata before the photo is stored. For videos, we automatically recognize recorded music in the soundtrack for licensing and moderation (through ACRCloud) and generate captions and a transcript (through Cloudflare) for accessibility, search, and moderation. We use automated tools, including AI services, to moderate photos, videos, and transcripts; we do not use these tools to build a biometric identifier of your face or voice.

Communications. When you contact us (by email, chat, forms, or through a travel specialist), we collect the contents of your communications and your contact details. If you use AI-assisted features such as our concierge chat, we collect the messages you send and the responses generated.

Invitations and sharing. If you share content with another person or invite someone to the Services by email, we collect the recipient's email address to deliver the share or invitation. You are responsible for having their permission to provide it.

Information about other people. Some features let you provide information about people other than yourself: travel companions you name on a booking or a trip, guests on a group trip sign-up, past travelers listed in your travel history, and the email addresses of people you share content with or invite. We use that information only to provide the feature you used, and you are responsible for having permission to share it. A person who is not a member can ask us to correct or delete information about them by emailing support@gosmart.travel.

Program participant and business account information. If you participate in an agent, affiliate, creator, or advertiser program, or hold a business account, we collect the information needed to run the program: business details and verification materials (company name, website, business email, and domain-confirmation codes), the names and emails of team members you add to a business account, your acceptance of the applicable program terms (version, time, and the network address used), referral and attribution records, commission, placement, and payout records, and tax information (such as tax identification details collected for required tax reporting).

Surveys, promotions, and support. We collect information you provide when you respond to surveys, enter promotions, or request support.

Marketing site forms. On gosmart.travel we collect what you enter in our waitlist and early-access form (the role you choose, your email address, your country, and any travel interests), contact and group trip inquiry forms, group trip sign-up and organizer pages (names, contact details, trip details, and photos you upload), and the application to become a GoSmart advisor (your experience, goals, and contact details). If you click through to a partner such as our travel insurance provider, that partner's privacy policy governs what you give it.

1.2 Information We Collect Automatically

We and our service providers use cookies, pixels, software development kits, local storage, and similar technologies to collect information automatically across the Services ("Tracking Technologies"). This includes:

• Device and technical data: IP address, browser type and settings, device type and identifiers, operating system, language, and network information.
• Usage data: pages and screens viewed, searches you run (including destinations, dates, and occupancy), listings you view, features you use, links you click, referring and exit pages, session identifiers, and the dates and times of your visits.
• Activity and interaction signals: actions you take in discovery and social features, such as items you view and for how long, items you save, skip, like, super-like, or otherwise react to, searches you run, boards you create, content you share, links you click (including links in sponsored posts and outbound partner links), conversations you start with a travel specialist, and how you arrived at the Services (for example through an agent, creator, or affiliate link). We keep these signals in an event log to power personalization, the ranking of the Discover feed, attribution to agents, creators, and affiliates, and the other uses described in this Policy.
• Approximate location: we may infer your approximate location (such as city, state, or country) from your IP address. We do not collect precise location from your device. Photo locations are handled as described in Section 1.1.
• Interaction with our emails: where permitted, whether emails we send are opened and which links are clicked.

1.3 Information We Derive

We create information about you from your activity, such as a travel-personality or preference profile based on your interactions, personalization signals used to rank and recommend content, and a travel history (such as destinations, trip counts, and travel seasons) derived from your bookings and, where applicable, travel documents or records you or your travel specialist provide.

1.4 Information from Other Sources

We may receive information about you from other sources, including: sign-in providers (as described above); travel suppliers who confirm, modify, or cancel bookings; other users (for example, when someone books travel for you, adds you as a guest, shares content with you, or invites you); our customer-relationship and communications systems; and publicly available sources. We may combine this with information we collect directly.

2. How We Use Information

We use the information we collect to:

