Privacy Policy

Last updated 25 October 2026

Waypoint Journeys ("we", "us") designs private luxury expeditions to remote destinations. This policy explains what information we collect through wpjourneys.com, how we use it, and the choices you have. Questions: hello@wpjourneys.com.

Information we collect

• Information you give us. When you submit an inquiry form or contact us: your name, email, phone/WhatsApp, destination interest, travel dates, group size, budget range, and any message you include.
• Marketing attribution. Campaign parameters from the link you arrived on (utm_source, utm_medium, utm_campaign, utm_content, utm_term) and ad click identifiers (fbclid from Meta, gclid from Google, msclkid from Microsoft Advertising), the referring website, and the page you landed on.
• Technical data. IP address, browser/user-agent, and pages viewed, collected through the cookies and tags described below.
• Your account. If you create an account: your name, email, phone (optional) and password, kept only as a one-way scrambled code, or the name, email when shared, and account identifier Google or Facebook shares if you continue with them; the expeditions you save, the booking requests you make and the passport copies you send for a booking, with the date of birth read from a passport. See Your Waypoint Journeys account.
• Your participation agreement. If you sign it online: the details it asks for and a record of how and when you signed, including your IP address and browser details. See Signing your participation agreement.
• Chats with Wayfinder. What you type to Wayfinder, the AI travel guide on our website, handled as described under Chatting with Wayfinder.

Cookies & tracking technologies

We use a small number of first-party cookies and two records kept in your browser to run the site, and third-party tags to measure traffic and the performance of our advertising.

When you submit an inquiry, we also send a server-to-server event to Meta (the Conversions API), a conversion to Google, and a completed-inquiry event to OpenAI Ads. To help match the event to your ad click while protecting your data, your email, phone, first and last name, and a pseudonymous visitor ID may be hashed (irreversibly scrambled) in your browser before being sent; we never send these identifiers to the ad platforms in plain text for this purpose.

How we use your information

• To respond to your inquiry and plan your expedition.
• To measure which ads and campaigns lead to inquiries, and to improve them.
• To operate, secure, and improve the website.
• To send guests who have travelled with us a note on their birthday (see Birthday notes).

Newsletter subscriptions

If you choose to subscribe, we use your email to send the Waypoint Journeys newsletter with new expeditions, upcoming departures, and occasional offers. Newsletter signup is optional and is not required to receive a reply to your inquiry. We record when and where you opted in and the wording you agreed to. We may use the destination you selected to make expedition emails more relevant.

We use Buttondown to manage subscriptions and deliver newsletter emails. We share your email, destination interest, and signup and consent information with Buttondown for that purpose. Every newsletter includes an unsubscribe link. Unsubscribing stops newsletter marketing; we can still reply to an inquiry or send information needed for your booking. We retain the information needed to record consent and honor your email preferences.

Birthday notes

Once you have travelled with us, we may email you a short note on your birthday from hello@wpjourneys.com, with a gift toward your next expedition. Your birthday comes from the date of birth on your passport, which our team enters from the copy you send us or our AI provider reads from a copy sent from your account (see passports), or from a birthday you give us, and it is kept sealed with your passport details. The note uses only the month and day. Every note has a link to stop them, or reply to any of our emails and we will stop them. Stopping the notes does not delete the date of birth on your booking; to have it deleted, email hello@wpjourneys.com.

Your Waypoint Journeys account

An account lets you see the expeditions you have booked with us, keep a list of the ones you like and ask to book. We keep your name, email and phone number (optional) and your password as a one-way scrambled code, never the password itself. If you continue with Apple, Google or Facebook, they share your name, an account identifier and your email when available; Apple may give us a private relay address that forwards to your own. We never see your Apple, Google or Facebook password. We use that identifier to recognize your sign-in and keep your account email unchanged when you connect another sign-in method. Facebook sign-ups and Google addresses outside Gmail or a confirmed Google Workspace domain need our email confirmation before showing bookings. We also keep the expeditions you save, the booking requests you make and, for each device you sign in on, when you signed in and the type of browser, so that changing your password can sign you out everywhere.

Once you have confirmed your email, your account shows the expeditions in our booking records that list that email: their dates, travellers, status and the itinerary we prepared for you, never our internal notes. For an expedition you have booked it also shows the trip total, what has been paid and when the rest is due, and any invoice for that email still open with Stripe, the payment service we use, with a link to pay it there. When you ask to book from your account, the request reaches our team the way an inquiry does, with the campaign and ad details described above, and we email you a copy.

