Privacy Policy

1. Introduction

Guidecall respects your privacy and is committed to protecting your personal data. This Privacy Policy informs you as to how we look after your personal data when you visit our website, use our application, or utilize our services, and tells you about your privacy rights. We may update this Privacy Policy from time to time; we will notify you of material changes by posting the revised policy on our website and updating the "Last Updated" date above. Your continued use of the platform after the revised policy is posted constitutes your acceptance of the changes. You must be at least 18 years old to create an account or use any of our services. We do not knowingly collect personal data from anyone under 18.

2. The Data We Collect About You

We may collect, use, store, and transfer different kinds of personal data about you, including data you provide directly and data collected automatically (such as IP address, browser type, device identifiers, and access logs):

• Identity Data: First name, last name, username, profile images, and (for Guides, meaning service providers who offer fishing, boating, or outdoor guide services through the platform) legal business name.
• Contact Data: Email address, telephone numbers, and billing or business addresses.
• Financial Data: Securely tokenized payment details handled natively by our PCI-compliant payment processor. Guidecall does not directly store credit card numbers or bank account credentials.
• Transaction Data: Details about payments to and from you, including booking history, refunds, credits, payouts, tips, and disputes. When you authorize a bank payment, we record the time, IP address, and browser details as part of the authorization record.
• Location Data: Geolocation coordinates and reverse-geocoded place labels, used to match Guides with Clients (customers who book guide services), render nearby-results rows, and display meetup locations. You may disable location sharing through your browser or device settings at any time.
• Uploaded Documents & Images: Guides upload credential documents (government photo ID, USCG captain's license, insurance certificate, boat registration, state fishing-guide license, federal permits, vessel photographs, profile images). Customers may upload profile images. Credential documents are visible only to Guidecall admins for compliance review; profile images are public.
• Communications: Messages exchanged with the other party in a booking thread, notes attached to bookings, and your interactions with our customer support.
• Trip Participant Data: When someone books an In-Person Trip for a group, they provide each participant's name and, optionally, an email address (used to deliver that participant's waiver signing link and reminders) and a mobile number. A participant may also add their own mobile number when signing the waiver. We do not text or call participant numbers. Participant email addresses and mobile numbers are used for one further purpose only: so that a person already booked on a Guide's trip is not sent that Guide's promotional offers for the same day. Participants who sign the liability waiver also provide a typed signature, and we record the signing time, IP address, and browser details as part of the signed legal record. Participants do not need a Guidecall account. See Sections 10 and 12 for how this data is retained and deleted.
• Contacts a Guide Uploads: A Guide may invite people they already know as customers to Guidecall, by uploading a name and email address or phone number, or by selecting from their own past Guidecall customers. We use this only to send that person a one-time invitation email, or to let the Guide text them from their own phone. We do not verify, enrich, or otherwise use this contact information for any other purpose, and it is never shared with any Guide other than the one who provided it. See Sections 8, 10, and 12 for how this data is used, retained, and deleted.
• Other Captains a Guide Lists: A Guide may list other captains who run trips for their business, with each captain's name and a copy of their captain's license (including its class and expiry date). These captains do not have Guidecall accounts. We use this information only to check that each captain is licensed for the boats they run; the name and license copy are visible only to that Guide and to Guidecall admins, and are deleted when the Guide deletes their account. See Section 10 for how long it is kept. Once a Guide has had a captain verified, they may also add that captain's name, an optional photo and an optional short bio, which are shown publicly on the trips that captain runs and on the Guide's profile; these are removed when the captain is removed from the Guide's account or the Guide deletes their account.
• Connected Calendar Data: If you are a Guide and you connect an external calendar — your Google Calendar, or a booking platform's calendar export — we read its events to work out when your boat is already committed. Those events may include the names of people who booked with you elsewhere, who are not Guidecall users. We use this only to determine which dates and seats are unavailable. We do not keep the events: after each read we retain only the date, the number of seats held, which of your trips it applies to, and which calendar it came from. Event titles and descriptions, and any customer details within them, are discarded and never written to your Guidecall records. Section 13 describes the Google Calendar connection in full, including the booking events we write to it.
• Notification Preferences: Your per-category email and SMS opt-in selections. When you turn on a marketing-SMS category, we also record a consent receipt: the timestamp, the phone number the consent names, the IP address and browser details at the time, and which version of the disclosure you saw.
• Tier 1 Membership Data: If you apply for the optional Tier 1 membership we collect your answers to five multiple-choice questions about your fishing, the plan you choose, a record of your consent to the terms (the time, your IP address and browser details, the exact wording you saw, and the phone number it covers), the brand, last four digits and a fingerprint of the card you save (the full card number is held only by our payment processor), your charge history, any invitation you gave or used (the member who invited you can see your first name and whether you were approved), and the state your phone number or location puts you in. Our team reviews your answers by hand; they are never shown to anyone else.
• Reviews & Ratings: Star ratings and written reviews you submit after sessions. Reviews are public on the Guide's profile and include your first name and profile image unless you have enabled anonymous mode for that session at booking time.

