Privacy Policy

Palmilla is a booking platform for surf lessons and surf photography in Baja California Sur, operated by Palmilla Software, Inc., a United States company (“Palmilla”, “we”, “us”). This policy covers palmilla.co and the messages we send in connection with it.

Questions about this policy or your data: email hello@palmilla.co.

We collect what you give us and what running a booking service requires:

• Account details — your name, email address, and, if you add one, your phone number and profile photo.
• Booking details — the sessions you book, when they happen, who the instructor is, and messages you exchange with instructors through the app.
• Payment details — handled by Stripe, our payment processor. Card numbers never touch our servers.
• Messaging preferences — whether you opted in to booking updates by WhatsApp or text message, and any opt-out you send.
• Instructor business details — for instructors, the profile, availability, and payout information needed to run their page and pay them.
• Technical basics — logs and analytics about how the site is used, to keep it working and improve it.

To run the service: process bookings and payments, send booking confirmations, session reminders, and review requests, connect you with your instructor, and provide support.

To operate responsibly: prevent fraud and abuse, comply with legal obligations, and understand how the product is used so we can improve it.

We send marketing messages only where you have separately agreed to receive them, and every one includes a way to stop.

If you opt in, we send booking updates to your phone number by WhatsApp or SMS: booking confirmations, session reminders, and review requests. Consent is never required to book, and you can withdraw it at any time by replying STOP (or BAJA) to any message, or by turning the toggle off in your profile.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third parties, except for the messaging providers that deliver the messages on our behalf.

We do not sell your personal information. We share it only with the service providers who make the product work, and only what each needs:

• Stripe — payment processing and instructor payouts.
• Messaging and email providers (Meta WhatsApp, Twilio, Resend) — to deliver the messages described above.
• Hosting and infrastructure providers (Vercel, Neon) — to run the site and store its data.
• AI providers (OpenAI and Anthropic, reached through Vercel's AI Gateway or OpenAI's own API, and ElevenLabs for spoken audio) — to power the assistant, translations, drafts and audio described under “Artificial intelligence” below. They receive only the text needed for the task at hand, never your Google Calendar data, and their terms do not allow them to train on what we send.
• Google — only if you connect your Google Calendar, and only in the direction described in the next section. We send nothing to Google.
• Your instructor — sees your name, and after you book, the contact details needed to coordinate your session.

We may also disclose information if the law requires it, or as part of a business transaction such as a merger, in which case this policy continues to apply.

A guide or host can connect their Google Calendar so that the times they are already busy are blocked on Palmilla and shown on their Palmilla calendar. This is optional, and nothing on Palmilla needs it.

If you connect it, we ask Google for read-only access to your list of calendars and to the events on them. Here is exactly what we do with that:

• We read the start time, end time and title of each event. The title is kept so you can recognize what is blocking a time on your Palmilla calendar.
• We store those events and the Google account's email address on our servers, and refresh them from Google in the background so your calendar stays current.
• Busy times block guests from booking those slots. Guests never see your event titles, your calendars, or your Google account.
• We never create, change or delete anything in your Google Calendar, never read your contacts or email, and never share your calendar data with anyone.
• We never send your calendar data to any AI model or AI provider, and never use it to build, train or improve one. See “Artificial intelligence” below.

Disconnecting Google Calendar in your settings deletes every event, calendar and token we hold for it, and we ask Google to revoke our access. You can also remove Palmilla at any time from your Google account's permissions page.

Palmilla's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

The same care applies to everything we hold, and especially to the sensitive data described above: your messages, your payout details and anything we receive from Google Calendar.

• In transit — every connection between your device and Palmilla, and between Palmilla and the services it uses, is encrypted with HTTPS (TLS).
• At rest — our database provider (Neon) encrypts stored data at rest. Google Calendar access and refresh tokens are encrypted a second time by Palmilla itself (AES-256-GCM) before they are stored, with the key held in our hosting environment and never in the database. They are decrypted only on our servers, only at the moment we talk to Google.
• Access — your calendar data is shown only inside your own signed-in Palmilla account. Guests, other providers and our public pages never see it. Palmilla staff access production data only to run the service or to carry out a request you make.
• Minimum data — we ask Google only for the two read-only permissions the feature needs, and we read only a rolling window of events, from yesterday to four months ahead. Each refresh replaces what we held before, so older events are not kept.
• Deletion — disconnecting Google Calendar, or deleting your Palmilla account, deletes the stored events, calendars and tokens right away, and we ask Google to revoke our access. Other personal data is deleted on request as described under “Your choices and rights”.
• If a security incident ever affects your personal data, we will tell you and any authorities the law requires without undue delay.

Parts of Palmilla use AI models: the assistant that helps a provider run their business, the translation of messages and listings between English and Spanish, drafts of posts and listings, and spoken audio. We use models from OpenAI and Anthropic, reached through Vercel's AI Gateway or OpenAI's own API, and ElevenLabs for speech.

These providers receive only the text needed for the task you are doing, under business API terms that do not allow them to use it to train their models. Vercel's AI Gateway deletes prompts and responses once a request completes.

Google user data is kept out of this entirely. Nothing we receive from Google Calendar — events, calendar names, or the connected account's email address — is ever sent to an AI model or AI provider, and we never use Google user data to build, train or improve any machine-learning or AI model, ours or anyone else's.

We keep your information while your account is active and as long as needed for the purposes above — bookings and payment records are kept for the periods bookkeeping and tax rules require. Opt-out records are kept so we keep honoring them.

• Stop messages — reply STOP (or BAJA) to any message, or use the toggle in your profile.
• Unsubscribe from marketing email — every marketing email includes an unsubscribe link.
• Access, correct, or delete your data — email hello@palmilla.co and we will handle it. Depending on where you live, you may have additional rights under laws such as the California Consumer Privacy Act; we honor requests regardless of where you are.

Palmilla is not directed at children under 13, and we do not knowingly collect their personal information. Bookings for minors are made and managed by a parent or guardian.

If we change this policy in a meaningful way, we will update the effective date above and, for significant changes, tell you directly. The current version always lives at palmilla.co/privacy.