Legal

Privacy Notice

Last updated: June 8, 2026

1. Who we are

This Privacy Notice explains how Justin Whitaker, a sole proprietor doing business as Broken Bow Escapes ("we", "us", "our"), collects and uses your personal data when you visit brokenbowescapes.com or book a stay with us. We act as the data controller for the personal data described below. Contact: hello@brokenbowescapes.com.

2. What we collect

  • Account & booking data — name, email, phone number, billing address, party size, check-in/out dates, cabin chosen, add-ons.
  • Guest communications — messages you send us by email, chat, or contact form.
  • Reviews and photos you submit after a stay.
  • Loyalty / VIP — your status, points, and stay history.
  • Usage and device data — pages viewed, referrer, IP address, browser and device identifiers, approximate location derived from IP, and basic analytics events.
  • Cookies — see the Cookies section below.

We do not store full payment card numbers. Card details are entered directly into Paddle's PCI-compliant checkout and never reach our servers.

3. Why we use it and our legal basis

  • To provide your booking (contract performance) — process reservations, send confirmations, manage check-in, handle add-ons and refunds.
  • To run and secure the Site (legitimate interests) — prevent fraud and abuse, monitor uptime, debug, improve the product.
  • To send transactional messages (contract / legitimate interests) — balance-due reminders, review requests, important service notices.
  • To send marketing (consent, where required) — newsletter and offers; you can unsubscribe at any time.
  • To comply with law (legal obligation) — tax records, lawful requests from authorities.

4. Who we share data with

We share personal data with the following categories of recipients, only as needed:
  • Paddle.com — our reseller and Merchant of Record, for payment processing, subscription/refund management, invoicing, and sales-tax compliance.
  • Hosting and infrastructure providers — cloud hosting, database, and email delivery used to run the Site and send transactional email.
  • Analytics and error monitoring — privacy-respecting analytics and error reporting to help us improve the Site.
  • Channel partners — calendar sync (iCal) with Airbnb / Vrbo where you booked through those channels.
  • Professional advisers — accountants and lawyers where reasonably necessary.
  • Authorities — where required by law, court order, or to protect our rights and safety.

5. International transfers

We are based in the United States and our service providers may process your data in the US or other countries. Where data is transferred from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms.

6. How long we keep it

Booking and tax records are kept for as long as required by law (typically 7 years in the US). Marketing contacts are kept until you unsubscribe. Analytics logs are kept for up to 14 months. Reviews remain publicly visible unless you ask us to remove them.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, port, restrict, or object to our use of your personal data, and to withdraw consent at any time. Residents of California, the EEA, and the UK have additional rights under CCPA/CPRA, GDPR, and UK GDPR respectively, including the right to lodge a complaint with your supervisory authority. To exercise any right, email hello@brokenbowescapes.com — we respond within 30 days.

8. Security

We apply appropriate technical and organisational measures including encryption in transit (HTTPS), encryption at rest for our database, access controls, and least-privilege practices. No system is perfectly secure; please use a strong, unique password and tell us immediately if you suspect a problem.

9. Cookies

We use a small number of cookies and similar technologies:
  • Essential — required for login, the booking flow, and security. Always on.
  • Analytics — anonymous aggregate usage data so we can improve the Site.
You can clear or block cookies in your browser settings. Blocking essential cookies may break parts of the Site.

10. Children

The Site is not directed at children under 13. We do not knowingly collect their personal data. If you believe we have, contact us and we will delete it.

11. Changes

We will post updates to this Notice on this page and update the "Last updated" date.

12. Contact

Questions or requests: hello@brokenbowescapes.com.