Last updated: 2026-10-27

This Privacy Policy describes how Nomad Cruise ("Nomad Cruise," "we," "us") collects, uses, and shares your personal information when you use our mobile applications for iOS and Android, our websites at nomadcruise.com and app.nomadcruise.com, our newsletter, and our cruises, trips and event services (collectively, the "Service").

The controller is DN Ventures, Dios Street 29, 7562 Teresfanou, Cyprus. For privacy questions, contact us at info@nomadcruise.com.

1. Information We Collect

1.1 Information you provide

  • Account information — first name, last name, e-mail address, password (hashed), and optional profile photo when you sign up. We support sign-up via Apple, Google, or an e-mail link or code.
  • Profile information — bio, company, tagline, languages, skills, social media handles, things you are looking for (e.g. mentor, collaboration), and what you are open to (e.g. coffee chats).
  • Booking a cruise or trip — the cabin and occupancy you choose, your phone number, date and place of birth, nationality, gender, T-shirt size, name for your name tag, bed and sleeping preferences, how you heard of us, billing address and optional VAT ID, and the amounts paid. If you provide them: passport details (number, issuing country, expiry date) and an emergency contact. Card details are entered into Stripe's payment form and never reach our servers.
  • Cabin matching — if you book a shared cabin and look for a cabin mate, the profile details you choose to show to other guests looking for a cabin mate (e.g. name, photo, age, nationality, sleeping preferences), and the requests you send or receive.
  • Location — your city / country (entered manually or detected from device GPS at city-level accuracy, with your permission). You choose whether your map position shows your exact spot or just your city, and who can see it. We also store optional travel plans (cities + dates you intend to visit).
  • Community content — posts, stories, comments, votes, questions, meetup proposals, and direct messages you create.
  • Voice messages — short audio recordings you record and send in direct messages or group chats, visible only to the recipients.
  • Photos and videos — photos and short videos you upload as profile picture, attach to posts, stories or messages, or upload to an event album. On media-team uploads we store your name and chosen public handle as photographer attribution.
  • Applications and forms — what you enter in our application forms (e.g. speaker, creator, affiliate, partner or sponsor applications) and event forms.
  • Newsletter — your e-mail address and name when you subscribe, and your confirmation (double opt-in). If you arrive through one of our ads or campaign links, we also store that link's campaign parameters (utm_source, utm_medium, utm_campaign) with your subscription.
  • Support & feedback — content of e-mails, in-app feedback, and any screenshots you attach.

1.2 Information we collect automatically

  • Device & usage — device model, operating system, app version, language, time zone, IP address (transient, used for security and locale), and basic interaction logs.
  • Website statistics — our own cookie-free statistics: a visit is counted with a one-way hash of IP address and browser that changes every day, so no visitor can be recognised across days. No cookies are set for this.
  • Push tokens — when you allow notifications, we store the Apple/Firebase push token to send you cruise updates and direct messages.
  • Crash & performance data — anonymized stack traces and breadcrumbs via Sentry to fix bugs.

1.3 What we do not collect

  • Our mobile apps contain no third-party advertising or analytics SDKs (no Facebook SDK, Google Analytics, AppsFlyer, Mixpanel, etc.).
  • On our website, advertising and analytics cookies of Meta and Google are used only if you agree in the cookie banner — see “Cookies and advertising measurement” in section 4. Without your consent, none of them are loaded.
  • We do not sell your personal information to anyone, ever.

1.4 Sensitive data — biometric, opt-in only

If you opt in to photo tagging, we generate and store a numerical face embedding derived from your profile picture and event photos, to suggest tags when event photos that may contain you are uploaded. This processing runs on our servers via our background-processing provider. Embeddings are stored in our EU-hosted database and never shared with third parties. Opting out at any time deletes the embedding. We ask for your explicit consent (GDPR Article 9) before this starts; you can use Nomad Cruise fully without opting in.

