This Privacy Policy explains how Velatris Analytics Inc. (“we”, “us”) collects, uses, shares and protects personal information when you use Royal Price Matching at royalpricematching.com, including our website, price alerts and related e-mails (the “Service”).
1. Who we are
The Service is operated by Velatris Analytics Inc., a company located in Ontario, Canada. We are the organization responsible for (the “controller” of) your personal information under this policy. You can reach us about privacy at support@royalpricematching.com.
2. Information we collect
Information you give us
- Account information: your name, e-mail address, and a password, which we store only as a one-way bcrypt hash (we cannot read your password). We also record whether you have confirmed your e-mail address, and any new address you ask to change to while it awaits confirmation.
- Watchers: the sailings, cabin types, party sizes and onboard packages you choose to track, and any alert thresholds you set.
- Optional feedback: if you delete your account, you can tell us why. This feedback is stored anonymously, with your former plan name only — no e-mail address or account identifier is kept with it.
- Messages: what you send us when you contact support.
Information created when you use the Service
- Account activity: when you created your account and last logged in, and onboarding progress (for example, the time of your first Find Deals search and whether you have viewed the help guide).
- Find Deals searches: we use the filters you choose to run your search. We do not store your searches against your identity; we keep only the time of your first search.
- Technical information: your IP address, browser user agent, the pages requested and the time, recorded in server and security logs, and temporary counters used to limit repeated requests (rate limiting).
- E-mail delivery records: our e-mail provider keeps records of the messages we send you, such as delivery status.
Information from payment processing
Paid plans are billed by Stripe. Stripe collects your payment details directly; we never see or store your full card number. We store only your Stripe customer ID, subscription ID and current plan, and we receive notices from Stripe about your subscription status (for example, renewals and cancellations).
3. How we use it and why
| Purpose | Information used | Legal basis (where GDPR/UK GDPR applies) |
|---|---|---|
| Create and run your account, check prices for your watchers, send alerts and service e-mails | Account information, watchers, account activity | Performance of our contract with you |
| Process subscriptions and keep billing records | Stripe IDs, plan, subscription notices | Contract; legal obligation (tax and accounting) |
| Keep the Service secure, prevent abuse and fraud (including reCAPTCHA on sign-up and rate limiting) | Technical information, reCAPTCHA signals | Our legitimate interests in a secure, reliable service |
| Improve the Service and fix problems | Technical information, anonymous deletion feedback, onboarding progress | Our legitimate interests |
| Measure whether our Google Ads lead to sign-ups or purchases | Advertising cookies and conversion events | Your consent, which you can withdraw at any time |
| Respond to support requests and legal claims | Messages and relevant account information | Contract; legitimate interests; legal obligation |
We do not send marketing e-mails. If we ever want to, we will ask for your permission first. We do not use your information for automated decisions that have legal or similarly significant effects on you.
4. Who we share it with
We do not sell your personal information. We share it only with service providers who process it on our behalf, under contracts that require them to protect it and use it only to provide their services to us:
| Provider | Purpose | Location |
|---|---|---|
| Stripe | Payment processing and billing | United States |
| Mailgun | Sending alert and account e-mails | United States |
| Google (reCAPTCHA v3) | Protecting the sign-up page from automated abuse | United States |
| Google (Google Ads) | Measuring ad conversions — only if you accept advertising cookies | United States |
| Cloudflare | Content delivery and security | Global network |
| Our cloud hosting provider | Running our servers and database | United States |
We may also disclose information if required by law, to protect the rights, safety and security of our users, us or others, or as part of a merger, acquisition or sale of assets, in which case this policy will continue to apply to your information.
5. Cookies and similar technologies
- Strictly necessary: a session cookie keeps you logged in and protects forms against cross-site request forgery (CSRF). The Service cannot work without it, so it does not need consent.
