Privacy Policy

Effective August 14, 2026 · Rhythms of the Night Vallarta · Maven Concepts

1. Scope and identity

This Privacy Policy describes how Maven Concepts, an Idaho-registered business partnership operating Rhythms-of-the-Night-Vallarta.com (the “Site”), collects, uses, discloses, stores and protects personal information from prospective guests, purchasers and website visitors. Maven Concepts acts as the independent online reservation and payment intermediary; Vallarta Adventures / The Adventures Group supplies and fulfills the actual tour experience.

This policy applies to the Site and interactions related to reservations, customer support, analytics and advertising. The Operator and Stripe also maintain their own privacy notices for processing under their respective responsibilities.

2. Information we collect

Booking and contact information: name, email address, telephone number, trip date, package selection, party size, age category, reservation and guest information, special requests, customer communications and booking history. We collect only details necessary for reservation and support functions or submitted voluntarily.

Transaction information: purchased package, total, currency, booking status, Stripe transaction identifiers, refund and chargeback details, and limited card metadata made available by Stripe such as card brand, issuing country and the last four digits. We do not collect or store full card numbers or card security codes.

Device and online information: IP address, the approximate city, region and country derived from it, browser and device type, pages visited, referral source, timestamps, cookie identifiers, analytics client identifiers, Google advertising click identifiers, campaign attribution and interactions with the Site.

Policy acceptance records: when you accept the booking terms at checkout we record the exact wording you were shown, its version, and the date and time of acceptance, alongside the IP address the request came from. These records exist to document what was agreed and to respond to payment disputes.

3. Purposes for using information

We use information to process reservation requests; verify availability with the Operator; issue confirmations and operational notices; take and reconcile payments; deliver customer assistance; handle date changes, refunds and disputes; prevent fraud; troubleshoot and maintain website security; maintain records; measure conversion and website performance; and, where lawful, advertise and improve our services.

Where required by law, we seek consent before sending optional direct marketing messages or setting non-essential cookies. Transactional communications necessary to administer a booking are distinct from promotional subscriptions. If you start a checkout and do not complete payment, we may send you a single reminder about that incomplete reservation.

4. Stripe and payment-card security

Payments are processed by Stripe using Stripe-hosted checkout pages. Card details are entered on Stripe’s own payment page and full card numbers and security codes never pass through, and are never stored on, our servers.

We receive payment status, billing identity data, card brand and last four digits, and fraud or chargeback records from Stripe in order to manage purchases. Stripe independently processes information for transaction execution, fraud detection, risk controls and legal compliance under its own policies. No payment system can promise absolute security; we use appropriate administrative and technical measures and review access to operational systems.

5. How information is disclosed — we do not sell customer lists

We do not sell or rent customer contact lists to unrelated data brokers. We disclose information where needed to complete transactions and maintain the Site:

• Vallarta Adventures / The Adventures Group — the guest name, party size, date, package and any stated requirements, for passenger registration and tour fulfillment.
• Stripe — payments, refunds, fraud screening and disputes.
• Railway — application hosting and the booking database, located in the United States.
• Postmark — delivery of transactional email.
• Google — Analytics and Ads measurement, as described in section 6.
• Microsoft — Clarity website analytics, as described in section 6.
• ipapi.co — converting an IP address into an approximate city, region and country.

We may disclose information to legal authorities when required, to protect safety or prevent fraud, or in connection with a legitimate business restructuring subject to applicable law. Shared data is limited to what is reasonably necessary for the stated purpose.

6. Analytics, advertising and session measurement

The Site uses Google Analytics 4 and Google Adsconversion tracking to understand visits, measure bookings and attribute advertising. These transmit identifiers, device information, website activity, referral data and conversion details to Google. Conversion events sent from our server may include the booking value, currency and a booking reference. We do not send names, email addresses or telephone numbers to Google.

The Site also uses Microsoft Clarity, which records how pages are used — including mouse movement, clicks, scrolling and page interactions — so that layout and usability problems can be found. Clarity is not loaded on our administration pages.

