Privacy Policy

WhatsOutsyde

Last updated: 9 October 2026

1. Who we are

WhatsOutsyde (“we”, “us”, “our”) is a map-first platform that helps people discover places, events, and experiences in Jamaica and connect with local operators, guides, drivers, and businesses.

For the Jamaica Data Protection Act, 2020 and, where they apply, UK/EU data-protection law, WhatsOutsyde is the data controller of personal data described in this policy. We are based in Jamaica. A Jamaican-qualified lawyer has not yet signed this policy; it describes how the live product actually stores data today.

Privacy contact: hello@whatsoutsyde.com

Data Protection Officer: Jason Hinds, at the same address. Our Data Protection Officer checks that we handle personal data as the Data Protection Act requires and helps with requests about your data.

2. Information we collect

We collect only what the product needs. Data lives in our Postgres database (Supabase), in files you upload (Storage), in short-lived security logs, and — on your device — in cookies and local storage. We do not run a separate advertising profile.

We collect:

• Account: email, password hash (held by our auth provider — we never store your password in plain text), Google or Apple sign-in identifiers if you use them, display name, avatar, role (visitor, operator, guide, or business), optional group fitness, language choice, rewards points, and (for hosts) membership fields
• Guest booking contact: name, email or phone you type, dates, party size, and notes — even if you have no account. Guests must confirm an email with a one-time code before we accept a booking request
• Bookings and enquiries: listing snapshot, status (pending, confirmed, declined, cancelled, completed), book mode (request or instant), payment status (unpaid or pay-the-operator; we do not take a card for experiences yet), operator notes
• Trips and saves: named trip plans, stop coordinates, time of day, notes, shared-link token, saved places, and saved addresses (including Mapbox place ids)
• Reviews: star rating, optional comment and photo, only after you have booked or enquired through the app
• Live events: RSVPs, clips you upload, likes/shares
• Guides, transfers, packages: tour-request and transfer-request details, package enquiries
• Messages: contact form, incident reports (the operator is not told you reported them from that form), privacy requests
• Marketing opt-in: newsletter email or WhatsApp number if you subscribe; business-follower email if you follow a venue
• How you found us: if you arrive through a campaign or invite link, we note the link’s campaign tags (such as utm_source), the site that sent you, the page you landed on, and any friend’s invite code, with your sign-up — so we know which posts work and can credit referrals
• Usage counters: listing views, WhatsApp taps, trip-adds (counts, not a marketing dossier)
• Location: stay town you pick, optional “use my location”, precise coordinates you save on trips/transfers (see below)
• Emergency contacts and panic alerts (optional): up to 3 people you add in Account → Safety (name, email, optional phone) and whether each accepted; and, each time you press the panic button, the time and your phone’s location (see below)
• Access needs (optional): if you choose to tell us that you or someone you travel with uses a wheelchair, has limited mobility, is deaf or hard of hearing, is blind or has low vision, has sensory needs, or travels with a service animal (see below)
• Technical and security: IP address, request metadata, TLS handshake fingerprints supplied by the CDN (JA3/JA4 — not invented from your User-Agent), login lockouts, and hashed one-time codes
• Partner verification (drivers, guides, operators, businesses): the identity and licence documents you upload (stored privately), what our automatic check read from them, a fingerprint of each file and of its document number, and the last four characters of that number

Partner documents. Documents are checked automatically: our AI provider reads each one, together with the names on your account, to confirm it is the right document, readable, in date and in your name. Clear documents are approved; ones it can't decide are reviewed by a person, and you can always ask us for a person to review a decision. To stop one person running several partner accounts, the same document, document number or WhatsApp number can't be used on two accounts, and a dotted or name+tag version of an existing account's email can't open a second one. If we block an account, fingerprints of its email, WhatsApp numbers and documents are kept so they can't be used on a new account. Fingerprints are one-way codes, not the numbers themselves.

Location and maps. Stay town and “use my location” are approximate, to show what is nearby and estimate drive times. Saved places, trip stops, and transfer destinations store the coordinates and any address you enter so directions and a driver can work. Saved places and trips are visible only to you (and to people you share a trip link with). We do not sell location data or use it for advertising.

Access needs. This is health information, so we only collect it if you choose to answer, and we use it only to decide which places, guides, and drivers to show you. It is kept on your device and, if you have an account, in a private record only you can read. We do not share it with businesses — except that when you request a ride you can choose to tell drivers you need a wheelchair-accessible vehicle or are travelling with a service animal. You can change it, switch the filter off, or clear it at any time in Account → Settings → Access needs.

