1. Scope and Data Controller
This Privacy Policy applies to all personal information collected by Caribbean Trend Lab ("we", "us", or "our") through the Caribbean Trend Lab platform at caribbeantrendlab.com and all associated subdomains, applications, and services (the "Platform"). It applies to all visitors, registered users, subscribers, and purchasers (collectively, "Users" or "you").
For the purposes of applicable data protection legislation, including the General Data Protection Regulation (GDPR) (EU) 2016/679, the California Consumer Privacy Act (CCPA/CPRA), and other applicable privacy laws, Caribbean Trend Lab is the data controller of personal information collected through the Platform.
Data protection enquiries should be directed to: privacy@caribbeantrendlab.com
2. Personal Information We Collect
We collect personal information in the following categories:
2.1 Information You Provide Directly
| Category | Data Types Collected |
|---|---|
| Account Registration | Full name, email address, password (hashed), country of residence, account creation date. |
| Payment Information | Billing name, billing address, and payment method tokenised by Stripe, Inc. We do not receive, store, or process raw payment card data. Stripe's privacy policy governs the handling of your card details. |
| Communications | Content of emails or messages sent to us, including support enquiries, feedback, and report requests. |
| AI Tool Inputs | Queries submitted to AI Tools (AI Concierge, Visa Finder, Island Recommender, etc.). These are transmitted to Anthropic, Inc. for processing. See Section 5 for details. |
| Affiliate Programme | For affiliates: name, website, audience description, payout details (via Stripe Connect or designated payment platform). |
2.2 Information Collected Automatically
When you access the Platform, we and our third-party service providers automatically collect certain technical and usage information, including:
- Internet Protocol (IP) address and approximate geolocation derived therefrom;
- Browser type and version, operating system, and device type;
- Pages visited, features used, time spent on the Platform, and navigation paths;
- Referring URLs and search terms;
- Performance data, error logs, and crash reports;
- Cookie identifiers and similar tracking technologies (see Section 7).
3. How We Use Your Personal Information
We process your personal information only where we have a lawful basis for doing so. The following table sets out our processing activities and the legal basis applicable under GDPR:
| Purpose of Processing | Description | Lawful Basis (GDPR) |
|---|---|---|
| Account management | Creating and managing your user account, authenticating your identity, and providing customer support. | Performance of contract |
| Subscription billing | Processing Subscription Fee payments, managing billing cycles, issuing invoices, and handling refund requests. | Performance of contract |
| Report delivery | Fulfilling purchases of Intelligence Reports by generating and delivering download links. | Performance of contract |
| Platform operation | Operating, maintaining, and improving the Platform and its features, including personalisation of dashboard content. | Legitimate interests |
| AI tool functionality | Processing queries submitted to AI Tools and returning AI-generated responses. Queries are passed to Anthropic, Inc. for model inference. | Performance of contract / Legitimate interests |
| Communications | Sending transactional emails (receipts, password resets, account alerts) and, where you have consented, marketing and newsletter communications. | Contract / Consent |
| Analytics | Analysing usage patterns to understand how the Platform is used, to identify technical issues, and to inform product development decisions. | Legitimate interests |
| Legal compliance | Complying with applicable legal obligations, including tax record-keeping, fraud prevention, and responding to lawful requests from regulatory or law enforcement authorities. | Legal obligation |
| Security | Detecting, preventing, and investigating fraud, abuse, security incidents, and other harmful activities. | Legitimate interests |
4. Data Sharing and Disclosure
4.1 We Do Not Sell Your Personal Data
Caribbean Trend Lab does not sell, rent, trade, or otherwise transfer your personal information to third parties for their independent commercial use. We are not in the business of monetising your personal data.
