Privacy Policy
Draft for legal review — not approved for public launch.
Prepared: 1 October 2026
This policy explains what happens to the information you share with Onyx & Oyster. We have written it in plain language rather than legal boilerplate, because a policy you cannot read protects nobody.
Who we are
Onyx & Oyster is an early-stage Hudson Valley travel platform. During this pre-partner phase, the website collects travel-planning interest and applications from hotels and local businesses. It does not currently publish a bookable collection of stays, experiences, or confirmed partners.
You can reach us at any time at hello@onyxandoyster.com.
Information you give us
Nearly everything we hold about you is something you choose to send through a form on this website. Depending on which form you use, that may include:
- your name;
- your email address;
- your phone number, where a form asks for it;
- travel-planning details such as a town of interest, timing, party size, occasion, and what you hope to find;
- information about your business, if you are enquiring about becoming a hotel partner or a local partner;
- anything else you choose to write to us in a free-text field or by email.
Please only tell us what is useful for planning or for your application. There is no need to send sensitive personal information, and we ask that you do not.
Information collected automatically
Analytics is off unless you choose “Accept analytics.” If you allow it, we use Google Tag Manager to load the analytics tools configured for this website. Those tools may collect technical and usage information such as pages viewed, device and browser information, approximate location, referring or campaign information, and interactions with the site. We do not intentionally send names, contact details, free-text form responses or other form content to analytics.
If a Partner Portal is made available in the future, its privacy practices will be reviewed and described before partner accounts are invited.
Why we use it
- To answer you. If you share travel plans, join the list, or write to us, we use your details to reply and understand what the first collection should become.
- To review applications. If you apply as a hotel or local business, we use the information you provide to consider whether to continue the conversation.
- To keep the service secure. We use rate limiting and bot protection to prevent abuse of our forms and sign-in pages.
- To improve what we offer. Aggregate analytics help us understand which experiences and pages people find valuable.
- To stay in touch, if you asked us to. If you joined our list, we will write occasionally. Every message includes a way to stop receiving them.
Sharing with prospective partners
We do not currently operate a public collection of confirmed hotel or local-business partners. Sharing travel plans does not place you in contact with a prospective partner, and we do not pass those details to one merely because you submitted the form.
If that changes in the future, we will update this policy and give you a clear notice before sharing information with a verified partner.
Service providers
We use service providers to host the website, store form submissions, send email, and protect the site against automated abuse. The final policy will name the providers in use and describe the role each one plays before publication.
Those providers process information on our behalf under their applicable agreements. The final policy must be checked against the actual deployed services before it is approved.
What we do not do
- We do not sell your personal information.
- We do not trade or rent your contact details to advertisers or data brokers.
- We do not add you to a mailing list because you requested an experience. Joining the list is a separate, deliberate choice.
How long we keep it
We keep travel-planning signals, list subscriptions, and applications for as long as reasonably needed to respond and keep appropriate business records. The final policy must state approved retention periods before publication.
If you would like your information removed sooner, write to us. We will respond in line with the final approved policy and any legal obligations that apply.
Your choices
You can allow or reject optional analytics at any time using . If you turn analytics off after allowing it, we stop sending new analytics events and reload the page so third-party analytics code is no longer active.
Write to hello@onyxandoyster.com and we will help you:
- see what information we hold about you;
- correct anything that is wrong;
- ask us to delete it, where we are not required to keep it;
- stop receiving our letters.
Depending on where you live, you may have additional legal rights over your personal information. We will do our best to honour any such request, and we will tell you if there is something we cannot do and why.
Cookies and similar technologies
We store your analytics preference locally as a necessary preference. If you allow analytics, providers configured through Google Tag Manager may use cookies or similar technologies. The final policy must identify those providers and technologies before publication.
Security
We take reasonable technical and organisational measures to protect submitted information, including access controls, protections against automated abuse, and monitoring for failures. No website or service can promise perfect security, and we will not pretend otherwise.
Children
This website is intended for adults. We do not knowingly collect personal information from children. If you believe a child has sent us information, please contact us and we will remove it.
Changes to this policy
As Onyx & Oyster grows — particularly once payments and additional destinations are live — this policy will change. When it does, we will update the date at the top of this page. Material changes will be described rather than quietly folded in.
Contact
Questions about this policy, or about any information we hold, can go to hello@onyxandoyster.com.
Before this policy is published
This draft requires professional legal review. That review must confirm the data controller details, service-provider list, retention periods, analytics and cookie disclosures, applicable privacy rights, and alignment with any future partner agreements.