- Your consent choice: we remember whether you accepted or rejected advertising cookies in your browser's local storage (key
rpm-consent). Some pages also remember display preferences, such as monthly or yearly prices, in local storage. - Google Ads (optional): only if you choose “Accept”, we load Google's tag, which sets cookies to measure whether a visit from an ad led to a sign-up or purchase. Nothing is loaded if you choose “Reject”. You can change your choice at any time with “Cookie settings” in the footer of every page.
- reCAPTCHA: the sign-up page uses Google reCAPTCHA v3, which may set cookies and collect device and interaction information to tell people and bots apart. Google's Privacy Policy (opens in a new tab) and Terms of Service (opens in a new tab) apply.
- Cloudflare may set strictly necessary security cookies to protect the site.
We do not use analytics or advertising trackers other than those described here. Our fonts are served from our own servers.
6. International transfers
We are based in Canada and several of our service providers process information in the United States or elsewhere. Your information may therefore be stored and processed outside your country, where the law may differ. Where data protection law requires it — for example for information about people in the European Economic Area, the United Kingdom or Switzerland — we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK addendum, or a provider's certification under the EU–US Data Privacy Framework.
7. How long we keep it
- Account information and watchers: until you delete your account (you can delete individual watchers at any time). Deleting your account removes your account and all of its watchers immediately.
- Billing records: deleting your account cancels any subscription immediately but does not delete invoices. Stripe and we keep billing and transaction records for as long as tax and accounting laws require (typically up to 7 years).
- Server and security logs: kept for a short period, generally no more than 30 days, unless needed to investigate a security incident.
- Rate-limiting counters: expire automatically within minutes to a day.
- E-mail delivery records: kept by Mailgun for its standard retention period.
- Deletion feedback: anonymous, so it is not linked to you and is kept to help us improve.
8. Your rights
Depending on where you live (including under Canada's PIPEDA and provincial laws, the EU and UK GDPR, and US state laws), you may have the right to:
- access the personal information we hold about you and get a copy of it;
- correct inaccurate information;
- delete your information;
- receive your information in a portable format;
- object to, or ask us to restrict, certain processing (including processing based on legitimate interests);
- withdraw consent at any time, for example by choosing “Reject” in Cookie settings — this does not affect processing that already happened.
How to exercise them: you can update your name, e-mail and password and delete your account yourself in Account settings. For anything else, e-mail support@royalpricematching.com. We may need to verify your identity and will reply within the time the law requires (usually 30 days). We won't treat you differently for exercising your rights.
9. US state privacy rights (including California)
In the past 12 months we have collected the categories of information described in section 2 (identifiers, account and commercial information, internet activity, and inferences limited to fraud prevention), for the purposes in section 3, and disclosed them to the service providers in section 4. We do not sell personal information. We do not “share” personal information for cross-context behavioural advertising, except that if you accept advertising cookies, Google Ads may receive information to measure ad conversions; you can opt out at any time with “Cookie settings” (choose “Reject”). We do not use or disclose sensitive personal information for purposes that would give you a right to limit it. To make a request, e-mail support@royalpricematching.com; you may use an authorized agent.
10. Security
We protect your information with measures appropriate to its sensitivity, including encryption in transit (HTTPS), bcrypt password hashing, protection against cross-site request forgery, a strict content security policy, rate limiting of sign-in and other sensitive actions, sign-out of all devices when you change your password, and access to production systems restricted to authorized staff. No system is perfectly secure; if a breach affects your information, we will notify you and the relevant authorities as the law requires.
11. Children
The Service is not intended for anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.
12. Changes to this policy
We may update this policy from time to time. We will change the “Last updated” date above and, for significant changes, notify you by e-mail or in the Service before they take effect.
13. Contact and complaints
Questions or requests: support@royalpricematching.com · Velatris Analytics Inc., Ontario, Canada. For help with the Service itself, write to support@royalpricematching.com.
If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca (opens in a new tab)) or to the data protection authority where you live or work.