4.2 Third-Party Service Providers
We share personal information with the following categories of trusted third-party service providers, strictly to the extent necessary to deliver the Platform and its services:
| Provider | Category | Purpose |
|---|---|---|
| Stripe, Inc. | Payment processing | Processing subscription and one-time report payments. Stripe's privacy policy: stripe.com/privacy |
| Vercel, Inc. | Cloud hosting & CDN | Hosting and serving the Platform. Data processed on Vercel infrastructure. |
| Anthropic, Inc. | AI model inference | Processing queries submitted to AI Tools. Anthropic's privacy policy: anthropic.com/privacy |
| Analytics provider | Platform analytics | Aggregated usage analytics to understand Platform performance. Data is anonymised where possible. |
| Email delivery | Transactional email | Sending account-related emails, receipts, and (where consented) marketing communications. |
4.3 Legal Disclosures
We may disclose personal information where required to do so by applicable law, court order, regulatory directive, or in response to a lawful request from a competent governmental or law enforcement authority. We will, where legally permissible, endeavour to notify you of any such disclosure.
4.4 Business Transfers
In the event of a merger, acquisition, restructuring, sale of assets, or insolvency proceeding involving the Company, personal information held by the Company may be transferred to the relevant acquiring or successor entity, subject to the same or equivalent privacy protections as set out in this Privacy Policy.
5. AI Tools and Third-Party Data Processing
Queries submitted to AI Tools on the Platform are transmitted to Anthropic, Inc. for processing by their large language model infrastructure. Anthropic processes these queries solely to generate responses and does not use your queries to train its models without consent, in accordance with Anthropic's published privacy and data use policies.
You are advised not to include personally identifiable information, confidential financial data, legally privileged information, or sensitive personal data in queries submitted to AI Tools. The Company accepts no liability for the content of AI-generated responses or for any consequences arising from the inclusion of sensitive information in AI Tool queries.
AI Tool queries may be logged by the Company for a limited period for the purposes of quality assurance, abuse prevention, and service improvement. Such logs are subject to the data retention periods set out in Section 9 of this Policy.
6. International Data Transfers
The Platform is operated from servers located in the United States. If you are accessing the Platform from outside the United States — including from the European Economic Area (EEA), the United Kingdom, or other jurisdictions with data transfer restrictions — your personal information may be transferred to and processed in the United States or other countries where our service providers operate.
Where such transfers are subject to data protection requirements (including GDPR), we rely on appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the European Commission, adequacy decisions where applicable, and equivalent contractual protections, to ensure your personal information receives an adequate level of protection.
7. Cookies and Similar Technologies
7.1 Types of Cookies Used
The Platform uses cookies and similar tracking technologies to operate and improve the user experience. The following categories of cookies are used:
| Cookie Type | Consent Required? | Purpose |
|---|---|---|
| Strictly necessary | No | Essential for Platform operation, authentication, and security. Cannot be disabled. |
| Functional | No (legitimate interest) | Remember your preferences, language settings, and logged-in state. |
| Analytics | Yes | Collect aggregated data on Platform usage to improve functionality and content. |
| Marketing | Yes | Used to deliver relevant promotional communications where you have provided consent. |
7.2 Managing Cookies
You may manage or disable non-essential cookies through your browser settings or through any cookie consent tool we deploy on the Platform. Disabling strictly necessary cookies may impair Platform functionality. For more information on managing cookies, visit allaboutcookies.org.
8. Your Privacy Rights
Depending on your jurisdiction, you may have the following rights in relation to your personal information:
| Right | Description |
|---|---|
| Right of Access | Request a copy of the personal information we hold about you (GDPR Art. 15 / CCPA). |
| Right to Rectification | Request correction of inaccurate or incomplete personal information (GDPR Art. 16). |
| Right to Erasure | Request deletion of your personal information where it is no longer necessary for the purposes for which it was collected, subject to applicable legal obligations (GDPR Art. 17 / CCPA). |
| Right to Restriction | Request restriction of processing of your personal information in certain circumstances (GDPR Art. 18). |
| Right to Data Portability | Receive your personal information in a structured, machine-readable format (GDPR Art. 20). |
| Right to Object | Object to processing based on legitimate interests or for direct marketing purposes (GDPR Art. 21). |
| Right to Withdraw Consent | Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing. |
| Right to Non-Discrimination | CCPA rights holders have the right not to receive discriminatory treatment for exercising their privacy rights. |
To exercise any of the above rights, please submit a request to privacy@caribbeantrendlab.com. We will respond within the timeframe required by applicable law (generally within thirty (30) calendar days for GDPR requests and forty-five (45) calendar days for CCPA requests). We may require identity verification before processing your request.