2. How We Use Your Information

  • To provide the Service — sign you in, show cruises and programs, process bookings, deliver messages, and show your profile to other participants of a cruise you have booked.
  • To organise your cruise — the passenger list (manifest) the cruise line needs for embarkation, cabin allocation and cabin matching, name tags and welcome packs, and contact in an emergency.
  • To send transactional e-mails — booking confirmations, invoices, payment reminders, login codes, and important account notifications.
  • To send our newsletter — only after you confirmed your subscription. Every newsletter carries an unsubscribe link.
  • To send push notifications — only those you have opted into.
  • To process payments — via Stripe, our payment processor. Stripe acts as an independent controller for the card data they collect.
  • To improve the Service — debug crashes, count visits without cookies, and prevent abuse.
  • To measure our advertising — only with your consent: to see which ads and campaigns bring people to Nomad Cruise, and to show our ads to people who have visited our website.
  • To meet legal obligations — tax records for bookings, lawful requests from authorities, and to enforce our Terms of Service.

3. Legal Bases (for users in the EU/UK)

  • Performance of contract — to deliver the Service and the cruise or trip you booked, including the passenger data the cruise line requires.
  • Legitimate interests — to operate the community, prevent abuse, secure the Service, count visits, and improve features.
  • Consent — for the newsletter, the advertising and analytics cookies on our website (Art. 6(1)(a) GDPR; for storing and reading information on your device, Art. 5(3) of the ePrivacy Directive), optional features like location, push notifications, access to photos and microphone, and the opt-in photo tagging. You can withdraw consent at any time.
  • Legal obligation — for tax-record retention and law-enforcement requests.

4. Who We Share Information With

The cruise line. For a cruise you booked, we pass the passenger details the cruise line requires for embarkation and port formalities (name, date and place of birth, nationality, gender and, where provided, passport details) to the operator of the ship. The cruise line processes them under its own privacy policy.

Other participants. Your profile is visible to other participants of the cruises you booked; in cabin matching, only the details you choose to show.

We share data with the following processors, all bound by data-protection agreements:

  • Supabase (database, auth, file storage) — hosting region: EU (Frankfurt).
  • Stripe (payment processing) — card payments, Apple Pay / Google Pay.
  • Apple Push Notification service (Apple Inc.) and Firebase Cloud Messaging (Google) — push notifications.
  • Resend (transactional e-mail) — booking confirmations, invoices, login codes.
  • MailerLite (newsletter) — to send the newsletter and booking-related updates to the groups you belong to.
  • Airtable (booking administration) — booking records of cruises administered there (Nomad Cruise 18 and earlier).
  • Sentry (crash & error reporting) — to fix bugs.
  • OpenStreetMap / Nominatim (place-name lookups) — only place names are sent, never your exact GPS coordinates.
  • Vercel (web hosting) — to serve the websites and the backoffice.
  • Trigger.dev (background jobs, including face-embedding processing for opted-in users) — hosting region: US, secured by Standard Contractual Clauses.

Embedded videos. Pages with a video embed it from YouTube in privacy-enhanced mode (youtube-nocookie.com). When the video comes into view, YouTube (Google) receives your IP address and browser information; YouTube's privacy policy applies.

Cookies and advertising measurement (website)

When you first visit our website, a banner asks whether we may use cookies to measure our advertising. If you decline, or do not answer, none of the services below are loaded and no cookies are set for them; the website works exactly the same. If you accept, we load:

  • Google Tag Manager, run server-side by Stape — a tag manager that loads the services below. It runs on our own subdomains (sgtm.nomadcruise.com, load.sgtm.nomadcruise.com) and is hosted by Stape (stape.io) as our processor, so the data passes through a server we control before it reaches Meta or Google.
  • Meta Pixel (Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland) — to measure which of our ads on Facebook and Instagram lead to a visit, a newsletter sign-up or an application, and to show our ads to people who have visited our website.
  • Google Analytics 4 and Google Ads conversion tracking (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) — to measure visits, and which of our Google ads lead to a sign-up or an application.

