Early access · Policies
Privacy Notice
Data controller
The data controller for LEAKLOCK Travel is MARCO BARRICIELLO, trading as LEAKLOCK Travel, based in Australia.
What we collect and why
With your explicit consent, we store your waitlist email, consent version, signup date, placement of the signup form, and restricted campaign labels and referring domain to manage early access and understand signups. We record anonymous usage events, a random tab-session identifier, page path, device category, event time, referring domain and restricted campaign labels to measure use and improve the service, relying on legitimate interests. We do not record your itinerary, destination, place names, email or IP address in usage events. Hosting may process IP addresses and technical logs for delivery and security under legitimate interests and legal obligations.
Drafts and itinerary storage
Saved drafts use localStorage on your device. Trip Pass destination, places, itinerary, transaction reference and hashed recovery secret are stored privately to deliver and edit that trip. Card details and checkout email remain with Paddle, not in our order records. Anyone holding the private recovery link can access the trip. Paid itinerary records are kept so the purchased itinerary stays accessible; test-mode records from the private preview are deleted after 30 days. Downloads remain local files. Separate Google Maps links open only when clicked; that service’s privacy terms apply.
Sharing and processors
Hosting and infrastructure providers process data to run the site. Paddle will process data for sales, subscription management if introduced, payments, tax compliance and invoicing when paid orders open. No welcome-email provider or lead webhook is active in this phase. If an email provider or owner-configured lead destination is enabled later, this notice will be updated before that processing starts. Professional advisers may receive data where necessary; authorities receive data when required by law. We do not sell personal data.
Retention
We keep waitlist data until consent is withdrawn or 12 months after signup, whichever comes first. Anonymous event records are retained for up to 90 days. We delete or anonymize data when no longer needed, except records legally required to be kept. Local drafts remain until you clear them or your browser storage. Retention periods are intended policies; operational deletion must be maintained by the seller.
Your rights
Depending on applicable law, you may request access, correction, deletion, restriction, portability or object to processing. You may withdraw consent at any time without affecting earlier lawful processing. Where GDPR applies, we respond within one month and you may complain to your supervisory authority.
Security and international transfers
We use appropriate technical and organizational safeguards, including encryption in transit and access controls. No system is entirely risk-free. Providers may process data internationally; where required we use adequacy decisions, standard contractual clauses or other lawful safeguards.
Cookies and browser storage
We do not set analytics or marketing cookies, and use no third-party analytics. Essential hosting cookies may be used by the platform. A random anonymous identifier is kept in sessionStorage for the current tab session; localStorage is used only when you save a trip draft; sessionStorage also keeps the private order access secret for recovery in the current tab. You can clear these through browser settings. No persistent cross-site tracking identifier is used.
LEAKLOCK Travel · Australia