Privacy Policy

Tourists: Name, email address, phone/WhatsApp number, nationality, and payment information necessary to complete a booking. Dietary requirements, medical notes, and special occasion details you choose to provide.

Operators: Business name, TTB licence number, TATO membership, bank account details for Flutterwave payouts, business address, and contact information.

All users: Account login data, session identifiers, and usage data (pages visited, actions taken) collected automatically when you use the platform.

To process and confirm bookings, communicate tour details with your operator, send pre-departure information and post-tour review requests, and issue refunds.

To verify operator TTB licensing, manage operator payouts via Flutterwave, and maintain the Platform Guarantee Fund records.

To improve the platform through aggregated, anonymised usage analytics.

When you submit a refund request or raise a dispute, we collect and store:

• Your written statement describing the issue
• Any evidence you upload (photos, videos, screenshots, communications)
• The operator's written response and any evidence they submit
• Internal notes made by the LifeGranted Adventures review team
• The final decision and its rationale
• All communications exchanged during the dispute process

This data is used solely for resolving the dispute, maintaining an accurate record for both parties, and defending against fraudulent chargeback claims where a fair process has already been completed. Dispute records may be disclosed to financial institutions (e.g. Flutterwave, issuing banks) when defending against chargebacks.

When you complete the booking checkout, we record:

• A timestamp of when you confirmed the cancellation policy
• Your IP address at the time of acknowledgment
• Your browser user agent string
• The exact version of the policy you acknowledged (identified by SHA-256 hash)
• The acknowledgment method (explicit checkbox confirmation)

Purpose: This data constitutes legally admissible evidence that you read and accepted the cancellation policy before completing your booking. It is used solely to defend against chargebacks and disputes where the cardholder claims they were unaware of the policy. We do not use this data for any other purpose, including marketing.

Legal basis: Legitimate interests — protecting the platform and its operators from fraudulent chargeback claims by documenting genuine, informed consent.

We share your data only with:

• The relevant tour operator — booking details necessary to deliver your tour
• Flutterwave — payment processing and operator payouts
• Resend — transactional email delivery (confirmation, pre-departure, dispute notifications)
• Supabase — secure database hosting (data processed within secure cloud infrastructure)
• Issuing banks / card networks — where required to defend a chargeback dispute

We do not sell, rent, or share your data with advertisers or third parties for marketing purposes.

We retain data for the following periods:

• Booking records: 7 years from booking date (legal and tax compliance)
• Dispute and refund records: 7 years from dispute resolution date (legal compliance and potential chargeback periods)
• Policy acknowledgment records: 7 years from booking date (chargeback defence evidence)
• Recovery notices: 7 years from resolution date
• Account data: For the duration of your account, plus 2 years after account deletion
• Marketing communications opt-in: Until you withdraw consent

The 7-year retention period for dispute and acknowledgment records reflects the standard limitation period for civil claims in Tanzania and the maximum chargeback lookback period of card networks.

Tour operators have the right to access records related to their own bookings and disputes through the operator portal at /portal/disputes and /portal/recovery. This includes:

• The tourist's dispute statement and evidence submitted
• The platform's decision and rationale
• All recovery notice details and amounts
• Their own response and evidence as submitted

Operators may not access tourist personal data (email, phone, payment details) beyond what is necessary to deliver the booked tour, and may not use dispute data outside the context of the platform's formal process.

You have the right to:

• Access a copy of the personal data we hold about you
• Correct inaccurate data
• Delete your account and personal data (subject to legal retention obligations)
• Object to processing based on legitimate interests
• Portability — receive your data in a machine-readable format

To exercise any of these rights, contact us at privacy@lifegranted-adventures.co.tz. We will respond within 30 days.

Note: Where data must be retained for legal or dispute-resolution purposes (e.g. chargeback defence), deletion requests may be partially fulfilled — we will delete all data not required for legal compliance and inform you of what we must retain and why.

We use essential cookies to maintain your session and booking state. We do not use tracking or advertising cookies. Analytics are collected in aggregated, anonymised form and cannot be used to identify individuals.

All data is stored in encrypted databases hosted by Supabase. Access is restricted by row-level security — each user can access only their own records. Administrative access is protected by separate authentication. Policy acknowledgment and dispute records are treated as immutable legal evidence and cannot be altered after creation.

We may update this policy from time to time. Where changes are material, we will notify you by email and display a prominent notice on the platform. Continued use of the platform after changes take effect constitutes acceptance of the updated policy.