Privacy Policy

Santé Frontiers Group Ltd ("Santé", "we", "us") runs Santé at sante.travel. Santé is a marketplace for outdoor sport travel. Creators publish content and earn commission when people they refer make a booking. Travellers book stays at properties and places on trips run by creators and clubs.

We are the controller of the personal data described in this notice, unless we say otherwise.

• Registered in England and Wales, company no. 16204077
• Registered office: Kiln Farm, Maidstone Road, Marden, Tonbridge, TN12 9AP, United Kingdom
• ICO registration: ZC021526
• Privacy contact: a@sante.travel

We have not appointed a data protection officer, as the law does not require one for a business of our type.

• We collect what you give us, what you do on Santé, and some technical details from your device.
• When you book, the property, trip operator or club hosting you gets the details they need to host you.
• If you came through a creator's link, that creator sees that you booked and your first name and last initial. They never see your email address.
• Analytics run only if you say yes, and you can change your answer at any time.
• We do not sell your data. We do not use advertising cookies.
• To see, correct or delete your data, email a@sante.travel.

3.1 When you create an account

• Your name, email address and date of birth. We use your date of birth to confirm you are 18 or over.
• Your password, stored only as a salted hash. You can also sign in with a single-use link or code sent to your email.
• Your profile: display name, handle, photo, bio, the sports you do, places you want to go and your interests. We use the last two to order trips in your feed (section 6).
• Your profile setting: off, private (approved followers only) or public.
• Your answers about marketing email and analytics.

3.2 When you book

• For a stay: the guest name, email address, dates, party size, and any messages with the property.
• For a trip: the guest name, email address, number of places, which payments you have made and any refunds, and messages with the operator. We also record your IP address and the time you accepted the trip's terms, as evidence of that acceptance.
• Payment: Stripe collects your card details, and we never see your full card number. We keep the card brand, the last four digits and a card fingerprint. The fingerprint lets us spot one card being used across several accounts (section 6).
• If you book without an account, we email you a private link to manage your booking. We also send a single-use link to create an account if you want one. It expires after 30 days.

We do not ask for health, dietary, accessibility or emergency contact details. If a host needs to know something like this, you can tell them in a message. We then pass it only to that host, and only so they can look after you. Please do not share more than they need.

3.3 When you use the social features

• Your posts, photos, videos, captions, comments, likes, saves, shares, follows and lists.
• Direct messages, club messages, and messages between creators and brands.
• Reports you make, and people you block.
• Routes you upload as GPX files, which contain the route's locations. We remove location data from photos when you upload them.

3.4 If you are a creator

• Your creator profile, content, kit lists and any affiliate links you add.
• Your referral link, the visits and bookings it leads to, and the commission you earn.
• Your payout details, which Stripe holds through Stripe Connect.
• Tax details we must collect under the UK reporting rules for digital platforms, when they apply to you (section 8).
• If you apply to join: the Instagram handle or other link you give us, your sports and why you want to join.
• If you work with brands: the audience figures you choose to share, your rate card, and sponsorship offers you send or receive.

3.5 If you run a property, a trip or a club

• Your business and contact details, payout details (held by Stripe), insurance and qualification certificates, and listing content.
• Photos and documents you upload as evidence for a facility badge. These are checked automatically and may be reviewed by Santé staff (section 6).
• For a club: your members, their roles and join dates, RSVPs and club messages.

3.6 What we collect automatically

• Your device and browser type, language, and the page that sent you to us.
• Your IP address. We keep it in full only where we need it, such as when you accept trip terms. For counting link clicks and stopping abuse, we store a scrambled version (a keyed hash) that cannot be turned back into your address.
• What you view and do on Santé: posts viewed, trips opened, saves, and clicks on links and kit. When you are signed in, we link this to your account.
• If you said yes to analytics: product analytics through PostHog, and recordings of a sample of sessions through Sentry, which help us fix errors (section 10).

3.7 From other people

• A creator, club or member who invites you gives us your email address and first name, and sometimes a personal note.
• When you arrive through a creator's or club's link, we record who sent you (section 9).
• If you run an accommodation business, we may have researched it before you had an account (section 4).

If you run an accommodation business and have never used Santé, we may still hold information about that business. We may also have written to you about it. This section explains what we hold, why, and how to stop it.

What we hold. Business contact details: a name where your website publishes one, a business email address and a website address. We also hold information about the property: its location, rooms or pitches, facilities, published rates and photographs. Where a listed contact is a named person rather than a general address, that name and address are personal data, and this section applies to them.

Where it came from. Your business's own public website. Our crawler stays on your domain, reads at most 40 pages, and follows the rules in your robots.txt file. It does not use review sites, booking platforms, social media or directories. Some records are instead entered by Santé staff, from details a business has published or from an introduction by someone who knows it. We do not buy contact lists or use data brokers. Every claim we publish about a property is linked to the page it came from. Anything we cannot link to a page is discarded.

