Privacy Policy

Spectre Technologies, Inc. d/b/a Pirate ("Pirate," "we," "us," "our") provides an AI-powered cruise search and booking platform for U.S. consumers, both directly and through a network of independent travel advisors. This Privacy Policy explains what we collect, how we use and share it, your choices, and your rights.

Relationship to the Terms of Service. This Policy is incorporated into and governed by our Terms of Service. Where helpful, we repeat key context (e.g., our role as an independent travel agency/agent of cruise lines).

---

#1Who we are; scope; roles

Company & domicile. Spectre Technologies, Inc., a Delaware corporation headquartered in Austin, Texas.

Scope. This Policy covers our websites, apps, AI chat agents, and customer support channels (including Meta Messenger and Instagram). This Policy also covers data collected by our affiliated independent travel advisors ("Advisors") who use our platform and technology to serve their clients.

Roles. For consumer accounts and our site/app, we are a controller. For cruise bookings, we and each cruise line act as independent controllers of the data we separately decide to process. We act as your agent to transmit booking details to cruise lines and related suppliers.

Independent Travel Advisors. Our Advisors are independent contractors, not employees of Pirate. When you work with an Advisor, the Advisor collects your information and enters it into our systems to facilitate your booking. Both Pirate (as the host agency and technology provider) and your Advisor process your data; Pirate is the controller of data within its systems.

#2Notice at Collection

We collect the categories below from you, your devices, and service providers. "Share" below refers to cross-context behavioral advertising (CPRA). We do not store full credit-card numbers; cruise lines (Merchant of Record) or Stripe process payments.

* We do not "sell" personal information. Where targeted advertising is enabled we do "share" (as the CCPA uses that term) device and usage data, and conversion events include hashed identifiers — your email address, first and last name, and an account ID — so an advertising platform can match them to an account it already has. You can opt out at any time — see §7.

#3Sources of personal information

• You — forms, bookings, profiles, AI chat interactions, and files you upload.
• Your devices and SDKs — cookies, pixels, and analytics tooling.
• Authentication providers — e.g., Google OAuth (we receive your email, name, and profile image if you allow; we do not receive your Google password).
• Payment processors and cruise suppliers — transaction confirmations, fraud results, and booking updates.
• Messaging and social platforms — Meta Messenger / Instagram when you interact there.
• Social platforms an Advisor connects — Meta (Facebook, Instagram), Google (YouTube), and TikTok, when you as an Advisor connect an account you own so you can publish to it from our portal (see §9).
• Independent travel advisors — booking requests, client preferences, travel notes, and service interactions entered into our platform on your behalf.
• Fraud, security, and support tools — risk scores, abuse signals, and support metadata.

#4How we use personal information

• Provide, secure, and troubleshoot the Services; create and maintain your account; authenticate logins (including Google OAuth).
• Search and compare cruises, hold and transmit bookings, and support changes and cancellations.
• Provide AI chat; summarize or recall prior interactions at your request.
• Communicate with you (transactional; with consent where required, marketing).
• Personalize content and measure performance; conduct analytics; show and measure targeted ads if enabled.
• Provide AI-powered tools and recommendations to Advisors to assist with your bookings and travel planning.
• Train, develop, improve, and operate our AI models, machine learning systems, recommendation engines, and AI-powered travel agents using booking data, interaction data, and usage data (see §8A).
• Prevent, detect, and investigate fraud, abuse, and security incidents.
• Comply with law and accounting/tax requirements; enforce the ToS.

#5Sensitive Personal Information

We process passport/ID numbers, date of birth, citizenship, accessibility/ADA/health-related requests, and vaccination status (if required by the cruise line). We use this data only to provide and support the Services (e.g., bookings, safety/fraud, customer support) and as required by law.

We collect sensitive personal information (such as date of birth, passport details, and accessibility or dietary notes you choose to share) and use it only to provide and support the Services and as required by law. We do not use it for advertising, do not share it for cross-context behavioral advertising, and do not sell it. Because sensitive personal information is not used for those purposes, no separate "Limit" control is required; if that changes, we will provide one before any new use begins.

#6Disclosures of personal information

We disclose data to:

Mobile information and text messaging. Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with third parties, except aggregators and providers of the text messaging services.

