Privacy policy
Your privacy matters to us. This policy explains what information Pana.ph collects, how we use it and how you can control it. We keep it simple because trust should be simple.
1. What we collect
- Account information — your name, email and password (stored as a salted hash) when you create an account.
- Trip enquiry details — your name, email, travel dates, party size and any note you include when submitting a request.
- Saved trips — offers you save to My Trips are stored in your browser's local storage, not on our servers.
- Session cookies — a httpOnly cookie keeps you signed in for 30 days. No tracking or advertising cookies are used.
- Contact messages — your name, email and message when you use the contact form.
2. How we use your information
- To create and manage your account and session.
- To process and respond to your trip enquiries and contact messages.
- To send you confirmation and notification emails related to your requests.
- To display your trip-request history on your account page.
- To prevent spam and abuse through rate limiting.
We do not sell your personal information. We do not share it with third parties except as necessary to process your enquiries (e.g. forwarding a request to a partner agent).
3. Data storage and security
Account and enquiry data is stored in our database, accessible only to the Pana.ph team and authorised agents. Passwords are hashed with scrypt and a random salt — we never store or transmit plain-text passwords. Session tokens are cryptographically random and stored in httpOnly cookies to prevent cross-site access.
Offer photos uploaded by agents and admins are stored in a private media bucket and served only through our media route, which restricts access to the offers/ prefix.
4. How long we keep your data
- Accounts — kept until you request deletion. Deleted accounts detach from trip-request history (set to null) rather than removing the enquiry record.
- Trip enquiries — kept for record-keeping even after the trip is completed or the account is deleted.
- Sessions — expire after 30 days; expired session rows are swept automatically.
- Contact messages — kept in the email inbox of the team for follow-up.
5. Your rights
- Access — you can view your trip-request history on your account page at any time.
- Correction — contact us to correct inaccurate account or enquiry information.
- Deletion — contact us to delete your account. Enquiry history is preserved with the account link removed.
- Opt-out — you can sign out at any time; saved trips are cleared from your browser.
6. Cookies
Pana.ph uses a single httpOnly session cookie (pana_session) for authenticated users and a separate cookie (pana_admin) for admin sessions. No tracking, analytics or advertising cookies are set. You can clear cookies at any time through your browser settings.
7. Changes to this policy
We may update this policy as the marketplace grows. Material changes will be announced on the site. Continued use after changes take effect constitutes acceptance.
8. Contact
Questions about your privacy? Contact us — we take your data seriously.