Privacy Policy

Effective Date: 22 April 2025  |  Last updated: 04 May 2025

Royal Price Matching (R‑PM, we, our, us) respects your privacy and is committed to protecting your personal information. This Privacy Policy explains what we collect, how we use it, and the choices you have.

1. Who we are

Velatris Analytics Inc. operates royalpricematching.com from Ontario, Canada. For GDPR purposes we are the data controller.

2. Scope

This Policy applies to visitors and registered users (Users) of royalpricematching.com and to communications (email, support tickets) directly related to the Service.

3. Information we collect

• Account data – name, email address, hashed password, account‑creation timestamp, confirmation status.
• Watcher data – ship name, sail date, cabin class, alert thresholds, and any price‑history we scrape on your behalf.
• Billing data – Stripe customer ID, subscription ID, plan tier, renewal date, and (for EU/UK etc.) tax location. We never store full credit‑card numbers; Stripe does that.
• Cookies – a single session cookie to keep you logged in, plus Cloudflare security cookies. No ad‑tracking cookies.

4. How & why we use your data

We process personal data only where we have a lawful basis:

• Contract performance – to deliver price alerts, maintain your account, and process subscription payments.
• Legitimate interests – to prevent fraud, improve the Service, and defend legal claims.
• Consent – for optional marketing emails (we currently send none, but will ask first if we ever do).
• Legal obligation – to comply with tax, accounting, and consumer‑protection laws.

5. Who we share it with

We do not sell or rent your personal info. We share it only with service providers that enable core functionality:

Provider	Purpose
Stripe	Payments & billing
Mailgun	Email delivery
AWS (East‑1)	Servers & databases
Cloudflare	CDN & DDoS protection
Plausible	Privacy‑friendly analytics

All vendors are bound by contracts that require them to protect your data and use it only for the stated purpose.

6. International Transfers

We are Canadian, but some data is processed in the United States and the European Economic Area. Where EU/UK data leaves those regions we rely on Standard Contractual Clauses (SCCs) or vendor adequacy decisions.

7. Retention periods

• Account & billing records – as long as you have an account and up to 7 years thereafter for tax/audit purposes.
• Watcher data – until you delete the watcher or 1 year after the sail date, whichever comes first.
• Server logs – 30 days, unless we need them for security investigations.

8. Security

We use TLS 1.2+ encryption in transit, AES‑256 at rest, principle‑of‑least‑privilege IAM, hourly off‑site backups, and industry‑standard hashing (bcrypt) for passwords. No system is 100 % secure; if we detect a breach that affects you, we will notify you and regulators as required by law.

9. Children

R‑PM is not directed to children under 18. We do not knowingly collect data from minors. If you believe a child has provided us personal information, please contact us and we will delete it.

10. Changes to this Policy

We may revise this Policy from time to time. Continued use of the Service after the effective date constitutes acceptance of the updated Policy.

11. Contact Us

Questions, concerns, or requests? Reach our Privacy Officer at:
[email protected]