• Provide the Services: operate the site and apps, create and manage accounts, run searches, display prices and availability, and personalize content and recommendations;
• Process bookings and payments: confirm reservations with travel suppliers, process payments and refunds through our payment processor, issue confirmations and vouchers, manage changes and cancellations, and maintain your trip history;
• Communicate with you: send transactional and service messages (confirmations, vouchers, cancellation and refund notices, payment and security alerts), respond to inquiries, and connect you with travel specialists when you request assistance or when your activity indicates you want help planning a trip;
• Personalize your experience: use your activity, preferences, and derived profiles to rank, recommend, and tailor content, offers, and search results;
• Market the Services: send marketing communications where permitted (you can opt out at any time), show you offers and promotions, and measure the effectiveness of our marketing;
• Operate social and sharing features: deliver shares and invitations, display shared and public content, and enable interactions between users;
• Run agent, affiliate, creator, and advertiser programs: record referrals and attribution, calculate and pay commissions, provide aggregated performance reporting, and satisfy tax and record-keeping obligations;
• Improve and develop the Services: perform analytics, research, testing, and product development, and train and improve features including personalization and AI-assisted tools;
• Protect the Services and our users: verify accounts, detect and prevent fraud, abuse, and security incidents, enforce our Terms of Use and other policies, and manage risk (including chargeback and dispute handling); and
• Comply with law: meet legal, regulatory, tax, and licensing obligations (including obligations that apply to sellers of travel) and respond to lawful requests.

We may use information that has been aggregated or de-identified so it can no longer reasonably be linked to you for any purpose, including analytics, benchmarking, research, and commercial products, and we will maintain and use such data only in aggregated or de-identified form and will not attempt to re-identify it, except as permitted by law to test our de-identification processes.

2A. How We Use AI and Automated Tools

Parts of the Services use artificial intelligence and other automated tools. These include Lumi, our conversational travel assistant and search guide; ranking and recommendations in discovery and search; travel-personality cards and vibe profiles; content moderation; and tools that read travel confirmations or links you share to help build trips. When you use these features you are interacting with an automated system, not a person. If a GoSmart travel specialist is helping with your trip we will make that clear; otherwise you should assume these features operate automatically. We label Lumi as an automated assistant where it appears.

These features use the messages and prompts you enter, your chat history, your saved preferences, your search and booking context, your boards and saved items, and activity signals such as saves, skips, and reactions. We do not send your full payment card number to these tools, and you should not enter payment card numbers, passport numbers, other government-ID numbers, or health or medical details into the concierge or chat. We do not use passport, date-of-birth, payment, or special-request information to build your travel-personality profile or for advertising.

We use aggregated and de-identified information about how people use the Services, including usage and interaction patterns, to develop, train, and improve our features, models, and AI assistant; because this information does not identify you, it is not subject to the content opt-out described below. Separately, we may use the identifiable content you provide, such as your messages to our assistant, photos, reviews, and board and trip content, to train and improve our models. We exclude payment card data, passport and other government-ID information, date of birth, and the health-related content of special requests from all model training. You can opt out of our use of your identifiable content for model training at any time by emailing support@gosmart.travel with the subject line "AI Opt-Out", and you will keep access to the Services (some personalization may be less tailored). For users in the EEA and the UK, we rely on our legitimate interests for this training and you may object at any time.

Our AI processing is performed by Anthropic as our service provider under a data-processing agreement; under its commercial terms, Anthropic does not use the content we send to its models to train its own general-purpose AI models.

Authorized GoSmart staff and service providers may review content, communications, and interactions with these features for safety, security, quality, and fraud- and abuse-prevention.

We do not make decisions that produce legal or similarly significant effects about you solely by automated means. Where automated tools assist with matters such as fraud or abuse detection or content moderation, a person is involved in, or you may request review of, significant decisions by contacting us at support@gosmart.travel.

We retain concierge and chat logs for 3 months unless they are tied to an open trip or a safety or abuse review, after which they are deleted or de-identified; de-identified data derived from them may be kept longer to improve our features and models. Records tied to a booking follow Section 6. For users in the EEA and the UK, we tell you when you are interacting with an automated system rather than a person and identify AI-generated or AI-assisted content where applicable law requires.

3. Cookies and Tracking Technologies

We use Tracking Technologies across all pages of the Services, including for:

• Essential purposes: signing you in, keeping your session active, remembering your cart and checkout state, security, and fraud prevention;
• Preferences: remembering your settings and choices;
• Analytics and performance: understanding how the Services are used, measuring feature performance, and diagnosing errors; and
• Advertising and marketing: measuring campaigns and, where used, tailoring offers and advertisements to your interests on our Services and elsewhere.

Most browsers let you refuse or delete cookies through your settings; if you do, parts of the Services may not work properly. Where required by law, we provide additional cookie controls on the Services. You can also opt out of interest-based advertising from participating companies through industry tools such as the Network Advertising Initiative opt-out page (optout.networkadvertising.org) and the Digital Advertising Alliance opt-out page (optout.aboutads.info). Our systems currently do not respond to "Do Not Track" browser signals. Where required by applicable law, we honor opt-out preference signals such as the Global Privacy Control.