• Cruise Suppliers & Travel Platforms (e.g., cruise lines, booking engine/Traveltek): traveler details, preferences/requests, manifests, and required documents to fulfill bookings.
• Independent Travel Advisors: if you are introduced to or work with one of our affiliated Advisors, we share your booking details, preferences, and contact information with that Advisor to facilitate your travel services.
• Payment Processors: Stripe for non-cruise charges; we do not store full card data. Cruise lines (Merchant of Record) process cruise fares.
• Insurance (if you elect, e.g., Allianz): traveler info for quotes, policies, and claims.
• Messaging & Social Platforms: Meta Messenger / Instagram to communicate with you; Meta receives your handle and message content on those platforms.
• Social platforms an Advisor connects: Meta (Facebook, Instagram), Google (YouTube), and TikTok. We send these platforms the content an Advisor chooses to publish to their own connected account, and we receive back the post's identifier, URL, and performance statistics (see §9).
• Service Providers & Contractors: hosting (cloud), analytics, error-logging, email communications, customer support, and fraud/security. We share text messaging originator opt-in data and consent only with aggregators and providers that deliver our text messaging services.
• Advertising/Analytics Partners: cookie and SDK identifiers and usage data for analytics and, if enabled, for cross-context behavioral advertising (see §7).
• Corporate transactions & legal: as required by law, to protect rights, or in connection with a merger or acquisition.

#Meta Platforms (Facebook, Instagram)

When you interact with our site (view pages, submit forms, complete registration, subscribe to a plan), we share hashed identifiers with Meta via their Conversions API. This may include hashed versions of your email address, name, and IP address, along with Meta-specific browser identifiers (_fbp, _fbc). When you request a trip or pay for a cruise booking, we also send Meta a hashed version of your phone number, together with the booking value.

If you are in California, the European Economic Area, the United Kingdom, or Switzerland, we do not use the Meta Pixel or the Conversions API until you accept non-essential cookies. Elsewhere, they run unless you decline. Declining — in the banner, in Cookie Settings, or through the "Do Not Sell or Share My Personal Information" control — stops both the browser pixel and our server-side Conversions API events, and we delete Meta's _fbp and _fbc cookies. We honor Global Privacy Control: when your browser sends it, we treat it as a decline even if you previously accepted.

We do not allow our processors to use your information for their own independent purposes.

#7Cookies, targeted advertising, and your choices

We use cookies and SDKs for operations, preferences, analytics, and — if enabled — targeted advertising (cross-context behavioral ads).

Sale / Share. We do not sell personal information. Where targeted advertising is enabled, we share device and usage data with advertising partners for cross-context behavioral advertising, and conversion events include hashed identifiers so the advertising platform can match them to an account it already holds. Depending on the event these are your email address, phone number, first and last name, and an account ID, together with your IP address and browser user agent. Hashing is not anonymisation: a platform that already knows these details can match the hashes back to you.

Your choices and signals.

• Footer links: Do Not Sell or Share My Personal Information, Your Privacy Choices, Cookie Settings.
• We honor Global Privacy Control (GPC) and similar opt-out preference signals as an opt-out of sale/share/targeted ads for that browser.
• You can also opt out of targeted ads by emailing [email protected].

Do Not Track (DNT). Industry DNT is not standardized; we rely on GPC and our site controls.

See our Cookie Policy for details and the SDK list.

#8AI data practices

What we collect. AI prompts, chat transcripts, and outputs; feedback signals (e.g., thumbs up/down); and usage metadata (timestamps, features used).

Purposes. Provide and improve AI features; quality assurance, safety/abuse prevention, debugging, and analytics.

Training & evaluation. With your permission, we may use de-identified or anonymized AI chat data to train and evaluate our models. You can opt out any time in Settings or by emailing [email protected]; opting out doesn't affect strictly necessary processing to provide the features.

Human review. A restricted team may review a sample of chats for quality and safety under confidentiality.

#8AAI model training, data retention, and Advisor-collected data

Data ownership and retention. When data is entered into our systems — whether by you directly, by an Advisor on your behalf, or generated through use of our platform — Pirate retains that data. This includes booking data, client preferences, interaction history, AI chat logs, and usage data. We retain this data even if you or your Advisor export a copy or if the Advisor's relationship with us ends.

AI training and operations. We use data in our systems, including data entered by Advisors, to train, develop, improve, fine-tune, and operate our artificial intelligence models, machine learning systems, recommendation engines, and AI-powered travel agents and assistants. This includes using booking patterns, travel preferences, interaction data, and anonymized/aggregated insights to improve the accuracy and relevance of our AI recommendations for all users. This paragraph is subject to the exception immediately below.

Exception — data from Google and YouTube. Data we receive from Google APIs, including all data from a YouTube channel an Advisor connects under §9, is excluded from everything described in this §8A. We do not use it to train, develop, improve, fine-tune, or operate any artificial intelligence or machine learning model, and we do not include it in aggregated or de-identified datasets used for those purposes. We use it only to provide the publishing and performance-reporting features in the advisor portal, as required by the Limited Use requirements of the Google API Services User Data Policy. Where this §8A and the Limited Use commitment in §9 could be read to conflict, the §9 commitment governs.

