1. Who We Are & Scope of Policy

Welcome to Tripxaro (“we,” “us,” “our,” or “the Blog”), an independent digital publication dedicated to slow luxury travel, cultural exploration, and mindful wandering, founded and authored by Stephanie. This Privacy Policy governs your access to and interaction with our website located at https://tripxaro.com (including all subdomains, RSS feeds, content widgets, and related digital communications collectively referred to as the “Service”).

For the purposes of the General Data Protection Regulation (EU Regulation 2016/679, “GDPR”), the UK Data Protection Act 2018 (“UK GDPR”), and the Swiss Federal Act on Data Protection (“FADP”), the Data Controller responsible for the processing of your personal information collected through this website is Stephanie / Tripxaro Editorial Office. If you have questions regarding our data practices, you may reach our privacy representative directly at privacy@tripxaro.com.

By browsing our website, leaving comments, subscribing to our email newsletters, or interacting with our travel guides, you acknowledge that you have read, understood, and agreed to the collection and handling of your data as described in this Privacy Policy.

2. Information We Collect

We believe in the principle of data minimization: we only collect personal information that is reasonably necessary to fulfill specific editorial, operational, or legal purposes. We categorize the data we collect into three groups:

A. Information You Voluntarily Provide to Us

• Newsletter Subscriptions: When you subscribe to Stephanie’s “Inner Circle” travel dispatches or download exclusive itineraries, we collect your email address, first name (optional), and the date and time of sign-up. We use double opt-in verification to confirm your explicit intent.
• Contact Form Inquiries: When you reach out via our contact page, we collect your full name, email address, message subject, and the detailed contents of your inquiry.
• Article Comments: When you post a comment on a travel guide, we collect your display name, email address, website URL (optional), comment text, and your device’s IP address and browser user-agent string to help combat automated comment spam.
• Survey & Giveaway Entries: If you participate in reader surveys or travel contests, we may collect demographic feedback, travel preferences, and delivery details for physical prizes.

B. Information Collected Automatically

As you navigate through Tripxaro, our servers and third-party analytics utilities automatically record routine technical details transmitted by your browser:

• Log Data: Internet Protocol (IP) address (anonymized prior to statistical storage), browser type, browser version, operating system, language preferences, referring/exit URLs, and Internet Service Provider (ISP).
• Usage Metrics: Pages visited, duration of visit, scroll depth, interaction with photo carousels, click paths, and timestamped entry points.
• Device Characteristics: Screen resolution, device family (mobile, tablet, desktop), and touch-screen capability.

C. Information We Do NOT Collect

We do not collect any Special Categories of Personal Data under GDPR Article 9 (such as biometric information, genetic data, racial or ethnic origin, religious beliefs, political opinions, trade union membership, or sexual orientation). Furthermore, because Tripxaro does not directly process payments on-site, we never collect, store, or transmit your credit card numbers or financial account credentials.

3. Cookies & Tracking Technologies

Cookies are small text files placed on your computer or mobile device when you load websites. They are widely used to make web applications function efficiently, remember user preferences, and provide statistical insights to publishers.

Categories of Cookies Employed on Tripxaro:

• Strictly Necessary Cookies: These cookies are vital for the technical operation of our website, enabling secure core features such as load balancing, Cloudflare security challenges, and page navigation. These cannot be disabled through our consent banner.
• Performance & Analytics Cookies: We utilize Google Analytics 4 with IP anonymization enabled. These cookies collect aggregated, pseudonymous statistics regarding visitor numbers, bounce rates, and traffic sources, allowing us to understand which travel guides are most helpful to our community.
• Functional Cookies: These cookies remember your preferences, such as whether you have already dismissed a notification modal, accepted our cookie preferences, or selected a preferred viewing mode.
• Affiliate Tracking Cookies: When you click on an external recommendation link for a boutique hotel, flight engine, or guided tour operator (e.g., Booking.com, GetYourGuide, Viator), a secure affiliate cookie is deposited on your browser by the destination platform. These cookies verify that you arrived via a recommendation from Tripxaro so that the merchant may credit us a modest referral commission. These cookies contain no personally identifiable information (PII).

4. Legal Bases for Processing (GDPR)

If you are an individual located within the European Economic Area (EEA), the United Kingdom, or Switzerland, our processing of your personal data is conducted strictly under lawful grounds designated by Article 6 of the GDPR:

1. Consent (Art. 6(1)(a)): Where you have granted clear, affirmative, unambiguous consent for us to process your data for a specific purpose (such as subscribing to our newsletter or consenting to analytics cookies). You may withdraw this consent at any time.
2. Legitimate Interests (Art. 6(1)(f)): Where processing is necessary for our legitimate editorial and business interests, provided those interests do not override your fundamental rights. This includes defending our site against distributed denial-of-service (DDoS) attacks, eliminating comment spam, monitoring performance, and earning commercial affiliate revenue.
3. Contractual Performance (Art. 6(1)(b)): Where processing is necessary to fulfill an agreement or respond to a direct pre-contractual inquiry initiated by you (e.g., responding to a bespoke sponsorship or editorial request).
4. Legal Obligation (Art. 6(1)(c)): Where compliance with statutory tax, accounting, or administrative obligations requires record retention.