Where required by law (for example, in the European Economic Area and the United Kingdom), we ask for your consent before setting non-essential cookies and similar technologies, and you can change or withdraw your choices at any time through the cookie controls we provide on the Services.

The cookies and similar technologies we set ourselves are: a sign-in session cookie from our authentication provider (essential); local storage in your browser that remembers settings such as onboarding steps, view choices, and an anonymous session identifier for the swipe feature (preferences); and a first-party attribution cookie named gs_attr that lasts 30 days and records which agent, creator, affiliate, or team link brought you to the Services, so that the most recent link can be credited for a booking or inquiry. We measure overall site traffic with Vercel Web Analytics, which does not use cookies and does not identify you. We do not currently set third-party analytics or advertising cookies. For visitors in the EEA and the UK, we do not set the attribution cookie until you accept non-essential cookies.

4. How We Share Information

We do not sell your name, email address, or booking details to data brokers. We share information in the following circumstances:

• Travel suppliers and fulfillment. To complete a booking, we share only the information the Supplier needs to fulfill it. For hotel and accommodation bookings this is typically the guest names, the number and ages of guests, stay dates, the room and rate selected, guest nationality or country of residence where the Supplier requires it, a contact phone number and sometimes an email, any special requests you provide, and, for certain suppliers, the IP address used to book. We do not send passport numbers, which we do not collect, or full payment card numbers to the Supplier. Once shared, the Supplier's handling of your information is governed by its own privacy policy.
• Payments and disputes. For hotel and accommodation bookings, GoSmart is the merchant of record: your payment is processed by our payment processor, and if you dispute a charge or file a chargeback we may share the booking and stay details needed to resolve it with our payment processor, the card network or your bank, and the Supplier. For cruises, activities and experiences (for example, Viator), and other products charged by the cruise line, operator, or vendor rather than by GoSmart, that vendor is the merchant of record and handles billing and disputes under its own terms and privacy policy. For cruises you book online, your card is entered into a hosted field operated by a PCI DSS compliant payment vault (currently PCI Vault) and passed directly to the cruise line as merchant of record; the card number does not touch our systems and we do not store it.
• Service providers. We share information with companies that perform services on our behalf, including payment processing; identity and sign-in; website and application hosting; data storage and content delivery; customer relationship management; email and messaging delivery; analytics; AI processing; security and fraud prevention; and professional services (such as accounting and legal). Service providers are permitted to use your information only to provide services to us.
• Travel specialists, agents, and program participants. If you work with a GoSmart travel specialist or independent agent, or arrive through an agent, affiliate, or creator referral link, we may share relevant information (such as your trip request, booking status, and contact details) with that person so they can assist you and be credited for the referral. Program participants are contractually required to use this information only to serve you through GoSmart. When an independent travel advisor books on your behalf, GoSmart and the advisor each act as a controller of your booking information for their own purposes. Specialist chat runs on a third-party chat platform (Chatwoot); the messages you exchange with a specialist are stored there and in our records so the specialist can help you with your trip.
• Other users and the public. Information you choose to share through social features is visible to others as described in Section 5.
• Advertisers and partners. Advertisers and commercial partners who buy sponsored placements receive aggregated reporting about their posts: counts of views, saves, shares, and link clicks, and the number of people who clicked. We do not share information that directly identifies you with advertisers except with your consent or at your direction, and we do not share your activity for use in advertising elsewhere.
• Corporate transactions. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of some or all of our assets, your information may be shared or transferred as part of that transaction, subject to reasonable confidentiality protections.
• Legal and safety. We may disclose information if we believe it is required by law, regulation, legal process, or government request, or to enforce our agreements, protect the rights, property, or safety of GoSmart, our users, or others, or to detect and prevent fraud or security issues.
• With your consent or at your direction.

The categories of service providers we currently rely on, and examples of the providers in each, include: authentication and sign-in (Clerk, and Google if you sign in with Google); hosting, content delivery, video processing, and aggregate traffic measurement (Vercel, Cloudflare); database and data storage (MongoDB Atlas); payment processing for hotel bookings (Stripe) and secure card capture for cruise bookings (PCI Vault); email and messaging delivery (Mailgun); customer-relationship management (HighLevel); specialist chat (Chatwoot); AI processing (Anthropic); music licensing for videos you create (Soundstripe); and audio content-recognition (ACRCloud). Travel suppliers that fulfill bookings include hotel wholesalers such as RateHawk (Emerging Travel Group) and WebBeds, and cruise lines such as Princess Cruises; activity and experience links go to Viator. We enter into data-processing agreements with providers that process personal information on our behalf and require them to safeguard it and use it only to provide services to us. Our providers may change over time; a current list is available on request at support@gosmart.travel.