3. Third-Party Service Providers

We rely on the following categories of third-party processors to operate the platform (current providers are listed for transparency and may be updated from time to time). Each provider receives only the data needed to perform its function and is bound by its own privacy and security obligations.

• Clerk — user authentication, sign-in/sign-up, and session management. Receives your email and any sign-in provider tokens.
• Payment processor — card processing for customer payments. Receives payment-card details (tokenized in the browser; we never see raw card numbers) and transaction metadata.
• Payout & tax processing — to deliver Guide payouts and meet tax-reporting obligations, we and our banking and payment providers collect Guide identity and payout information (legal name, address, taxpayer identification, and bank-account details).
• Twilio — SMS delivery for account alerts, booking updates, trip reminders, and payout notifications. Receives your phone number and the body of each notification we send. We have explicitly pledged to Twilio and the underlying carriers that mobile information will not be shared with third parties for marketing or promotional purposes.
• Telnyx — SMS delivery for deal alerts and other promotional messages you've opted into. Receives your phone number and the body of each message we send, on the same terms as Twilio above.
• Daily.co — video and audio call hosting for Scheduled Calls (pre-booked video consultations) and On-Call sessions (immediate-connect video sessions). Receives a unique room ID per session and produces a cloud recording of the call (see Section 5 below).
• UploadThing — secure file storage for credential documents, profile images, and vessel photos.
• Anthropic (Claude API) — automated reading of credential documents. When a Guide uploads a license, permit, insurance certificate, or photo ID, we use Anthropic's Claude API to read the document and pre-fill its details (credential number, holder name, expiry date) for the Guide to review and confirm. Documents are transmitted for one-time processing only and are not used to train AI models. We do not extract or store government ID numbers from photo IDs. We also use the same service to read events on a Guide's connected calendar, so a booking can be matched to the correct trip and any stated number of guests can be read. The event's title and description are sent for a single read; what we keep is the resulting trip match and seat count, not the text. Content sent to this provider is never used to train AI models, and is retained only as long as needed to return the result — except where flagged by the provider's own safety systems, or where retention is required by law.
• Address search (Google Maps Platform and OpenStreetMap) — as you type an address (a meetup spot, or a business or mailing address), the text you type is sent to Google's Places service to suggest matching addresses and, for the one you pick, to read its parts (street, town, state, ZIP). When Google isn't available we use OpenStreetMap's public search service instead. OpenStreetMap also finds a map point for an address and names a pin dropped on a map, and powers the town search on the homepage. What we keep is the address text you confirmed; we do not store map coordinates received from Google. Google's use of the information is governed by Google's Privacy Policy.
• Vercel — application hosting and edge delivery, and cookieless, aggregate traffic and performance analytics (Vercel Analytics and Speed Insights). These do not use cookies or browser storage and do not track you across sites.
• Supabase / PostgreSQL — primary database hosting.
• Sentry — error monitoring, so we can detect and fix bugs. Receives technical details about the error (what happened, where in the app) and your account ID; we configure it not to record page content or form input.
• Resend — email delivery, including calendar invites carrying trip title, date and customer name.
• Meta (Facebook) — advertising measurement and retargeting via the Meta Pixel. Receives the pages you visit on Guidecall, actions you take on them, and standard browser and device information, tied to Meta's own cookies. Unlike the processors above, Meta also uses this data for its own purposes under its own privacy policy, including matching your visit to your Facebook or Instagram account so that we can measure our advertising and show Guidecall ads to past visitors on Meta's platforms. See Section 7 for details and your opt-out choices.

4. SMS & Mobile Communications

Guidecall utilizes Twilio to transmit critical account alerts, secure messages, booking updates, trip reminders, and payout notifications via SMS, and Telnyx to transmit deal alerts and other promotional messages you've opted into.We do not sell, share, or distribute your mobile number to third parties or affiliates for marketing or promotional purposes.