Your choices. You may request deletion of your personal information as described in §11. Where we have incorporated data into trained AI models in de-identified or aggregated form, deletion of the original record does not require retraining of the model, but we will delete or de-identify identifiable records in our operational systems. Opting out of AI training (§8) applies to your direct AI chat interactions; Advisor-entered booking and preference data is used to improve our platform as described above.

Advisor data practices. Our Advisors are independent contractors, not Pirate employees. When you work with an Advisor, the Advisor may independently collect information from you (such as your name, contact details, travel preferences, and payment information) and enter it into our platform. Advisors are contractually required to protect your personal information, comply with applicable privacy laws, and direct you to this Privacy Policy. If you have questions about how a specific Advisor handles your data outside our platform, please contact the Advisor directly.

Retention of Advisor-collected data. Data entered by Advisors into our systems is retained for a minimum of seven (7) years for compliance, audit, and business purposes, and may be retained indefinitely in de-identified or aggregated form for AI training and platform improvement.

#9Social media platforms

This section covers two different situations: when you message us on a social platform, and when an Advisor connects their own social accounts to our platform.

If you message us. If you message us on Messenger or Instagram, your use is also subject to Meta's terms and policies. We receive your messages and may sync them to our support systems to answer questions and provide service.

If you are an Advisor who connects a social account. Our advisor portal lets you connect social accounts that you own or manage, so you can publish your own content to them from one place. We support Facebook Pages, Instagram Business accounts, YouTube channels, and TikTok accounts.

What we do with a connected account:

• We publish only the content you create, only to the accounts you connected, and only when you click Publish. We do not post on your behalf automatically, we do not post without your instruction, and we never publish to an account you did not connect.
• We read a limited amount of information from the connected account to make the feature work. This is described per platform in the table below.
• We store an encrypted access token so we can act on your instruction. Tokens are encrypted with a per-credential key and are never stored in readable form.

You can disconnect any account at any time in Settings, then Integrations. When you disconnect, we revoke the access token with the platform where the platform supports revocation, and we delete our stored credentials for that account. Content you already published to the platform stays on the platform — disconnecting does not delete your posts. To remove a published post, delete it on the platform itself.

For each post published or imported through our platform, we also store the post's platform ID, its public URL, its caption or title, a thumbnail URL, and the engagement statistics the platform reports — views, reach, likes, comments, shares, and saves — so we can show you how your posts performed.

Meta deauthorization and deletion. If you remove our app from your Facebook settings, Meta notifies us and we immediately mark the integration disconnected and retire the stored credentials. If you ask Meta to delete your data, Meta sends us a deletion request and we delete the connection records, credentials, and encryption keys for that account. You can check the status of a deletion request at pirate.travel/data-deletion.

#Google and YouTube data

When an Advisor connects a YouTube channel, our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Specifically:

• We request only two Google permissions: permission to upload videos to your channel, and read-only access to your channel and video data.
• We use this data only to provide the publishing and performance-reporting features you see in the advisor portal.
• We do not transfer this data to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with notice to you.
• We do not use this data for advertising, and we do not sell it.
• We do not allow humans to read this data unless we have your explicit consent for specific messages, it is necessary for security purposes such as investigating abuse, to comply with applicable law, or the data is aggregated and de-identified.

Our YouTube integration uses YouTube API Services. By connecting a YouTube channel you also agree to the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.

You can revoke our access to your YouTube channel at any time, either by disconnecting in Settings, then Integrations, or through the Google security settings page.

#10Children & teens

Our Services are not directed to children under 13. Users 13–17 may browse with a parent or guardian's involvement; bookings must be made by adults. We do not knowingly collect data from children under 13.

Teens 13–16 (CA/CT/CO/VA, etc.): we do not "sell" data. If we "share" data for targeted ads, we seek opt-in consent before sharing teen data and honor withdrawals at any time.

#11Your privacy rights (U.S. state laws)

Depending on where you live (e.g., CA/CPRA, VA/VCDPA, CO/CPA, CT/CTDPA, UT/UTDPA, TX/TDPSA, OR/OCPA), you may have rights to:

• Know / Access the data we hold about you, and portability (a copy).
• Delete and Correct. Where your data has been incorporated into trained AI models in de-identified or aggregated form, deletion of the original record does not require retraining of the model. We will delete or de-identify your identifiable records in our operational systems upon valid request.
• Opt out of (i) sale/share of personal information, (ii) targeted advertising, and (iii) profiling in furtherance of decisions that produce legal or similarly significant effects (we do not engage in such profiling today).

