Privacy Policy

⚠️ Template — have a solicitor review for UK GDPR compliance before launch.

Who we are

OrlandoDays (the “service”) is operated from the UK. For privacy queries, contact the address on our site.

What we collect

Organisers: name, email, password (hashed), and Stripe customer/payment references (we never store card numbers).
Trip content: itinerary, family member names, and photos you and your group upload.
Usage: basic logs needed to run and secure the service.

Photos & children

Trips often include photos of family members, including children. Only upload photos you have consent to share. Photos are visible to anyone with that trip’s join code. You can delete any photo from the gallery, and organisers can request full deletion of a trip and its content at any time.

Legal basis

We process organiser data to perform our contract with you (running the service) and trip content on the basis of your consent. You can withdraw consent by deleting content or your account.

Sharing

We use Stripe (payments), Backblaze B2 (photo storage), and Queue-Times.com (wait-time data). We don’t sell your data.

Your rights

Under UK GDPR you can access, correct, export, or delete your data. Email us to exercise these rights or to delete your account and all associated trips.

Retention

Trip content is kept while your account is active. Delete a trip or account and its content is removed from our systems and storage.

← Terms of Service