We do not operate a Meta pixel or Meta Conversions API on this Site.

Advertising and analytics technologies can be regarded as “sharing” for cross-context behavioral advertising under some privacy laws even though we never sell a customer list. We therefore do not claim that we never share information with anyone. We limit advertising event payloads to permitted, non-sensitive information.

7. Cookies and similar technologies

Necessary technologies support functionality, security and checkout. Optional analytics and advertising technologies support measurement and campaign attribution. Browser settings can block or delete cookies, though doing so may affect how the Site works.

• rotn_lang — remembers whether you chose English or Spanish. Necessary.
• rotn_click_id (browser storage) — retains a Google advertising click identifier for up to 90 days so a booking can be attributed to the advertisement that produced it.
• rotn_conv_sent (browser storage) — records that a purchase has already been reported, so reloading the confirmation page does not report it twice.
• _ga, _ga_* — Google Analytics, to distinguish visitors and sessions.
• _gcl_au — Google Ads, for conversion attribution.
• _clck, _clsk — Microsoft Clarity, to associate page interactions within a session.
• rotn_admin — set only when a member of staff signs in to the administration area. Never set for customers.

You may use Google ad settings to manage advertising personalization. Where the law applies, we honor valid requests to opt out of the sale or sharing of personal information, including browser-based opt-out preference signals such as Global Privacy Control.

8. Retention and deletion

We retain reservation, payment-reference and customer-support records for the period reasonably necessary to complete services, handle disputes, comply with tax and accounting obligations, detect fraud and defend legal claims. As a general practice:

• Booking and transaction records — retained for seven years from the date of travel, to meet accounting and tax record-keeping obligations and to allow for the card-network dispute window.
• Terms-acceptance records — retained for the same period as the booking they belong to, for the same reason.
• Incomplete checkouts — retained for up to 12 months, then deleted.
• Customer support correspondence — retained for up to three years from the last contact.
• Analytics data — retained according to the provider’s own schedule, currently 14 months for Google Analytics and up to 13 months for Microsoft Clarity.

We delete or de-identify information when it is no longer needed, except where legal retention or another legitimate exception applies.

9. Data security and incident response

We use safeguards appropriate to the sensitivity of booking information, including encrypted transport for the whole Site, restricted and password-protected access to the administration area, managed payment processing by Stripe, and supplier access controls. Access is limited to authorized personnel with an operational need. No internet transmission or storage environment is guaranteed completely secure.

We investigate suspected unauthorized access and take the notification steps required by applicable law. Please do not send payment-card numbers, passport details or sensitive medical information by ordinary email.

10. Your privacy rights and how to exercise them

Depending on where you live, you may request access to your personal information, correction, deletion, a copy of your information, limits on certain uses, or an opt-out of targeted advertising or the sale or sharing of personal information. We may need to verify your identity, and we may retain information where a legal exception applies. We do not discriminate unlawfully against anyone for exercising privacy rights.

To make a request, email info@rhythms-of-the-night-vallarta.com with the word “Privacy” in the subject line and, if you have booked, your booking reference. We aim to acknowledge requests within 10 days and to respond substantively within 45 days, or sooner where the law requires it.

11. International processing, minors and third-party sites

Reservations involve a United States-based booking business and a tour provider in Mexico. Booking information is transmitted and stored across borders, including by payment and technology service providers, and our hosting and database are located in the United States. Where necessary, appropriate safeguards and disclosures are applied.

The Site is intended for adults booking travel experiences; adults may supply the limited information needed to reserve places for accompanying children. Children under six are not permitted on this experience. We do not knowingly use children’s personal information for targeted advertising. Third-party websites linked from the Site are governed by their own policies.

12. Changes and contact

We may update this policy to reflect changes to our data practices, vendors or the law, and will post an updated effective date. Material changes will be notified as required by law. The current version remains accessible from the Site footer and at checkout.

Privacy contact: Maven Concepts — info@rhythms-of-the-night-vallarta.com. Our Terms & Conditions and Booking Terms govern use of the Site and the reservations made through it.