5. How We Use Your Information

We process the personal information we collect for the following specific and legitimate purposes:

• To publish, curate, maintain, and optimize our luxury travel guides, itineraries, and photographic resources.
• To send periodic email updates, destination deep-dives, and packing checklists to subscribers who have explicitly opted in (every email includes a one-click unsubscribe link in the footer).
• To screen reader comments for offensive language, hate speech, malicious code, and commercial spam before public display.
• To answer personal correspondence, travel inquiries, and reader questions submitted via our contact portal.
• To analyze aggregate traffic trends and reader interests, ensuring we allocate our photography and research budgets to destinations our audience genuinely cares about.
• To detect, prevent, and remediate technical vulnerabilities, security breaches, and fraudulent activity.

6. Affiliate Links & Advertising Disclosure

In full compliance with the United States Federal Trade Commission (FTC) Guides Concerning the Use of Endorsements and Testimonials, and international consumer protection standards, we disclose that Tripxaro participates in various affiliate marketing programs.

This means that certain links on our website—particularly those pointing to luxury boutique riads, hotel booking platforms (e.g., Booking.com), excursion providers (e.g., GetYourGuide, Viator), travel gear merchants, and flight comparison search engines—are customized affiliate links. When you click on one of these links and complete a valid reservation or purchase, Tripxaro may receive a modest referral commission from the vendor.

7. Third-Party Service Providers

We partner with a limited roster of reputable third-party cloud infrastructure and technology vendors who assist us in operating Tripxaro. These vendors have access to personal data solely to perform specific tasks on our behalf, bound by strict Data Processing Agreements (DPAs):

• Web Hosting & Server Infrastructure: Hostinger International Ltd. (servers located within high-security European and North American enterprise data centers).
• Content Delivery Network (CDN) & Web Security: Cloudflare, Inc. (providing global SSL encryption, DDoS mitigation, asset caching, and firewall filtering).
• Email Newsletter Platform: Intuit Mailchimp / Klaviyo (managing our double-opt-in subscriber lists, automated delivery, and bounce tracking under standard contractual clauses).
• Analytics & Measurement: Google LLC (Google Analytics 4 with IP anonymization enabled).
• Spam Protection: Automattic Inc. (Akismet Anti-Spam engine analyzing comment payloads against global spam blacklists).

8. International Data Transfers

Tripxaro operates globally, serving readers from over 150 nations. Consequently, personal data collected from users residing in the European Economic Area (EEA), the UK, or Switzerland may be transferred to, stored, and processed in the United States or other countries where our cloud hosting facilities and technology vendors maintain operations.

When transferring personal data across international borders, we ensure adequate safeguards are in place in accordance with GDPR Chapter V, including:

• Transferring data to countries recognized by the European Commission as providing an adequate level of data protection.
• Executing European Commission-approved Standard Contractual Clauses (SCCs) with all non-EEA service providers.
• Verifying that US-based service providers are actively certified under the EU-U.S. Data Privacy Framework (DPF) and the UK Extension to the EU-U.S. DPF.

9. Your European Privacy Rights (GDPR & UK GDPR)

If you are an EEA or UK resident, you possess comprehensive statutory rights regarding your personal information under Articles 15 through 22 of the GDPR:

• Right of Access (Art. 15): You have the right to request a formal copy of the personal data we hold concerning you, alongside details regarding how it is processed.
• Right to Rectification (Art. 16): You may request the immediate correction of inaccurate or incomplete personal records.
• Right to Erasure (“Right to Be Forgotten”, Art. 17): You may request the permanent deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you have withdrawn consent.
• Right to Restriction of Processing (Art. 18): You may restrict the processing of your data under specific statutory conditions (e.g., while the accuracy of contested data is being verified).
• Right to Data Portability (Art. 20): You may receive your personal data in a structured, commonly used, machine-readable format (JSON or CSV) or request its direct transfer to another controller.
• Right to Object (Art. 21): You may object at any time to the processing of your data based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent (Art. 7(3)): Where processing relies on your consent, you may revoke that consent instantly at any time.
• Right to Lodge a Complaint: You have the right to submit a grievance to your national Data Protection Supervisory Authority (such as the CNIL in France, the DPC in Ireland, the BfDI in Germany, or the ICO in the United Kingdom).