What we do with it. We build a preview of how your business would look on Santé, and write to you inviting you to claim it, correct it or remove it. We use Anthropic's Claude to write the listing from your website and to draft the email to you, which includes your name.

When you open the preview. We record that the link was opened, which parts of the page were viewed and for how long. We use a scrambled version of your IP address for this, and use it only to decide whether to follow up.

Our legal basis. Legitimate interests: introducing an accommodation business to a marketplace relevant to it, using information the business published for that kind of contact. We have assessed that this does not override your rights, and you can ask us for that assessment. If the business is a sole trader or a partnership that is not an LLP, we treat the contact as an individual under the Privacy and Electronic Communications Regulations. We then do not send marketing email without consent or a soft opt-in.

How long we keep it. A preview expires 10 days after we send it. If it is not claimed, it is deleted in full within 48 hours of expiring: the property record, our research notes and the source links. A preview we never send is deleted after 30 days. We keep only the business name, web address and dates, so that we never research or contact the same business again.

How to stop it. Every preview page has a one-click removal link. You don't need an account or to reply to us. It takes the page down and adds your business to a do-not-contact list that outlives the deleted record. A later crawl will not rebuild the page or write to you again. You can also reply to any email from us, or email a@sante.travel.

You have the same rights as anyone else whose data we hold (section 14). That includes the right to object to processing based on legitimate interests and the right to complain (section 15).

Where we rely on legitimate interests, we have assessed that our interest in running a safe, working marketplace does not override your rights. You can ask us for that assessment, and you can object at any time (section 14).

Some details are needed for a contract. Without your name and email address we cannot take a booking. Without payout and tax details we cannot pay a creator or host.

We use automated checks in the places below. Where a check affects you, you can ask a person at Santé to review it by emailing a@sante.travel. You can explain your side, and we will tell you the outcome.

• Your feed. Trips that match the places and interests on your profile are shown higher. Nothing is hidden.
• Search. Places recommended by creators you follow are shown higher.
• Commission checks. Before commission is paid, we check for signs that a booking was not a genuine referral. We compare card fingerprints, and look for links between the booker and the creator: follows, messages, and when a trip was saved. A match holds the commission until a person at Santé reviews it. A booking made by the creator themselves, from the same account or email address, earns no commission. That check is automatic.
• Facility badge evidence. When a property uploads a photo or document for a badge, Claude checks whether it shows what was claimed. It can accept or reject the evidence. Anything it is unsure about goes to a person.
• Property standards. We flag properties with repeated problems, such as failed bookings or poor reviews, for a person to review. Only a person can warn or suspend a property. A property is flagged automatically when a required certificate expires.

We do not sell your personal data, and we do not share it with anyone for their own marketing.

7.1 The people you book with

• Properties see the guest name, email address, dates, party size and your messages. They do not see your payment details or IP address.
• Trip operators see each attendee's name and email address, number of places, payments made, amounts and refunds. They can download a list of attendees to run the trip. Operators are independent controllers of this data.
• Clubs see their members' names, handles, photos, roles and join dates, plus RSVPs and club messages.
• When you confirm whether a property had a facility you used, the property sees only an anonymous count. Your answer is never attributed to you.

7.2 Other members and the public

• Your profile is off by default, which means nobody else can find it. You can make it private (only followers you approve) or public.
• Creators' profiles and published content are public once Santé opens creator content to everyone.
• Reviews you write are public.

7.3 Creators and brands

• A creator who referred you sees that a booking was made, its value, and your first name and last initial. They never see your email address.
• Brands see a creator's audience figures as ranges, unless the creator chooses to share exact numbers. Brands also see the creator's rate card and their messages with that creator. A brand can see how many clicks its own links received, and which creator's content they came from. It cannot see who clicked.

7.4 Others

• Stripe runs its own identity checks when hosts, operators, clubs and creators set up payouts. For those checks Stripe is an independent controller, under its own privacy notice.
• HMRC, for sellers (section 8).
• Our service providers (section 11).
• Professional advisers, such as lawyers, accountants and insurers.
• Regulators, the police or courts, where the law requires it or to protect someone's safety.
• A buyer of our business, if Santé is sold or reorganised.

UK law requires us to report what sellers earn through Santé to HMRC. This can cover hosts, trip operators, clubs and creators who earn through Santé. When it applies to you, we will ask you for:

• for a person: your full name, home address, date of birth, tax number (your National Insurance number in the UK) and the country that issued it;
• for a business: its legal name, address, and company or tax number;
• for a property: its address.

