Privacy Policy
Last updated: October 7, 2026
1. Who is responsible for your data
The data controller is Serghei Culesov, impresa individuale trading as Track Cruises, Via Angelo Scarsellini 32, 37123 Verona (VR), Italia, VAT number (Partita IVA) 01696350550, REA VR-469816. You can reach us at support@track.cruises. Full provider details are in our legal notice.
We are a sole trader and have not appointed a data protection officer; the controller handles every privacy request personally.
2. What data we collect
2.1 Data you give us
- Account data: email address, password (stored only as a hash by our authentication provider) and, if you sign in with Google or Facebook, the name, email address and profile picture those services share with us.
- Preferences: favourite cruises, price alerts and target prices, market and language settings.
- Messages: what you write to us by email or through feedback forms.
- Subscription data: plan, billing status and the name, email address and country you give at checkout. Card and payment details go directly to FastSpring; we never see them.
- Newsletter: your email address and the newsletters you chose.
2.2 Data collected automatically
- Technical data: IP address, browser, operating system, device type and the pages you request, which our hosting provider logs to run and protect the site.
- Usage data: pages viewed, searches and clicks, collected by analytics tools only if you accept cookies (section 6).
- Error reports: when something breaks, a technical report with the page, browser and error details.
2.3 API customers
- If you use our Cruise Pricing API, we log each request (API key, endpoint, parameters, time and IP address) and, for RapidAPI customers, the RapidAPI username that RapidAPI passes to us.
3. Why we use your data and on what legal basis
- To provide the service: your account, favourites, price alerts and the emails you asked for. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
- To manage subscriptions and keep accounting records. Legal basis: contract and our obligations under Italian tax law (Art. 6(1)(b) and (c)).
- To keep the service secure and working: preventing abuse and fraud, rate-limiting the API, fixing errors. Legal basis: our legitimate interest in a secure, working service (Art. 6(1)(f)).
- To measure and improve the site and our advertising with Google Analytics, Microsoft Clarity and the Meta Pixel. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time.
- To send newsletters. Legal basis: your consent (Art. 6(1)(a)); every newsletter has an unsubscribe link.
- To answer your messages. Legal basis: contract, or our legitimate interest in replying (Art. 6(1)(b) or (f)).
You need to give us an email address to create an account; everything else is optional. We do not make decisions about you based solely on automated processing, and we do not sell your personal data.
4. Who receives your data
We use the providers below. Processors act only on our instructions under a data processing agreement; the others are independent controllers with their own privacy policies.
- Supabase (Supabase Inc., USA): database and sign-in. Processor.
- Vercel (Vercel Inc., USA): website hosting and cookieless traffic statistics (Vercel Web Analytics, Speed Insights). Processor.
- Brevo (Sendinblue SAS, France): sending price alerts, account emails and newsletters. Processor.
- Sentry (Functional Software Inc., USA): error monitoring. Processor.
- Google (Google Ireland Ltd / Google LLC): Google Analytics, only with your consent, and Google sign-in if you use it. For sign-in, Google is an independent controller.
- Microsoft (Microsoft Ireland Operations Ltd): Clarity heatmaps and session recordings, only with your consent.
- Meta (Meta Platforms Ireland Ltd): the Meta Pixel for advertising measurement, only with your consent, and Facebook sign-in if you use it. Meta is jointly responsible with us for the data collected through the Pixel, and an independent controller for what it does with it afterwards and for sign-in.
- FastSpring (Bright Market LLC, USA): sells our subscriptions as reseller and merchant of record and processes payments. Independent controller; see FastSpring’s privacy policy.
- RapidAPI (USA): marketplace through which some customers buy API access. Independent controller.
- CJ Affiliate (USA): serves the CruiseDirect advertising banners on some pages and records clicks on them. Independent controller.
- Our accountant: receives invoices and payment records to meet our tax obligations.
We may also disclose data to public authorities when the law requires it. When you follow a link to a cruise line you leave our site; we do not pass your personal data to cruise lines.
5. Transfers outside the EU
Some providers are based in the United States. Transfers rely on the EU–US Data Privacy Framework adequacy decision of 10 July 2023 where the provider is certified, and otherwise on the European Commission’s Standard Contractual Clauses (Art. 46 GDPR).
7. How long we keep data
- Account, favourites and alerts: while your account exists; deleted within 30 days after you ask us to delete the account.
- Newsletter: until you unsubscribe.
- Invoices and accounting records: 10 years, as Italian law requires (Art. 2220 Civil Code).
- Support emails: up to 3 years after the last message.
- Error reports: up to 90 days.
- Google Analytics data: up to 14 months.
- API request logs: as long as needed for billing, security and abuse prevention.
8. Security
Data travels over encrypted connections (HTTPS). Passwords are stored only as hashes by our authentication provider. Access to production systems is limited to the owner, and our providers run certified infrastructure. If a data breach is likely to put you at risk, we will notify the Garante within 72 hours and tell you without undue delay, as Articles 33 and 34 GDPR require.
9. Your rights
Under Articles 15–22 GDPR you can:
- access the personal data we hold about you and get a copy;
- have inaccurate data corrected;
- have your data deleted, including your whole account;
- restrict how we use your data;
- receive the data you gave us in a machine-readable format (portability);
- object to processing based on our legitimate interests;
- withdraw consent at any time, without affecting processing that took place before.
Write to support@track.cruises, ideally from the email address linked to your account. We reply within one month; for complex requests this can be extended by two more months, and we will tell you if so. You can manage your alerts and favourites yourself in your dashboard.
You also have the right to lodge a complaint with a supervisory authority: in Italy the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome), or the authority of the EU country where you live or work.
10. Children
Track Cruises is not intended for anyone under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, write to us and we will delete it.
11. Emails we send
Price alerts and account and billing emails are part of the service you asked for. Newsletters and promotional emails are sent only if you subscribed; each one has an unsubscribe link, and you can also simply write to us.
12. Links to other websites
When you follow a link to a cruise line or another website, that site’s own privacy policy applies. We do not control what those sites collect.
13. Changes to this policy
We update this policy when our services or the law change. The date at the top shows the current version. If a change materially affects how we use your data, we will tell you by email or with a notice on the site before it takes effect.