10. California Privacy Rights (CCPA / CPRA)

This section applies exclusively to California residents under the California Consumer Privacy Act of 2018 (CCPA) and the California Privacy Rights Act of 2020 (CPRA):

• We Do NOT Sell Your Personal Information: In the preceding 12 months, Tripxaro has never sold, leased, or rented personal information to third parties for monetary gain, nor do we sell personal information of minors under 16 years of age.
• We Do NOT Share Personal Data for Cross-Context Behavioral Advertising: We do not distribute your personal identifiers across unrelated third-party apps or websites to target advertisements.
• Right to Know & Access: You may submit a verifiable consumer request to know the specific pieces of personal information collected about you over the preceding 12 months.
• Right to Delete: You have the right to demand the permanent deletion of personal information collected from you, subject to limited legal exceptions (e.g., fraud prevention or legal compliance).
• Right to Correct: You may request the correction of inaccurate personal records.
• Non-Discrimination: We will never discriminate against you (by denying content, charging different rates, or altering service quality) for exercising your California privacy rights.

11. Other US State Privacy Rights

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and Texas (TDPSA) hold comparable rights under their respective state data privacy statutes. To submit a verified request to inspect, correct, or delete your data, please email privacy@tripxaro.com with the subject line “State Privacy Rights Request.”

12. Data Retention & Storage Protocols

We retain personal information only for as long as is necessary to accomplish the explicit purposes set forth in this policy, unless a longer retention window is mandated by tax or legal statutes:

• Subscriber Email Addresses: Retained for as long as your subscription remains active. If you unsubscribe via the link in any newsletter, your address is immediately moved to a suppression list to prevent future dispatches.
• Approved Article Comments: Retained indefinitely alongside the published travel guide to maintain the narrative integrity of reader discussions, unless a removal request is submitted.
• Server Log Files: Automatically purged or permanently anonymized within ninety (90) days of collection.
• Contact Inquiries: Retained for a maximum period of twenty-four (24) months for correspondence reference, after which they are securely purged.

13. Information Security & Encryption

We deploy robust organizational, administrative, and technical measures to protect your personal information from unauthorized access, accidental alteration, disclosure, or destruction:

• All transmissions between your web browser and Tripxaro are encrypted using modern Transport Layer Security (TLS 1.3 / SSL) with 256-bit cryptographic keys.
• Our hosting environment features dedicated Web Application Firewalls (WAF), automated brute-force defense, malware screening, and real-time vulnerability scans.
• Administrative access to the WordPress content management dashboard and cloud infrastructure is restricted to authorized personnel via multi-factor authentication (MFA) and strict role-based access controls.

14. Protection of Children’s Privacy

Tripxaro is an adult-oriented travel publication and is not directed to children. In compliance with the Children’s Online Privacy Protection Act (COPPA) and international child privacy regulations, we do not knowingly solicit or collect personal data from anyone under the age of sixteen (16). If we learn that we have inadvertently gathered personal information from a minor without verified parental consent, we will take immediate measures to purge such records from our databases. If you suspect a minor has provided us with personal information, please notify us immediately at privacy@tripxaro.com.

15. External Websites & Embedded Media

Our travel articles contain hyperlinks to third-party travel resources, airlines, national tourism boards, and luxury accommodations. Additionally, some articles feature embedded media (such as YouTube videos, interactive Google Maps, or Instagram visual posts). Embedded content from third-party websites behaves in the exact same manner as if you visited the third-party site directly. These external entities may collect data, deposit cookies, and monitor your interaction with their embedded content. We have no control over and assume no legal liability for the privacy policies or practices of third-party platforms.

16. Amendments to this Policy

We may update, modify, or revise this Privacy Policy periodically to reflect changes in our editorial operations, emerging technologies, or evolving legal frameworks. When updates occur, we will revise the “Last Revised” date at the head of this document. Any substantial alterations in how we handle your personal data will be communicated through a prominent notification banner on our homepage or via an email dispatch to verified subscribers prior to the changes taking effect.

17. Contacting Us & Exercising Your Rights

If you have any questions, concerns, or grievances regarding this Privacy Policy, or if you wish to exercise any of your statutory rights (such as requesting a copy of your stored data or requesting permanent erasure), please contact our Data Protection Officer through any of the following channels:

• Email: privacy@tripxaro.com
• Editorial Desk: contact@tripxaro.com
• Digital Contact Form: https://tripxaro.com/contact/
• Publication Name: Tripxaro — Slow Luxury Travel by Stephanie

We commit to acknowledging and processing all verifiable data subject access requests within thirty (30) calendar days, without charge.