Mobile information collected internally (your phone number and per-category opt-in selections) is used solely to deliver the platform notifications you explicitly requested via the checkboxes in your Account Settings or the booking-updates checkbox at guest checkout. All SMS data handling complies with CTIA messaging principles and 10DLC carrier requirements. You may opt out at any time by replying STOP to any message we send or by toggling SMS off in your Dashboard Settings.

Deal Alerts (marketing messages). You may opt in to Guidecall Deal Alerts — recurring automated marketing texts and/or emails about discounted fishing-trip openings matching preferences you choose (location, species, timing, minimum discount, and maximum frequency) — on our public signup page at /deal-alerts. Deal-alert signups made on /deal-alerts are verified with a one-time code before any text is sent.

Separately, favoriting a captain or a specific trip enrolls your account in email alerts about that captain’s openings and deals by default; this is a plain opt-out — every email includes a link to turn it off, and you can also turn it off any time in Account Settings. Text alerts for favorites are off by default: they require turning on the “Deals” text notification category in Account Settings, where its own disclosure is shown before your consent is recorded, and go to the phone number on your account. Favoriting a captain without an account, or through a captain’s own invite link, offers the same choice up front — a “Text me” checkbox with the same disclosure shown before your phone number is verified and your consent is recorded. These are the only marketing SMS we send; each requires its own opt-in, and consent is not a condition of any purchase. Marketing texts go only to US mobile numbers, and only during the texting hours permitted by the recipient’s state law. The mobile number and preferences you provide are used solely by Guidecall to send these alerts and are never sold or shared with third parties for their marketing. Reply STOP to any alert to opt out of texts, use the manage link in every message or the Alerts section of Account Settings to change preferences or unsubscribe, and reply HELP for assistance. Message and data rates may apply; message frequency for /deal-alerts signups is limited to the cap you select there.

5. Video Calls & Cloud Recording

Scheduled Calls and On-Call sessions take place inside private 2-participant video rooms hosted by Daily.co. All call sessions are recorded to the cloud. Recordings are retained for dispute resolution, refund review, and platform integrity. Recordings are visible only to Guidecall admins for review purposes and to the call participants themselves on request. By joining a call, both parties consent to being recorded.

6. Public Profile, Listings & Reviews

Certain information you provide is intentionally public so the marketplace can function:

• Guide profiles (business name, captain name, bio, profile picture, target species, fishing techniques, vessel photos and details, pricing, availability, meetup region) are public.
• Trip listings (title, description, price, duration, days of week, season, target species, photos) are public.
• Customer reviews are public on the reviewed Guide's profile. By default a review includes your first name and profile image. You may submit a review anonymously at the time of writing it — anonymous reviews omit your name and image.
• Per-product approval status (whether a Guide is approved for In-Person Trips, Scheduled Calls, or On-Call) determines which sections of a profile are publicly visible.

7. Cookies & Session Tracking

We use session cookies via our authentication provider (Clerk) to keep you signed in, and a signed first-party guest-session cookie to keep a guest checkout or booking-manage session recognized without requiring an account. If you save a favorite without creating an account by verifying a one-time code sent to your email, we set a separate signed first-party cookie (retained 14 days) recognizing your device so your favorites and alert preferences are remembered without asking you to prove your email again. If you use the "use my location" control, we store your chosen location in a short-lived first-party cookie so it persists as you browse. If you arrive via a referral link, we set a first-party cookie (retained 30 days) recording which link you followed, so the resulting booking or signup can be attributed to the right captain. During a pre-launch period we may also set a first-party cookie recognizing an early-access visitor, so the site can be reached before public launch. We use lightweight first-party local-storage and session-storage flags to remember UI preferences (calendar view, recent searches, autoscroll position) and to group your page views together, within a single browser session, for analytics. We also set one first-party analytics cookie (gc_aid, retained for one year) that assigns your browser a random identifier so we can understand how the site is used (pages viewed, searches, bookings started). Data from this first-party analytics cookie is used only by Guidecall for product analytics and is never sold or shared with third parties. Separately, we use one third-party advertising pixel, described below.

