Privacy Policy

Palmilla is a booking platform for surf lessons and surf photography in Baja California Sur, operated by Palmilla Software, Inc., a United States company (“Palmilla”, “we”, “us”). This policy covers palmilla.co and the messages we send in connection with it.

Questions about this policy or your data: email hello@palmilla.co.

We collect what you give us and what running a booking service requires:

• Account details — your name, email address, and, if you add one, your phone number and profile photo.
• Booking details — the sessions you book, when they happen, who the instructor is, and messages you exchange with instructors through the app.
• Payment details — handled by Stripe, our payment processor. Card numbers never touch our servers.
• Messaging preferences — whether you opted in to booking updates by WhatsApp or text message, and any opt-out you send.
• Instructor business details — for instructors, the profile, availability, and payout information needed to run their page and pay them.
• Technical basics — logs and analytics about how the site is used, to keep it working and improve it.

To run the service: process bookings and payments, send booking confirmations, session reminders, and review requests, connect you with your instructor, and provide support.

To operate responsibly: prevent fraud and abuse, comply with legal obligations, and understand how the product is used so we can improve it.

We send marketing messages only where you have separately agreed to receive them, and every one includes a way to stop.

If you opt in, we send booking updates to your phone number by WhatsApp or SMS: booking confirmations, session reminders, and review requests. Consent is never required to book, and you can withdraw it at any time by replying STOP (or BAJA) to any message, or by turning the toggle off in your profile.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third parties, except for the messaging providers that deliver the messages on our behalf.

We do not sell your personal information. We share it only with the service providers who make the product work, and only what each needs:

• Stripe — payment processing and instructor payouts.
• Messaging and email providers (Meta WhatsApp, Twilio, Resend) — to deliver the messages described above.
• Hosting and infrastructure providers (Vercel, Neon) — to run the site and store its data.
• Your instructor — sees your name, and after you book, the contact details needed to coordinate your session.

We may also disclose information if the law requires it, or as part of a business transaction such as a merger, in which case this policy continues to apply.

We keep your information while your account is active and as long as needed for the purposes above — bookings and payment records are kept for the periods bookkeeping and tax rules require. Opt-out records are kept so we keep honoring them.

• Stop messages — reply STOP (or BAJA) to any message, or use the toggle in your profile.
• Unsubscribe from marketing email — every marketing email includes an unsubscribe link.
• Access, correct, or delete your data — email hello@palmilla.co and we will handle it. Depending on where you live, you may have additional rights under laws such as the California Consumer Privacy Act; we honor requests regardless of where you are.

Palmilla is not directed at children under 13, and we do not knowingly collect their personal information. Bookings for minors are made and managed by a parent or guardian.

If we change this policy in a meaningful way, we will update the effective date above and, for significant changes, tell you directly. The current version always lives at palmilla.co/privacy.