On an expedition you have booked, you can send us a photo or a PDF of the passport photo page for each traveller, so one person can send the whole party's. For that, your account shows the names of the travellers on the booking as our records spell them, and whether each passport has arrived and when. Before a photo leaves your device, the page checks that it is large, bright and sharp enough to read, and nothing about that check is sent anywhere. Our server then shows the copy to our AI provider, which checks that the whole photo page is in the picture and clear enough to read, and reads the traveller's date of birth from it. It answers with those two things alone, never with anything else the passport says, does not train its models on the copy and keeps it only for a limited time under its own retention policy. We keep that date of birth only when it agrees with the machine-readable lines at the bottom of the page, check digit included, and seal it like the passport details our team enters, with a key only our website holds, in our private booking records, which GitHub hosts for us and cannot read. It goes on the traveller's booking for arranging permits and flights, your account shows its month and day as your birthday when the passport is your own, and we use it for a birthday note once you have travelled with us (see Birthday notes). A copy our team files for you, from one you emailed, is not shown to our AI provider. If either check finds a problem, the page asks for a clearer photo and, after a second try, lets you send it anyway. Where the visa for a trip needs a passport-style photo of each traveller on a white background, your account asks for that photo as well and treats it like the passport copy: the page checks that it is large and bright enough, our AI provider checks only that it shows one person's face clearly against a plain white background, and everything below applies to it too. The copy is then sealed, with a key only our website holds, and the sealed file is kept in private storage that Vercel runs for us, never public. Only our team, signed in, and the account that sent it can open it: you can view a copy you sent from your account at any time, but one emailed to us, or sent from another account, opens only for our team. It belongs to the traveller, so it also counts for their later bookings with us and they need not send it again. We delete it 365 days after the traveller's last trip with us (a new booking moves that date, a cancelled one does not), and you can replace or remove it from your account at any time, which deletes our copy straight away. Our team gets a short email when a passport or visa photo arrives or is removed, with the traveller's name and the trip, never the passport or photo. Removing the copy does not remove passport details our team has already entered in your booking to arrange permits, flights or hotels, or the date of birth read from it; to have those deleted, email hello@wpjourneys.com.

The account is kept in a database that Upstash runs for us through our website host, Vercel. To limit sign-in and sign-up attempts, our server counts the attempts from your IP address for up to an hour, filed under a one-way code made from the address, never the address itself. To delete your account and everything it holds, use Delete account in the Waypoint Journeys app, or email hello@wpjourneys.com.

The Waypoint Journeys app for iPhone and Android uses the same account and shows the same things: your bookings, itineraries day by day, the checklist for each trip, your participation agreement and passport copies. It keeps a copy of your account overview, itineraries and checklist on your phone so they open with no signal, and removes it when you sign out. The items you tick on a trip's checklist are saved to your account, so they follow you from one phone to another and our team can see what is still open. If you allow notifications, we keep a notification token for each of your devices, with whether it is an iPhone or an Android phone, so our team can tell you about your trip; Apple or Google delivers each notification. The app uses your camera or photo library only when you choose to photograph or send a passport or visa photo, as described above. It has no advertising or analytics tools. Delete account, on the app's Account screen, deletes your sign-in, the expeditions you saved, your booking requests and your notification tokens, and ends your Sign in with Apple connection; the expeditions you have booked stay in our booking records, with their invoices, for as long as our booking terms and the law require.

Signing your participation agreement

You can read and sign your Expedition Participation Agreement, with any supplement your trip needs, at wpjourneys.com/sign: from a personal link we email you, from your account, or by filling it in yourself. It asks for your full legal name, date of birth, nationality, country of residence, email, mobile number and an emergency contact, and for any trip details we have not already filled in. As the record of how and when you signed, we also keep the time you opened the page, agreed to sign electronically and signed, the time of each initial, how we knew it was you (the link we emailed you, your account's confirmed email or, if you fill it in yourself, whether the email you give is the one on your booking), your IP address and the browser details your browser sends (its user agent).

The signed document and that record are sealed together the moment they reach our server, with a key only our website holds, and kept in our private booking records, which GitHub hosts for us and cannot read. We email you a copy of the signed document. To prove when you signed, a fingerprint of the signed document (a SHA-256 hash, from which nothing in the document can be read) is sent to an independent timestamp authority, DigiCert or Sectigo, which signs it with the time; the document itself is never sent to them. Our booking record notes that you signed, when and how, never your date of birth. Only our team, signed in, can open the sealed copy; you can download your own from your account. We also email a copy of the signed document to our team's own mailbox, in our Google Workspace, so that we hold the company's copy of every agreement. An unused signing link is kept for us by Upstash for up to 90 days, and a signed agreement whose save is waiting to be retried until it is saved. So that we can show your copy reached you, Upstash also keeps for us the reports Resend sends on the emails a signing sends (accepted, delivered, delayed, bounced or marked as spam), and a record of each time a sealed copy is opened: when, by whom (a team member's work email, or your account) and a one-way code made from the IP address it was opened from, never the address itself. We keep these for as long as we keep the agreement. We keep the signed agreement and that record for 7 years after the last trip the agreement covers ends, or, for a traveller under 18, until 7 years after their 18th birthday if that is later. If someone dies or is seriously injured on a trip, or a claim about a trip is threatened, we keep the agreements for that trip until the matter is closed.

Chatting with Wayfinder

Wayfinder, the travel guide on our website, is an AI. What you type to it, with the conversation so far, is sent to the AI provider whose model writes its replies. When you chat from an expedition's page it is also told which expedition it is, so it can answer about it. We use only AI providers whose business terms do not let them train their models on these messages, and they keep them only for a limited time under their own retention policies.