We do not currently use third-party advertising cookies or pixels (such as Google, Meta, or TikTok advertising tags), and we do not sell your personal information or share it for cross-context behavioral advertising. Booking identifiers and traveler files are not used for third-party advertising. If we introduce advertising or analytics technologies that applicable law treats as a “sale” or “sharing” of personal information, we will update this Policy and provide a “Do Not Sell or Share My Personal Information” choice as described in Section 9.

5. Public and Shared Features

The Services include social features. Please use them thoughtfully:

• Public share links. When you share a board, collection, trip idea, or travel-personality card using a share link, anyone with the link can view it without logging in. Shared pages may display your first name, content you have saved, and profile elements you have chosen to share, and may be accessible to search engines and third parties.
• Interactive shares. People viewing your shared content may be able to react to it, swipe on it, save it, or re-share it, and you may see similar activity from others.
• Member-to-member sharing. Content you send to another member appears in their account. Invitations you send to non-members include your name so the recipient knows who invited them.
• Comparisons. If you compare vibes with another member, they can see the travel-personality fields involved, such as your archetype and your vibe profile (your personality dials and fingerprint).

Your member profile is public by default; you can set it to followers-only or private in your settings, and your boards and trips stay private to you until you share them. Content and invitations you send to another member appear in that member's inbox on the Services, and you can block a sender to stop receiving shares from them; we do not offer private end-to-end messaging, and anything you share is User Content that we may moderate using automated filters and human review. You can report content or conduct that violates our Terms by contacting support@gosmart.travel, or through in-product reporting where available. You can stop sharing a public link at any time from the shared item in your account; revoking a link prevents new views but cannot recall copies that others already saved, re-shared, or captured. We are not responsible for how other people or third parties use information you make public or share. Group trip pages published by a group leader are public pages; information you enter on a group trip sign-up form is not public.

Content that shows you. If another person posts a photo, video, or other content on the Services that shows you, or that includes your name or other information about you, you can ask us to remove it or to restrict who can see it, whether or not you have a GoSmart account. Use the in-product report option on the post or email support@gosmart.travel with the subject line "Image Removal," tell us where the content is and that you are the person shown, and we will respond within 30 days, usually much sooner. We may ask for enough information to confirm that you are the person in the content, we may tell the person who posted it that it was removed at the request of someone shown in it (without naming you), and we may keep a copy only where the law requires or where it is needed for a legal claim. For users in the EEA and the UK, this is how you exercise your rights to object to and erase personal information in content posted by others.

6. Data Retention

We keep information for as long as needed for the purposes described in this Policy, and retention periods vary by the type of information.

Travel and traveler records. We keep records of the travel you book with us, including your traveler details (such as legal name, date of birth, contact and address details, passport issuing country and expiration date, and loyalty numbers) and your booking history, for seven years after your most recent completed trip. We keep these as business and tax records, and they also allow us to handle payment disputes, chargebacks, and supplier commission questions, and to meet Florida seller-of-travel and other legal obligations, long after a trip ends.

Content you add. Photos, videos, posts, and similar content you add are yours. You can delete them at any time, and we will remove them from primary user-facing surfaces within a reasonable time, subject to the license and exceptions described in our Terms of Use.

Closing your account. If you close your account, we deactivate your profile and remove your content. You can reopen your account within 60 days to restore it. After 60 days, your content is removed. We keep the business record of the trips you have taken, as described above, even after your account is closed. If your account stays unused for an extended period, we may notify you and then deactivate or delete inactive account content, consistent with the retention periods in this Policy.

Backups and legal holds. Copies of information may remain in backups for a limited period after deletion, and we may retain information longer where required by law or to resolve disputes and enforce our agreements.