We collect sensitive personal information (such as date of birth, passport details, and accessibility or dietary notes you choose to share) and use it only to provide and support the Services and as required by law. We do not use it for advertising, do not share it for cross-context behavioral advertising, and do not sell it. Because sensitive personal information is not used for those purposes, no separate "Limit" control is required; if that changes, we will provide one before any new use begins.

• Appeal a decision if we decline your request (you'll see appeal instructions in our response).

How to exercise:

• Webform: pirate.travel/data-request
• Email: [email protected]
• In-product: Settings → Privacy

We will verify your identity (e.g., account login + 2–3 data points). You may use an authorized agent (we may require signed permission and verification). We respond within 45 days (with a possible 45-day extension where permitted). We will not discriminate against you for exercising your rights.

#12Verification & authorized agents

We verify requests using information you provide and data we already hold. If we cannot reasonably verify you, we will explain why and how to fix it. Authorized agents must provide proof of authorization; we may also request direct confirmation from you.

#13Security

We use administrative, technical, and physical safeguards appropriate to the nature of the data (e.g., access controls, encryption in transit and at rest where appropriate, least-privilege access, monitoring, and regular reviews). No system is perfectly secure.

#14Retention

We keep data only as long as needed for the purposes above, including to provide the Services, comply with law, prevent fraud, and resolve disputes. Typical periods are listed in the Notice at Collection table; financial records are generally retained 7 years. Backups and logs roll off on scheduled cycles.

#15International visitors; transfers

We are U.S.-based and primarily target North America. If you are outside North America, you may browse our site but availability may be limited. When we transfer personal data from the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses (and the UK Addendum, as applicable) plus supplementary measures. If we join a recognized transfer framework (e.g., EU-U.S. DPF), we will note it here.

#16Financial incentives

We currently do not offer financial incentives (e.g., loyalty or referral programs) that involve sharing or selling personal information. If we launch one, we will describe the material terms and opt-in/withdrawal rights here.

#17Changes to this Policy

We may update this Policy from time to time. For material changes, we will provide reasonable advance notice (e.g., email, in-product, or site banner) when feasible. The "Last updated" date shows when changes took effect.

#18Contact us

• Privacy requests & questions: [email protected]
• Support: [email protected]
• Legal notices: [email protected]
• Webform: pirate.travel/data-request

Accessibility. To request this Policy in an alternative format, contact [email protected].

#19U.S. State-Specific Disclosures

California (CPRA). We provide Notice at Collection (see §2), do not "sell" PI, and may "share" device/usage data for cross-context behavioral advertising unless you opt out. We honor GPC. We collect sensitive personal information (such as date of birth, passport details, and accessibility or dietary notes you choose to share) and use it only to provide and support the Services and as required by law. We do not use it for advertising, do not share it for cross-context behavioral advertising, and do not sell it. Because sensitive personal information is not used for those purposes, no separate "Limit" control is required; if that changes, we will provide one before any new use begins. We use personal information, including data entered by independent travel advisors, to train and operate our AI models and AI-powered travel agents. This use is for providing and improving our services and is not a "sale" of personal information.

Virginia / Colorado / Connecticut / Texas / Oregon / Utah. We honor rights to access, correct, delete, and portability; to opt out of targeted advertising and profiling where applicable; and to appeal.

Nevada. We do not sell covered information as defined by Nevada law.

#20Key definitions

• "Personal information" or "personal data" means information that identifies or is reasonably linked to an individual or household.
• "Sensitive Personal Information" includes passport/ID numbers, precise geolocation, and health/ADA requests.
• "Share" means making PI available to a third party for cross-context behavioral advertising.

---

#Short "AI" notice

We collect and analyze AI chat data (including transcripts) to provide and improve our services and to keep our systems safe. With your permission, we may also use de-identified data to help train and evaluate our models. You can adjust your AI data choices any time in Settings.

#Appendix A — Data Recipient Categories (illustrative)

• Cruise Suppliers: traveler identity, DOB, passport details, preferences, loyalty IDs, manifests, special requests.
• Booking engine / travel platform: itinerary selection, PNR/record locator, booking messages.
• Payments: Stripe (non-cruise charges); cruise lines for cruise fares.
• Support & communications: email/SMS providers, helpdesk; Meta Messenger and Instagram when you chat there.
• Analytics & ads: analytics platforms; ad partners and cookie platforms (if enabled).
• Cloud & security: hosting, storage, content delivery, monitoring, and fraud tools.