Privacy Policy

1. Information We Collect

We collect information that you provide directly to us when you make a purchase or communicate with us. This may include:

• Personal identification information: full name (as it appears on your travel document) and email address.
• Payment information: payment details are processed securely through Stripe. We do not store your full credit card number, CVV, or other sensitive payment data on our servers.
• Order information: airport, planned visit date and time, traveler allocation, selected or supported lounge information, order history, and transaction records.
• Communications: any messages, inquiries, or feedback you send through an available support channel.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Processing orders: to arrange the airport lounge visit you purchased and deliver confirmation and access details.
• Communications: to send you order confirmations, status updates, and respond to your inquiries and support requests.
• Service improvement: to analyze usage patterns, improve our website functionality, and enhance the overall customer experience.
• Legal compliance: to comply with applicable laws, regulations, and legal processes.

3. Data Storage and Security

We take the security of your personal data seriously and implement appropriate technical and organizational measures to protect it:

• Your data is stored in a managed Cloudflare D1 database. Access is restricted to our server-side application through a private Worker binding rather than being exposed directly to browsers.
• All data transmitted between your browser and our servers is encrypted using HTTPS/TLS protocols.
• Stripe processes payment details. We do not store account passwords or full card details because customer accounts are not required and card data is not collected by our application.
• We regularly review and update our security practices to address emerging threats.

4. Third-Party Services

We use the following third-party services to operate our business. Each service has its own privacy policy governing the use of your information:

• Stripe — for secure payment processing. Stripe is PCI DSS Level 1 certified, the highest level of certification in the payments industry. See Stripe's Privacy Policy.
• Resend — for transactional email delivery, including order confirmations and status updates. See Resend's Privacy Policy.
• Google Analytics — to measure website visits, traffic sources, product interactions, checkout activity, and completed purchases. Where consent is required, analytics storage starts denied and Google Analytics cookies are not set unless you accept. We do not send Google Analytics your name, email address, date of birth, or payment details. See Google's Privacy Policy.

5. Cookies

We use the following browser storage and cookies:

• preferred-currency — stores your preferred display currency (USD, HKD, or GBP) for a consistent browsing experience.
• admin-session — used to authenticate administrative sessions for site management purposes only.
• NEXT_LOCALE — stores your preferred language locale as set by next-intl.
• lounge-analytics-consent — stores your analytics preference in your browser.
• _ga and _ga_* — optional Google Analytics cookies used only after you accept analytics. They help distinguish pseudonymous visits and measure website usage.

For visitors in the EEA, United Kingdom, and Switzerland, the Google tag starts with analytics storage denied and may send cookieless measurement signals. The _ga cookies are not set unless analytics consent is accepted. Elsewhere, analytics may be granted by default. You can reject it or change your choice at any time through Cookie settings. We keep advertising storage and personalization disabled, and we do not sell your browsing data.

6. Your Rights

You have the following rights regarding your personal data:

• Right of access: you may request a copy of the personal data we hold about you.
• Right to correction: you may request that we correct any inaccurate or incomplete personal data.
• Deletion requests: you may ask us to delete personal data, subject to applicable law and records we must retain for legal, payment, fraud-prevention, or dispute purposes.
• Other applicable rights: additional rights may apply depending on where you live.

To exercise any of these rights, please contact us using the details provided below. We will respond within the period required by applicable law.

7. Contact Information

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us:

• Email: support@loungeentry.com

8. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.