Advertising pixel (Meta). We use the Meta Pixel, a cross-site tracking pixel provided by Meta (Facebook), to measure the performance of our advertising and to show Guidecall ads on Facebook and Instagram to people who have visited our site. The pixel sets Meta cookies (such as _fbp) in your browser and sends Meta the pages you view, actions you take on them (for example, viewing a trip or starting a booking), and standard device and browser information; Meta may associate this activity with your Facebook or Instagram account under its own privacy policy. If you sign up for deal alerts, our server also reports that signup to Meta (a "Conversions API" event, a delivery backup for the same signal the pixel sends) along with a hashed version of the contact details you entered (email address or phone number), so the signup can be attributed to the ad that led to it; hashing means Meta can recognize an existing Facebook or Instagram account holder but cannot otherwise read the values, and opting out (below) stops this server-side report along with the rest of the pixel. You can control how Meta uses this data in your Facebook settings (Ad Preferences and Off-Facebook Activity), opt out of interest-based advertising generally at optout.aboutads.info, or block the pixel entirely using your browser's tracking protection or a content blocker — the site works fully without it. You can also turn the pixel off for your browser at any time on our Your Privacy Choices page, and we honor the Global Privacy Control (GPC) browser signal as an automatic opt-out — if your browser sends GPC, the pixel never loads. We do not respond to the older "Do Not Track" browser signal because no uniform industry standard for DNT was adopted.

8. How We Use Your Personal Data

We will only use your personal data when the law allows us to. The legal bases we rely on include: performing our contract with you, pursuing our legitimate business interests (provided your rights do not override those interests), complying with legal obligations, and, where applicable, your consent. Most commonly, we use your personal data to:

• Perform the contract connecting Guides and Clients (matching, booking, communication).
• Process customer payments and deliver Guide payouts.
• Send transactional notifications (email and SMS based on your opt-in preferences).
• Verify Guide credentials and maintain compliance with marine, fishing, and federal licensing requirements.
• Investigate and resolve refund disputes, payout reversals, and customer-safety reports.
• Manage our relationship with you and provide customer support.
• Keep availability accurate and prevent double-bookings, including by reading a Guide's connected calendars to identify dates and seats already sold elsewhere.
• Detect, prevent, and address fraud, abuse, and security incidents.
• Send a one-time invitation, on a Guide's behalf, to a contact that Guide has told us they already have a customer relationship with.
• Avoid sending a Guide's promotional offers for a trip day to people already booked with that Guide on that day.
• Review Tier 1 applications, charge and renew Tier 1 memberships, honor invitations, and prevent duplicate memberships and fraud.

9. Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorized way. However, no method of transmission over the Internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. We limit access to your personal data to those employees, agents, contractors, and processors who have a strict business need to know. Credential documents are stored in segregated, access-controlled buckets and are visible only to Guidecall admins. When automated reading is used — for credential documents or for a Guide's connected calendar — the content is transmitted securely to our AI processor for a single read. It is never used for model training, and is not retained beyond returning the result except where the provider's safety systems flag it or the law requires it.

10. Data Retention

We retain personal data only as long as necessary to provide the service and to satisfy our legal, tax, accounting, and dispute-resolution obligations. Specifically:

• Account data is retained for the lifetime of your account. Upon account deletion (see Section 12), we anonymize your name, email, and phone within thirty (30) days — except the phone number and email address preserved in the marketing-SMS consent/opt-out log described below, which follow that log's own seven-year retention period as our suppression-list and compliance record.
• Transaction and payout records are retained for at least seven (7) years to comply with IRS retention rules, the card networks' and our payment processor's dispute and chargeback windows, and applicable state tax law. Personally identifying fields on those records are anonymized following account deletion; the underlying financial record remains.
• Call recordings are retained for approximately one hundred twenty (120) days after the session ends, longer if a refund ticket or dispute is opened.
• Credential documents are retained for as long as the Guide's account is active. Expired credentials are retained for an additional one (1) year after expiry for audit purposes.
• Marketing SMS consent / opt-out logs — the record of when you granted or revoked consent to receive marketing text messages (Deal Alerts and favorites-lane texts), including the phone number and email address on file at that time — are retained for at least seven (7) years following the user's last account activity, or longer where required for carrier-compliance and audit purposes. This log is separate from, and does not extend the retention of, transactional/account SMS records.
• Trip participant records: if a listed participant never signs the waiver, their information is automatically deleted ninety (90) days after the trip ends. Signed waivers are legal records and are retained for as long as a claim relating to the trip could be brought (including extended periods where a participant was a minor); a signed participant's contact details (email/phone) can be removed on request while the signed waiver itself is preserved.
• Availability Records: the date and seat-count records created from a connected calendar are kept while the trip date is upcoming and deleted approximately 30 days afterwards. Disconnecting a calendar deletes them immediately.
• Calendar Reading Cache: the stored result of reading a calendar event — which trip it matched and how many seats — is kept for up to 200 days so the same event is not re-read repeatedly. It contains no event text.
• Bank-payment authorization records are retained for at least two (2) years after the payment, as required by NACHA operating rules.
• Tier 1 membership records: your five application answers are deleted ninety (90) days after we decide on your application. Our internal review note and your card's fingerprint are deleted one (1) year after your membership or application ends; the fingerprint exists so a person who was removed after a payment dispute cannot simply re-apply. The record of your consent is kept for at least three (3) years so we can show what you agreed to, and charge records follow the seven-year transaction rule above.
• Referral-link record: if you save a Guide’s profile through their own invite link, we keep a record of that association so the reduced pricing it unlocks keeps applying to your future bookings with that Guide. This record is kept for as long as your account exists.
• Other captains a Guide lists: each captain's name and license copy are kept while the Guide's account exists, including after the Guide removes that captain, as a record of who was licensed to run the Guide's trips. Both are deleted when the Guide deletes their account.
• Contacts a Guide uploads: if you never respond to a Guide's invitation, your contact information is deleted one hundred eighty (180) days after it was uploaded. If you do save the Guide's page, that information becomes account data (see above) rather than invite data. If you unsubscribe, or your invitation bounces or is otherwise undeliverable, we keep your email address on a suppression list indefinitely, so you are not invited again — no other information about you is kept alongside it.