Retention at a glance: completed bookings, traveler profiles, and related tax records are kept for seven years after your most recent completed trip; payment and transaction records held by our payment processor for that processor's required period plus any chargeback window; business account and program records (term acceptances, placements, attribution, commission, and payout records) for seven years as business and tax records; concierge and AI chat logs for 3 months, unless tied to an open trip or a safety or abuse review, after which de-identified derivatives may be kept longer to improve our features; specialist chat transcripts and quote requests for 24 months after the conversation ends, or with your booking record if you book; the event log of views, dwell time, clicks, saves, and shares for 180 days in identifiable form, with aggregates kept longer; other behavior and personalization data (swipes, impressions, search text, onboarding answers, specialist alerts, and notifications) for 24 months; marketing lists until you opt out, after which you are suppressed; social content and activity signals (saves, skips, reactions, boards) until you delete them or, on account closure, 60 days after closure, except where a legal hold applies; server and access logs, including IP address, for 90 days; and backups for a limited rolling window. Longer periods may apply where required by law or to resolve disputes.

7. Security

We use administrative, technical, and physical safeguards designed to protect your information, including encryption in transit, access controls, and segregation of payment processing to our payment processor (we never store full card numbers). No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please use a strong, unique password and protect your account credentials. If a data breach affects your personal information, we will notify you and the appropriate authorities as required by applicable law, including the Florida Information Protection Act.

8. Children's Privacy

The Services are intended for adults. You must be at least 18 years old to create an account or membership, receive personalized recommendations, submit content, or make a booking or purchase, and we do not knowingly collect personal information from anyone under 18. Browsing of public pages does not require an account. If you believe someone under 18 has created an account or provided us personal information, contact us at support@gosmart.travel and we will delete it. We collect limited information about children only when an adult includes them in a booking, as described in Section 1, and we do not create accounts or profiles for children. A parent or the booking companion may request access to or deletion of a child's traveler record by contacting support@gosmart.travel. You are responsible for having permission to post images of other people, including minors, that you share; you or a parent or guardian may ask us to remove content that depicts you or a child in your care, as described under "Content that shows you" in Section 5, and additional restrictions may apply to images of minors for users in the EEA and the UK.

9. Your Choices

• Marketing emails. We record when and how you opted in to marketing (the form, the date and time, and the choices you made). You can opt out of marketing emails using the unsubscribe link in any marketing message or by contacting support@gosmart.travel, and closing your account also removes you from marketing. You will still receive transactional messages about your bookings and account.
• Account information. You can review and update your account information in your account settings or by contacting us.
• Companions on a booking. If you are included on a booking as a guest or companion, we keep the traveler record needed to fulfill that trip. If you have a GoSmart account, you can view the trips you are on in your profile. You can request access to, correction of, or deletion of your traveler record by contacting us at support@gosmart.travel; we may keep the business record of a completed trip as described in Section 6.
• Closing or deleting your account. You can close or delete your account in your account settings or by contacting support@gosmart.travel. We deactivate your profile and remove your content, and you can reopen your account within 60 days to restore it. We keep records of completed bookings and the travel you have taken, including the date-of-birth and passport details saved to your traveler profile, as business records described in Section 6. Some information may also remain in backups for a limited period.
• Cookies. See Section 3 for cookie choices.
• Shared content. You can delete boards and shared items from your account; see Section 5 and our Terms of Use regarding content that has already been shared with or saved by others.
• AI training and model improvement. You can opt out of our use of your identifiable content to train or improve our models and features by emailing support@gosmart.travel with the subject line "AI Opt-Out" from the email address on your account; we apply the opt-out within 30 days and confirm by email. We may still use aggregated or de-identified data that does not identify you.
• Do Not Sell or Share and targeted advertising. We do not currently sell or share your personal information for cross-context behavioral advertising. If this changes, you can opt out using the controls we provide or by emailing support@gosmart.travel with the subject line “Do Not Sell or Share.” We honor the Global Privacy Control.
• Profiling and personalization. You can ask us not to use your activity to build a travel-personality profile or to personalize your recommendations by contacting support@gosmart.travel; some features may not work without personalization.
• Text messages and push notifications. If we offer SMS or push notifications, we will obtain any consent required at opt-in, and you can opt out by replying STOP to texts or by turning notifications off in your device or account settings.

10. U.S. State Privacy Rights

Depending on where you live, you may have rights under state privacy laws, such as the right to know or access the personal information we hold about you, obtain a portable copy, correct inaccuracies, delete your personal information, and opt out of certain processing (such as targeted advertising or "sale"/"sharing" as those terms are defined by applicable law). We do not use or disclose sensitive personal information for purposes that require a right to limit under applicable law. Appendix A at the end of this Policy lists the categories of personal information we collect, where we get them, why we use them, who we share them with, and how long we keep them.