Panic button. If you add emergency contacts, we email each one an invite saying you added them; they can accept (to also get app alerts) or say no thanks. If you switch the panic button on and press it, we send your name, the time and your location to the contacts who haven’t said no thanks — by email, and as an app notification to those with a WhatsOutsyde account. We keep each alert (time and location) for 90 days so your contacts can open it, then delete it. WhatsOutsyde does not contact the police or emergency services for you.

Maps and search. Search terms and coordinates needed for a map or route go to Mapbox, outside Jamaica. We send only what that request needs.

Airport transfers. Nearby transport partners are alerted to a general area and party size. Your exact drop-off and contact stay with WhatsOutsyde until we connect you with a driver.

One-time email codes. For guest bookings (and for changing a password while signed in) we email a 6-digit code. We store a hash of that code against your email and purpose — not the code itself. Codes expire in about 10 minutes; too many wrong guesses locks that check. Signed-in users skip the booking code.

On your device. Essential cookies keep you signed in and stop cross-site request forgery (`trod_csrf` plus our auth cookies). Local storage remembers language, stay town, fitness, cookie choice, similar first-open flags, and a friend’s invite code if you followed their link. The campaign link you arrived from is kept on your device only if you opt in to analytics. Analytics run only after you opt in. Google Translate runs after you opt in, or when you choose a language other than English in our language picker (choosing English switches it off).

3. How we use your information

We use your information to:

• Run the map, account, bookings, trips, events, and host tools
• Pass a booking or enquiry to the operator and email you a confirmation when we have an address
• Prove a guest email with a one-time code before a request is stored
• Show in-app notifications and reminders about your bookings
• Keep the service secure (rate limits, lockouts, TLS fingerprints, abuse logs)
• Check partner documents automatically, and stop one person running several partner accounts or returning after a block
• Process host membership payments through our third-party payment processor if you buy a plan — we do not store full card numbers, and experience bookings are still paid to the operator directly
• Send transactional email (codes, booking notices). Newsletter and venue follow-mail only if you asked
• Improve the product using coarse usage counts, not advertising profiles

4. Legal bases for processing

Under the Jamaica Data Protection Act, 2020 we process personal data fairly, for specified purposes, only as much as needed, and with appropriate security. Where UK or EU/EEA law also applies, we use these legal bases:

• Contract: creating an account, processing a booking or RSVP, sending the codes and notices that booking needs, providing trips and host tools you asked for
• Legitimate interests: security and abuse prevention (IP, TLS fingerprint, lockouts), checking partner documents and preventing duplicate or blocked partner accounts, showing nearby places from the stay you picked, and limited product understanding. You can object (see rights below)
• Consent: non-essential cookies (translation / analytics), translation when you choose a language, optional device location, the panic button, newsletter, and following a venue. You can withdraw in Cookie settings, by choosing English, by switching the panic button off, or by unsubscribing
• Explicit consent: access needs you choose to give us (health information). You can withdraw by clearing them in Account → Settings → Access needs
• Legal obligation: tax or lawful requests; host membership records where a payment is made

5. How we share information

We do not sell your personal information.

We may share information with:

• The operator, guide, or driver on a booking, tour request, or transfer — name, contact, dates, party, notes you typed
• Drivers on a ride request — only if you choose to, a line saying you need a wheelchair-accessible vehicle or are travelling with a service animal
• Anyone you share a trip link with (the plan you chose to share)
• Service providers listed below, only to run the feature that needs them
• Authorities if required by law

The processors we actually use today:

• Supabase — accounts, Postgres (including bookings, trips, OTP hashes, security events), and file storage. Row-level security limits what a signed-in browser can read
• Vercel — hosts the website and serverless APIs
• Mapbox — maps, geocoding, directions
• Resend — transactional email (password codes, booking codes, booking notices, contact form, emergency-contact invites and panic alerts)
• Payment processor — host membership only, if you pay. Not used for experience checkout today
• Google or Apple — only if you sign in with them
• Google Translate — only after you opt in to non-essential cookies, or when you choose a language other than English
• Anthropic (Claude) — optional AI concierge / trip draft: only the text you type is sent; we do not send your name, email, or booking contact. For partners, it also reads uploaded verification documents, with the names on the account, to check them. Under the provider’s API terms, none of this is used to train their models

We do not currently run a separate advertising or marketing-cookie product. Analytics cookies stay off until you turn them on in Cookie settings.

6. International data transfers

We are based in Jamaica. Hosting, database, maps, email, sign-in, payments, and AI may process data in the United States, the UK, the EU, or other countries.

For Jamaica DPA transfers we rely on those providers’ contractual and security safeguards. Where UK or EEA law applies we also rely on Standard Contractual Clauses or an adequacy decision where one exists. Counsel should still confirm these transfer tools.