We report those details with what you earned through Santé and our fees, each January for the year before. HMRC may share it with the tax authority where you live. We send you a copy of what we report. If you do not give us these details when we ask, we may hold your payouts until you do.

When you open a creator's or club's referral link, we set a cookie that records who sent you. It lasts 30 days, and is signed so it cannot be changed. If you book in that time, the booking is credited to them. If you create an account in that time, they become your referrer.

Once you have an account, your referrer is fixed and stays the same for later bookings. Your referrer earns commission from Santé's share of what you pay. Your price is the same either way.

We also record each click on a referral link, with a scrambled version of your IP address. We use it to count visits and spot fake clicks.

The first time you visit, we ask whether you allow analytics. Choose Allow or Essential only. If you choose Essential only, our analytics tools never start, so nothing is set and nothing is sent. To change your answer while signed out, use the Cookie settings link at the foot of the page. If you are signed in, email a@sante.travel and we will change it.

We do not use advertising cookies or track you across other sites. PostHog data is held in the EU. Session recordings hide all text and images on the page, including anything you type.

Other services on our pages. Maps load from Mapbox, which receives your IP address. Videos play through Mux, which measures playback quality without setting cookies and receives your IP address. Videos from YouTube and Vimeo load only when you press play, and those services' own cookies and privacy notices then apply. At checkout, Stripe sets its own cookies to prevent fraud.

These providers run parts of Santé for us. Each one handles personal data only on our instructions, under a written data processing agreement.

Anthropic. We send data to Anthropic's Claude for four things:

1. checking evidence a property uploads for a facility badge (section 6);
2. writing a listing from a business's own website (section 4);
3. drafting our first email to that business, including the contact's name (section 4);
4. reading a web page a creator adds to a trip, to fill in its title and description.

Anthropic does not use data sent through its API to train its models.

Payment cards. Stripe captures card details directly, and they never reach our servers.

If you sign in with Google, we ask Google only for your account identifier, email address, name and profile photo (the openid, email and profile scopes). We use them only to create your Santé account, sign you in and fill in your profile. We copy your profile photo into our own storage when you first sign in.

We do not access your Gmail, Drive, Calendar, Contacts or any other Google service. We do not sell Google data, use it for advertising or use it to train AI models. We share it only with the providers in section 11, on our instructions. Our use of data from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

You can disconnect Santé at myaccount.google.com/permissions. This stops Google sign-in but does not delete your Santé account (section 14).

Some providers handle data outside the UK. Where they do, we rely on UK adequacy regulations, the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework, with extra safeguards where needed. You can ask a@sante.travel for a copy of the safeguard that applies.

Under UK data protection law you have the right to:

• get a copy of the personal data we hold about you;
• have wrong or incomplete data corrected;
• have your data deleted, except records the law says we must keep;
• limit how we use your data while a complaint is looked at;
• receive your data in a format a computer can read, to take elsewhere;
• object to us using your data on the basis of legitimate interests, and to marketing at any time;
• withdraw consent at any time, without affecting anything we did before;
• ask a person to review an automated check (section 6).

To use any of these rights, email a@sante.travel. We reply within one month. A complicated request can take up to three months, and if so we will tell you why. There is no charge, unless a request is clearly unfounded or excessive.

Deleting your account. Ask from your account page, or email us. A person at Santé then deletes your profile and personal data. We keep only records the law requires, with your name and email removed where possible, and analytics that no longer identify you. If you have a confirmed booking that has not happened yet, we complete or cancel it first and tell you. Your posts are taken down. Messages you sent stay in the other person's inbox, shown as from a deleted account.

Getting a copy of your data. If you run a property, download it from your property settings. Everyone else, email a@sante.travel and we will send it to you.

If you are unhappy with how we have handled your data, tell us first so we can put it right. Email a@sante.travel. We acknowledge every complaint within 30 days, look into it, and tell you the outcome without undue delay.

You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. If you live in the EEA, you can complain to the data protection authority in your country.

We encrypt data in transit and at rest. Database rules control who can read each record. Passwords are hashed, and so are IP addresses in most logs. Staff can reach only what their role needs. Verification documents and certificates are kept in private storage, and admin actions are logged. We scan our code and its dependencies for known weaknesses.

No system is perfectly secure. If a breach is likely to put your rights at risk, we will tell the ICO within 72 hours. If the risk to you is high, we will also tell you directly without undue delay.

Santé is for adults aged 18 and over. We check the date of birth of everyone who creates an account, and bookings must be made by someone aged 18 or over. If you book for a group that includes under-18s, you give their details as their parent or guardian, or with their parent's or guardian's permission. If you think we hold a child's data by mistake, email a@sante.travel and we will delete it.

We will update this notice as Santé changes, and change the date at the top. For a significant change, we will email registered users and show a notice in the app at least 14 days before it takes effect.