To exercise these rights, email support@gosmart.travel with the subject line "Privacy Request" and tell us the right you want to exercise and the state where you live. We will verify your request using the email address associated with your account and other reasonable methods, and we will respond within the time required by law. You may authorize an agent to submit a request on your behalf; we will require proof of authorization. We will not discriminate against you for exercising your rights. If we decline a request, you may appeal by replying to our response with the subject line "Privacy Appeal."

If applicable law treats any of our advertising, analytics, or data uses as a "sale" or "sharing" of personal information or as targeted advertising, you can opt out as described above or through controls we provide on the Services.

California residents may also request, under California Civil Code Section 1798.83 (the "Shine the Light" law), certain information about any personal information we disclose to third parties for their own direct marketing purposes. To make a request, email support@gosmart.travel with the subject line "Shine the Light Request."

Sensitive information. We treat the following as sensitive: your date of birth, passport issuing country and expiration date, your account credentials, and any health-related details you provide in special requests (such as accessibility, dietary, or medical needs). We use special requests only to fulfill your booking and share them with the relevant supplier because the stay cannot be provided without them. We do not use sensitive information to build your travel-personality profile, to train our models, or for advertising, and you may ask us to limit our use of sensitive personal information as described above.

11. International Users and Regional Privacy Rights

GoSmart is based in the United States, and booking travel through the Services is available only to users located in the United States. Our discovery, social, and content features are available to users in other countries, including the European Economic Area (EEA) and the United Kingdom (UK). This means we may process personal information of users outside the United States, and the information and rights described in this Section may apply to you depending on where you live.

International data transfers. Wherever you are located, your information is transferred to, stored, and processed in the United States and other countries where we and our service providers operate. These countries may not provide the same level of data protection as your home country. Where we transfer personal information of EEA or UK users, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses and the UK Addendum, or another lawful transfer mechanism.

Legal bases (EEA/UK). Where the EU or UK General Data Protection Regulation applies, we process your personal information on one or more of the following legal bases: to perform a contract with you or take steps at your request before entering into one (such as creating your account or fulfilling a booking); your consent (for example, for certain marketing, cookies, or optional features, which you may withdraw at any time); our legitimate interests (such as operating, securing, personalizing, and improving the Services and running our programs), balanced against your rights; and compliance with our legal obligations.

Your rights (EEA/UK). Subject to applicable law, you may have the right to access the personal information we hold about you; to correct inaccurate information; to erase your information; to restrict or object to certain processing (including processing based on our legitimate interests and processing for direct marketing); to data portability; and to withdraw consent where we rely on it. You also have the right to lodge a complaint with your local data-protection supervisory authority. To exercise these rights, email support@gosmart.travel with the subject line “Privacy Request”; we will verify your request and respond as required by law. Some information may be retained where we have an overriding legal obligation or legitimate ground, such as the travel and tax records described in Section 6. These rights also apply to personal information about you that another member has posted, such as a photo or video that shows you; see "Content that shows you" in Section 5.

EEA/UK representative. Where required by Article 27 of the EU or UK GDPR, we will designate a representative in the EEA and/or the UK and publish their contact details here. [EU/UK REPRESENTATIVE CONTACT TO BE ADDED.]

Other regions. If the law of another jurisdiction grants you rights over your personal information, you may contact us at support@gosmart.travel and we will honor requests as required by applicable law.

12. Third-Party Services

The Services rely on and may link to third-party websites and services, including travel suppliers, payment processing, and sign-in providers. This Privacy Policy does not apply to third-party services, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party service you use.

Some outbound links on the Services are affiliate or referral links. If you click one and make a purchase or reservation with the third party, we may earn a commission, at no additional cost to you, and any information you provide to that third party is handled under its own privacy policy. See our Terms of Use for more about affiliate links.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice as appropriate, such as by posting the updated Policy on the Services with a new "Last Updated" date or by emailing account holders. Your continued use of the Services after changes take effect constitutes acceptance of the updated Policy.

14. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

Smooth Sailing Travel, LLC DBA GoSmart Travel

PO Box 729, Nokomis, FL 34274, United States

Email: support@gosmart.travel

Appendix A. Notice at Collection (California and Other U.S. States)

This table summarizes the personal information described in this Policy by the categories used in California and similar state laws. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use sensitive personal information to infer characteristics about you.