What is processed: the pages you visit, the page you came from, the time of your visit, your IP address, browser and device information, the click identifiers in the link of an ad (e.g. fbclid, gclid), and cookie identifiers. When you sign up for the newsletter or send an application, we report that event too; Meta receives the e-mail address and name you entered in hashed (pseudonymised) form, so it can match the sign-up to an ad click.

Cookies used (typical lifetimes): _fbp (Meta, 90 days), _ga and _ga_* (Google Analytics, up to 2 years), _gcl_au (Google Ads, 90 days), and an identifier set by Stape so these keep working in Safari. Your choice itself is stored in your browser's local storage.

You can change your choice at any time under Cookie settings at the bottom of every page of our website. Meta and Google also process this data under their own privacy policies (facebook.com/privacy/policy, policies.google.com/privacy).

We may also disclose information when required by law, court order, or to protect the rights, property, or safety of Nomad Cruise, our participants, or others.

5. International Transfers

Some of our processors (e.g. Stripe, Sentry, Vercel, MailerLite, Airtable, Trigger.dev) may store data outside the European Economic Area, including in the United States. Where this happens, transfers are protected by Standard Contractual Clauses approved by the European Commission or an adequacy decision. If you accept the advertising cookies on our website, Meta and Google may also process data in the United States; both are certified under the EU-U.S. Data Privacy Framework. Where Stape processes data outside the EEA, Standard Contractual Clauses apply. A cruise line may process passenger data in the countries its ships call at.

6. Your Rights

If you are in the EU/UK, you have the right to:

  • access the personal information we hold about you;
  • correct it, restrict its processing, or object to processing based on legitimate interests;
  • have it deleted — inside the app under You → Settings → Delete account, or by writing to info@nomadcruise.com;
  • receive a portable copy of your data in a machine-readable format;
  • withdraw a consent at any time, e.g. unsubscribe from the newsletter via the link in every e-mail, or change your cookie choice under “Cookie settings” at the bottom of every page of our website;
  • lodge a complaint with your national data-protection authority.

7. Account Deletion

You can delete your account at any time inside the app under You → Settings → Delete account. Deletion removes your profile, posts, messages, travel plans, and location history within 30 days. Booking history and invoices are retained for tax-law compliance (10 years in the EU). Deleting your account does not cancel a booking.

8. Data Retention

  • Account & profile data — until you delete your account.
  • Community content (posts, messages, comments) — until you delete your account or the content.
  • Passenger details for a cruise (passport, birth date and place, nationality, emergency contact) — as long as needed to run the cruise and handle its follow-up, then deleted; booking and invoice records stay for tax purposes.
  • Event photos — for the lifetime of the event album.
  • Face embeddings (opt-in photo tagging) — while the opt-in is active; deleted within 24 hours of opt-out or account deletion.
  • Newsletter subscription — until you unsubscribe.
  • Advertising and analytics cookies — the lifetimes listed in section 4; your cookie choice — until you change it or clear your browser's storage.
  • Booking and invoice records — 10 years (EU tax law).
  • Crash logs, security logs and e-mail logs — up to 90 days.

9. Security

We use TLS for all data in transit and AES-256 encryption at rest for our database and file storage. Card details are handled directly by Stripe and never reach our servers. Passport numbers are never sent by e-mail, never logged, never passed to our payment processor, and readable only by authorized staff. Access to production data is restricted by Row-Level Security and limited to authorized staff using two-factor authentication. Messages are not end-to-end encrypted: they are protected in transit, at rest, and by these access controls. No one on our team reads or monitors your private messages.

10. Children

The Service is intended for users aged 16 and older. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with information, contact us at info@nomadcruise.com and we will delete the account.

11. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by e-mail or in-app notice at least 14 days before they take effect. The "Last updated" date at the top reflects the most recent change.

12. Contact Us

If you have any questions, complaints, or requests regarding this Privacy Policy or your data, please contact us at:

DN Ventures
Dios Street 29, Teresfanou
7562, Cyprus
E-Mail: info@nomadcruise.com