11. Your Rights

Depending on your jurisdiction, you may have the following rights. We may need to verify your identity before fulfilling any request to protect the security of your personal data:

• Right of Access — request a copy of the personal data we hold about you. We will respond to verified requests within forty-five (45) days.
• Right of Correction — ask us to correct inaccurate or incomplete data. You can update most fields yourself from Account Settings.
• Right of Deletion — request deletion of your personal data (subject to legal retention obligations described in Section 10). Logged-in users can self-initiate from Account Settings; guests can use guidecall.app/privacy/delete. Where full deletion is not possible due to legal or compliance requirements, we will anonymize the relevant data.
• Right to Withdraw Consent — for SMS, reply STOP or untoggle SMS categories in Account Settings. For email, use the unsubscribe link or toggle email categories in Account Settings.
• Right to Opt Out of Sale or Sharing — some US state privacy laws treat data sent to an advertising partner for cross-context advertising, such as the Meta Pixel described in Section 7, as a "sale" or "sharing" of personal information. We do not sell personal information for money. To opt out, use our Your Privacy Choices page (also linked in the footer of every page), enable the Global Privacy Control signal in your browser, or email privacy@guidecall.app and we will honor the request.
• Right to Lodge a Complaint — you may complain to your local data-protection authority.

12. Account Deletion

Logged-in users may request deletion from Account Settings. Guests and former users may use guidecall.app/privacy/delete. We will anonymize your name, email, and phone within thirty (30) days of confirmation, except that the phone number and email address preserved in the marketing-SMS consent/opt-out log (Section 10) are retained for that log's own seven-year period as our suppression-list and compliance record. Past booking, payment, and refund records remain in our systems in anonymized form to satisfy our obligations under federal, state, tax, and payment-network rules (including IRS retention and payment-network dispute-history requirements).

Trip participants without an account: if you were listed as a participant on someone else's booking and never created a Guidecall account, you can still exercise your privacy rights — email privacy@guidecall.app or use guidecall.app/privacy/request. If you never signed a waiver, your information is deleted automatically ninety (90) days after the trip (or sooner on request). If you signed a waiver, we can remove your contact details on request, but the signed waiver itself is a legal record we must retain as described in Section 10.

Contacts a Guide invited, without an account: if a Guide uploaded your name and email address or phone number to invite you to Guidecall, and you never created an account, you can still exercise your privacy rights — email privacy@guidecall.app or use guidecall.app/privacy/request to have your contact information deleted immediately (rather than waiting for the 180-day automatic deletion described in Section 10) and to stop being invited again.

15. Children's Privacy

Guidecall is intended for users 18 years of age or older. We do not knowingly collect personal data from anyone under 18, and our services are not directed to children under 13 within the meaning of the Children's Online Privacy Protection Act (COPPA). If you believe a minor has provided us with personal information, please contact us at the email below and we will promptly delete it.

16. Contact Us

For privacy questions, data-access requests, or to report a concern, contact us at privacy@guidecall.app or submit a request at guidecall.app/privacy/request.