When the chat opens, Cloudflare Turnstile checks in the background that a person, not an automated script, is using it, so we can keep spam and abuse out. It never asks you to solve a puzzle. To do this, Cloudflare receives your IP address and technical details about your browser and device, which it uses only to tell people from bots. How Cloudflare handles that information is set out in its Turnstile Privacy Addendum.

We do not keep the conversation on our side. It stays in your browser tab (see wpj_wayfinder above) until you close the tab or choose Start over, and a conversation more than a day old starts afresh. To limit how many messages one visitor can send and to shut out abuse, our server keeps a count of the messages sent from your IP address for up to a day, filed under a one-way code made from the address, never the address itself. Our logs record the timing and size of each reply, which expeditions it suggested and which expedition's page you chatted from, never what was said.

If you send your details to our team in the chat (Wayfinder asks for your name and then your email, or you can use the form it offers), it works like our inquiry form: your name and email never go to the AI provider, and your name, email, the expedition, dates and group size reach us as an inquiry, together with the conversation and a few lines Wayfinder writes to sum up the trip you have in mind, so nobody has to ask you twice, and the measurement described above applies. Please do not share passport numbers, health details or other sensitive information with Wayfinder.

Who we share it with

We do not sell your personal information. We share limited data with service providers who act on our behalf:

• Google. We deliver inquiry details to our own Google Workspace (Gmail and Google Sheets, via Google Apps Script) so our team can respond quickly, and keep the company's copy of each signed participation agreement in its Gmail; we use Google Analytics & Google Ads for measurement; and Google signs you in to your account if you continue with Google.
• Meta Platforms. Facebook signs you in if you choose it. The Meta Pixel and Conversions API are used for advertising measurement (hashed identifiers as described above).
• OpenAI. The OpenAI Ads Pixel for ChatGPT Ads conversion measurement (hashed identifiers as described above).
• Microsoft. Universal Event Tracking for our Microsoft Advertising pilot, as described above. Microsoft also uses the data it receives for its own purposes under its Privacy Statement.
• Our AI provider. Writes Wayfinder's replies from the messages you send it (see Chatting with Wayfinder), checks that a passport copy or visa photo sent from your account is clear enough to use, and reads the date of birth from a passport copy (see passports).
• Cloudflare. Cloudflare Turnstile checks that the chat is used by a person, not a bot (see Chatting with Wayfinder).
• Vercel. Hosts our website, and keeps the passport copies and visa photos you send from your account in private storage, sealed so that Vercel cannot read them (see passports).
• Upstash. Runs the database that holds your account (see Your Waypoint Journeys account), and holds unused signing links, any signed agreement waiting to be saved, and each signed agreement's email delivery reports and record of openings (see Signing your participation agreement).
• GitHub. Hosts our private booking records, including the sealed copies of signed participation agreements and sealed passport details such as a date of birth, which GitHub cannot read (see Signing your participation agreement and passports).
• Resend. Sends the emails your account needs: the link that confirms your email, a welcome when you join with Google, a password reset link and your copy of a booking request, a link to sign your participation agreement, your copy once it is signed and our team's copy (and tells us whether each of those two was delivered), and the note that tells our team a passport or visa photo has arrived or been removed, which names the traveller and the trip but never carries the passport or photo. It also sends our birthday notes.
• Stripe. Takes payment on our invoices. Your account looks up the invoices still open for your confirmed email so you can pay them from there.

These providers process data in the United States.

How long we keep it

Inquiry details are kept for as long as needed to assist you and for our normal business records. Your account is kept until you ask us to delete it, and a sign-in on a device lasts 30 days. A passport or visa photo sent from your account is deleted 365 days after the traveller's last trip with us, or as soon as it is removed from the account; the date of birth read from it stays, sealed, for your account and birthday notes until you ask us to delete it. A signed participation agreement is kept for 7 years after the last trip it covers ends (for a traveller under 18, until 7 years after their 18th birthday if that is later), and longer after a death or serious injury on a trip, or a threatened claim about one, until the matter is closed. Analytics and advertising data follow the retention periods of Google, Meta, and OpenAI. You can ask us to delete your inquiry at any time.

Your choices

• Cookies. You can block or delete cookies in your browser settings. You can opt out of personalised ads via Meta ad preferences and Google ad settings.
• Access or deletion. Email hello@wpjourneys.com to request a copy of, or the deletion of, the information you've given us.

A note for visitors in the UK / EU

We do not currently show a cookie banner. The analytics and advertising tags described above load when you arrive, wherever you are visiting from. If you would rather they did not, you can block or delete cookies in your browser and opt out of personalised advertising at the links under Your choices above; those controls work regardless of where you are. If you are in the UK or EU and want to exercise your rights under the UK GDPR or GDPR, including access to or deletion of what we hold about you, email hello@wpjourneys.com and we will action it.

Changes

We may update this policy from time to time; the "last updated" date above will change accordingly.

Contact

Waypoint Journeys · hello@wpjourneys.com