9. Data Retention
We retain personal information only for as long as necessary to fulfil the purposes for which it was collected and to comply with applicable legal, accounting, and regulatory obligations. The following retention periods apply:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account data (active accounts) | Duration of account + 3 years | Contractual obligation / legitimate interests |
| Account data (deleted accounts) | 30 days post-deletion | Fraud prevention / dispute resolution |
| Payment and billing records | 7 years | Legal obligation (tax / financial records) |
| Intelligence Report purchase records | 7 years | Legal obligation |
| Support communications | 3 years from last contact | Legitimate interests |
| AI Tool query logs | 90 days | Quality assurance / abuse prevention |
| Analytics data (aggregated) | 26 months | Legitimate interests |
| Marketing consent records | Until consent withdrawn + 1 year | Legal compliance |
10. Data Security
We implement and maintain industry-standard technical and organisational measures to protect your personal information against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:
- Transport Layer Security (TLS/HTTPS) encryption for all data transmitted between your browser and the Platform;
- Encryption of data at rest for sensitive personal information held in our databases;
- Access controls limiting personnel access to personal information on a need-to-know basis;
- Regular security assessments and vulnerability monitoring;
- Incident response procedures for data breach detection, assessment, and notification.
Notwithstanding the foregoing, no method of electronic transmission or data storage is completely secure. We cannot guarantee the absolute security of your personal information. In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will notify you and the relevant supervisory authority in accordance with applicable legal requirements.
11. Children's Privacy
The Platform is not directed at, and is not intended for use by, individuals under the age of eighteen (18) years. We do not knowingly collect personal information from minors. If you become aware that a minor has provided personal information through the Platform, please contact us at privacy@caribbeantrendlab.com and we will take prompt steps to delete such information.
12. Marketing Communications
Where you have provided your consent, we may send you marketing communications about the Platform, new Intelligence Reports, and related products and services. You may withdraw your consent and opt out of marketing communications at any time by:
- Clicking the unsubscribe link in any marketing email;
- Updating your communication preferences in your account settings; or
- Contacting us at privacy@caribbeantrendlab.com
Withdrawal of consent does not affect the lawfulness of marketing communications sent prior to withdrawal. Please note that even after opting out of marketing communications, you will continue to receive transactional and account-related emails necessary for the operation of your account.
13. Updates to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or operational requirements. The "Last Updated" date at the top of this Policy indicates when the most recent changes were made.
Where changes are material, we will notify registered users by email at the address associated with their account at least fourteen (14) calendar days before the changes take effect. Your continued use of the Platform after the effective date of any update constitutes your acceptance of the revised Privacy Policy.
14. Right to Lodge a Complaint
If you are located in the European Economic Area or the United Kingdom and believe that we have processed your personal information in a manner inconsistent with applicable data protection law, you have the right to lodge a complaint with the relevant national data protection supervisory authority. In the EEA, this is the supervisory authority of your country of habitual residence, place of work, or place of alleged infringement. In the United Kingdom, this is the Information Commissioner's Office (ICO) at ico.org.uk.
We would encourage you to contact us directly in the first instance to attempt to resolve any concern.
15. Contact Us
For all privacy-related enquiries, data subject access requests, or complaints, please contact:
- Caribbean Trend Lab — Data Privacy
- Website: caribbeantrendlab.com
- Privacy & Data Requests: privacy@caribbeantrendlab.com
- Legal: legal@caribbeantrendlab.com
- Support: support@caribbeantrendlab.com