7. How long we keep data

We keep personal data only as long as we need it:

• Account and profile: while the account is open. Delete my account removes the login, profile, listings you created, events, guide profile, gift claims, and uploaded listing photos. Bookings you made are anonymised (name and contact cleared, unlinked from your user id) so an operator can still see that a slot was requested — not your identity
• Guest bookings and enquiries: while needed to complete the request, then typically up to 24 months for questions or disputes
• One-time codes: hash stored until it expires (about 10 minutes) or is overwritten; not used for marketing
• Security events and lockouts: typically up to 90 days, longer only to investigate abuse
• Access needs: until you clear them or delete your account
• Emergency contacts: until you remove them or delete your account. Panic alerts (time and location): 90 days
• Saved places, saved addresses, and trip plans: in your account until you delete them or the account. Inactive precise-location rows may be purged after 24 months
• Reviews: while the listing remains, or until we remove them for policy reasons
• Payment records (membership): as tax and payment-processor rules require
• Newsletter / followers: until you unsubscribe or we delete the account
• On your device: cookie choice and first-open flags until you clear site data

Backups may hold a copy for a short time after deletion, then they expire.

8. Your rights under GDPR

Jamaica’s Data Protection Act gives you rights to fair processing, access, correction, and to complain to the Office of the Information Commissioner. If UK or EU/EEA data protection law applies to you, you also have the following rights:

• Right of access — ask for a copy of the personal data we hold about you
• Right to rectification — ask us to correct inaccurate or incomplete data. You can also update your name and photo in Account
• Right to erasure (“right to be forgotten”) — ask us to delete your data. You can delete your account in Account → Delete my account. Some anonymised booking rows may remain for the operator’s records
• Right to restrict processing — ask us to limit how we use your data in certain cases
• Right to data portability — ask for a copy of data you provided to us, in a common format
• Right to object — object to processing based on legitimate interests, including limited analytics and security profiling such as rate-limits
• Rights related to automated decision-making — we do not use solely automated decisions that have legal or similarly significant effects on you. Map ranking, rate limits, and review gates are not that kind of decision
• Right to withdraw consent — where we rely on consent (for example non-essential cookies), you can change that in Account → Cookie settings

These rights are not always absolute. We will explain if we cannot fully meet a request, and why.

9. How to exercise your rights

You can:

• Update your account details in the app (Account)
• Delete your account in the app (Account → Delete my account)
• Send a privacy request in the app (Account → Privacy request) — access, correction, or a question
• Manage cookies (Account → Cookie settings, or Cookie settings on this page)
• Email us at hello@whatsoutsyde.com

Please tell us which right you want to use and enough detail for us to find your account or guest booking (usually the email you used). We may need to confirm it is you. We aim to reply within one month.

10. Cookies and similar technologies

We use essential cookies and similar technologies to keep you signed in and to make the app work. Analytics cookies stay off until you Accept all or turn Analytics on in Cookie settings.

Essential (always): login/session cookies from our auth provider; the CSRF cookie (`trod_csrf`); first-open choices stored on the device. Non-essential (only after opt-in): Google Translate and any future basic analytics. Google Translate also runs when you choose a language other than English in our language picker. We do not use marketing cookies today.

11. Children’s privacy

The app is not intended for children under 16. Host (operator, guide, business) accounts are for adults 18 and over. We do not knowingly collect personal information from children.

12. Complaints

If you are unhappy with how we use your data, please contact us first at hello@whatsoutsyde.com so we can try to put it right.

You also have the right to lodge a complaint with a supervisory authority. In Jamaica that is the Office of the Information Commissioner. In the EU/EEA it is the data protection authority in your country. In the UK it is the Information Commissioner’s Office (ico.org.uk).

13. AI features

Some optional features use artificial intelligence to help you — the AI trip-planner and the “Ask WhatsOutsyde” concierge. These are clearly labelled as AI features when you use them.

When you use them, the text of the request you type is sent to our AI provider (Anthropic) to generate a response. We do not send your name, email, or account details, and under our provider’s API terms your request is not used to train their models. AI responses are generated automatically and can be inaccurate or incomplete, so please confirm important details (prices, times, safety, availability) with the operator before relying on them.

We do not use AI to make decisions that have a legal or similarly significant effect on you. Using the AI features is entirely optional.

14. Changes

We may update this Privacy Policy from time to time. The updated version will be posted in the app with a new “Last updated” date.

15. Contact

For privacy questions or requests: hello@whatsoutsyde.com

Data Protection Officer: Jason Hinds, at the same address.

In the app: Account → Privacy request, or Account → Delete my account.