Privacy policy

v0.9 · updated 2026-07-26

Vastura Travel — Privacy Policy

Last updated: 2026-07-26 Version 0.9

1. Who this policy covers

This policy explains how Vastura Travel, a DBA of Vastura Ltd (based in Alberta, Canada), collects, uses, and stores personal information from travellers and Providers who use the site. Vastura Ltd is the data controller.

Registered address: Vastura Ltd, 62431 Range Rd 443, Ardmore, Alberta T0A 1H0, Canada

2. What we collect

From Providers (applicants and listed operators):

business name, contact name, email, phone, and address
application details (services offered per service line, pricing, licences/permits claimed, photos, video links)
payment/billing details for subscriptions (processed by our payment provider — we do not store full card numbers ourselves)
acceptance record for our Provider Agreement: agreement version, acceptance timestamp, name, email, a hash of your IP address, and a content hash of the exact agreement text shown to you at the time (see Provider Agreement, Section 2)
assessment records, including notes and scores from announced quality-check visits and anonymous service audits, per service line

From travellers:

feedback and reviews submitted about listed operators (name/contact info if provided, and the content of the feedback)
review verification documents, submitted to prove a reviewer actually visited the operator being reviewed — see Section 5 for what we accept, how it's checked, and when it's deleted
basic contact details if you reach out to us directly

From all visitors:

basic analytics data (pages viewed, general location at country/region level, device/browser type, referral source)
a hashed version of IP address, used for review-verification anti-fraud checks (Section 5) — we do not store raw IP addresses for this purpose

We do not require travellers to create an account or pay us anything, so we collect meaningfully less data from travellers than from Providers.

3. Why we collect it

We use this information to:

operate and display Provider listings, including per-service-line assessment stages and scores
process and bill subscriptions
record Provider Agreement acceptance as a condition of starting a subscription
assess Provider applications and conduct ongoing quality checks and audits
verify that traveller reviews are genuine before publishing them
record and act on traveller feedback, which feeds directly into listing status decisions (see our Dispute Resolution Policy)
understand site usage in aggregate to improve Vastura Travel
respond to enquiries

4. Where it's stored

Vastura Travel's data is stored using Cloudflare's infrastructure — primarily Cloudflare D1 (database) and Cloudflare R2 (file/object storage), which operate across Cloudflare's global edge network. Data may therefore be processed or cached in Canada and in other countries where Cloudflare operates infrastructure.

5. Review verification — what we collect, check, and delete

Before a traveller review is published, we verify that the reviewer actually visited the operator. This section explains exactly what that involves.

What we accept as proof, in order of strength:

a booking confirmation or receipt (strong)
confirmation from the operator that the visit happened (strong)
a dated photo whose EXIF data matches the claimed visit (moderate)

A confirmed email address is never sufficient on its own. Confirming an email only proves someone controls that inbox — it doesn't prove they were ever at the operator's premises.

Automated checks we run on every submission, to flag suspicious reviews for manual attention:

the submitter's IP matches the operator's own known IP
multiple reviews originate from the same IP address or device
an unusual burst of positive reviews in a short window
the claimed visit date is before the operator joined Vastura Travel
review text is a near-duplicate of another review
the submission uses a disposable/temporary email address

What happens to the proof document itself: we collect it, check it against the criteria above, and then delete it once verification is complete. We do not retain booking confirmations, receipts, or photos submitted for verification purposes after that check is done. The outcome of the check (verified / not verified) is retained against the review; the underlying document is not.

IP addresses used for the fraud checks above are stored only as a hash, not in raw form — we can compare hashes to detect a match without retaining the actual address.

Rules that apply regardless of verification outcome: an operator cannot review its own listing, cannot edit a traveller's review, and cannot pay to have a review removed. Retaliation by an operator against a reviewer is grounds for removal from Vastura Travel under our Provider Agreement and Dispute Resolution Policy.

6. How long we keep it

Provider application, listing, and per-service-line assessment data is kept for as long as the listing is active, and for a reasonable period after termination for record-keeping and dispute-history purposes. Assessment scorecards specifically are retained after a listing is archived — see our Terms of Service and Provider Agreement on cancellation.
Provider Agreement acceptance records (Section 2) are retained for as long as the agreement (in the version accepted) could be relevant to a dispute.
Review verification proof documents are deleted after the check is complete (Section 5); the verification outcome is retained with the review.
Traveller feedback is kept indefinitely as part of an operator's history, since past feedback informs ongoing listing decisions — but personal contact details attached to feedback can be deleted on request (see Section 11), while the substance of the feedback may be retained in de-identified form.
Basic analytics data is retained in aggregate and is not tied to an identifiable person for longer than necessary.

7. We do not sell personal data

Vastura Travel does not sell your personal data to third parties. We do not share Provider or traveller personal data with advertisers or data brokers.

8. Cookies and analytics

Vastura Travel uses cookies and similar technologies for basic site functionality and analytics.

9. Third-party embeds

Listings may include embedded video from third-party platforms such as YouTube or Vimeo (Vastura Travel hosts no video itself — see our Provider Agreement, Section 11). Where technically possible, we configure these embeds in privacy-enhanced / "nocookie" mode to limit tracking by the embedded platform before you interact with the video. Once you play an embedded video, the third-party platform's own privacy policy and cookie practices apply to that interaction, not ours.

10. Which privacy laws apply

Vastura Travel is operated by Vastura Ltd from Alberta, Canada, and our handling of personal information is governed in the first instance by Canadian privacy legislation — the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta's Personal Information Protection Act (PIPA).

Providers and travellers use Vastura Travel from many countries. Where the privacy law of another jurisdiction applies to personal information we hold about you, we will meet the obligations that law places on us in respect of that information. If you want to know how a particular regime applies to your data, or you wish to raise a concern about how we handle it, contact travel@vastura.ca.

11. Your rights

Subject to applicable law, you may have the right to:

access the personal data we hold about you
correct inaccurate data
delete your data, subject to legitimate retention needs (e.g., dispute history, legal obligations, assessment scorecard retention as described in our Terms of Service and Provider Agreement)

To exercise any of these rights, contact travel@vastura.ca.

12. International data transfers

Because we use globally distributed infrastructure (Section 4), your data may be transferred to and processed in countries other than the one you live in, including Canada and other jurisdictions where Cloudflare operates.

13. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top will change when we do.

14. Contact

Questions about this policy, or requests relating to your personal data, can be sent to travel@vastura.ca.

Terms confirmed in this document

Vastura Ltd, 62431 Range Rd 443, Ardmore, Alberta T0A 1H0, Canada — registered business address (Section 1)
travel@vastura.ca — dedicated privacy contact (Sections 11, 14)
Analytics provider name(s) — to be specified (Section 8)
Exact data retention periods — to be finalized (Section 6)
Applicability of GDPR, PIPEDA/PIPA, and provider-country privacy laws — open legal question (Section 10)