Privacy Policy

1. How We Collect and Use Information

Information you provide us directly. When you register for a Shrtlst account, we collect your name, email address, postal code, and a password. You must be at least 18 years of age to register. Once registered, you may provide additional optional information through your account settings, including your date of birth, home city, and updated postal code. We use this information to operate and maintain your account, facilitate Services on your behalf, show you events and content relevant to your area, and communicate with you about your account.

Membership applications. If you apply for Privé membership, we collect the information you provide in your application, including your answers to questions about your travel habits and preferences. We use this information to review your application and, if you are approved, to tailor the Services to you.

Travel profile and trip planning information. If your Privé membership is approved, we ask you to complete an onboarding form, and if you engage Trip Planning Services at any membership tier, we collect the information you share with our team, so that we can plan, book, and personalize your travel. Depending on what you choose to provide, this may include:

• Contact details, such as your name, home address, phone number, and email address
• The names of your spouse or partner and children
• Important dates and celebrations, such as anniversaries and birthdays
• Your travel style and preferences, including your travel persona, preferred hotels and hotel brands, hotel non-negotiables, preferred airlines, departure airports, cabin, and seat
• Typical spending ranges, such as budget per hotel stay and dining spend
• Hotel and airline loyalty program names, membership numbers, and status
• Known traveler numbers, such as TSA PreCheck, Global Entry, or NEXUS
• Accessibility and sensory considerations, and dining preferences, including any dietary needs
• Lifestyle, culture, and wellness interests, and clubs and associations
• Service preferences and other details you ask us to remember
• Trip-specific details, such as travel dates, destinations, budget, travelers, and special requests
• For specific bookings, traveler details required by airlines, hotels, or government authorities, such as full legal name, date of birth, gender, and passport information

This information is stored in a travel profile, separate from your account settings, and used solely to provide and personalize the Trip Planning and Privé services you request. It is not used for advertising purposes.

Information about other people. When you provide information about your spouse or partner, children, or other travel companions, including information about minors, you represent that you are authorized to share it with us. We use that information only to plan and book travel that includes them, and we share it only with the providers needed to fulfill those bookings.

Sensitive information. Some information we collect is considered sensitive under certain privacy laws, including known traveler numbers and passport details, accessibility or health information, information that may reveal religious beliefs or union membership (for example, through clubs and associations you choose to list), and precise location information if you enable location services in the App. We use sensitive information only to provide the Services you request, such as completing bookings, arranging accommodations, and showing you nearby content, and we share it only with the providers needed to fulfill your requests. We do not use sensitive information to infer characteristics about you, and we do not use it for advertising.

Call recordings. Calls with our team, such as onboarding and Trip Discovery calls, may be recorded. You will be notified at the start of any recorded call. We use recordings for quality, training, and record-keeping purposes. Payment card information is never collected on a recorded call.

Payment information. Membership purchases made on the Shrtlst website are processed by our third-party payment processor. Membership purchases made in the App are processed by Apple or Google under their terms, and we receive only the information needed to confirm your purchase and membership status, not your payment details. Payment for travel bookings is collected through a secure payment link or, in limited cases, by phone on a call that is not recorded, and is entered directly into the secure payment system of Shrtlst’s travel agency partner. With your authorization, your payment card may be kept on file in that system, where Shrtlst’s team can use it through our account to complete bookings you approve. Payment card information is stored only in our travel agency partner’s secure system; Shrtlst does not store or retain your payment card information in its own systems. If you receive cash back payouts, your bank account and identity verification details are collected directly by our payment processor, and Shrtlst receives only the information needed to confirm the status of your payouts.

Communications. We communicate with you by email and, depending on the information and permissions you provide, by text message and push notification.

Email. We send two categories of email: (a) transactional and service emails, such as booking confirmations, account notices, billing and renewal reminders, policy updates, and security alerts, which are necessary for the operation of the Services and cannot be opted out of; and (b) marketing emails, such as promotions, curated travel content, and member offers, which you may opt out of at any time via the unsubscribe link in any marketing email or through your account settings. Opting out of marketing emails does not affect transactional or service communications.

Text messages. If you provide a mobile phone number, we may send text messages related to your account, membership, bookings, Trip Planning Services, and member support. You may opt out at any time by replying STOP. We send marketing text messages only if you have separately opted in to receive them.

Push notifications. If you use the App and allow notifications, we may send push notifications related to your account, bookings, Trip Planning Services, and member support. We send promotional push notifications only if you have separately opted in to receive them in the App. You can turn off push notifications through your device settings and opt out of promotional push notifications through the App’s notification settings.

Information collected automatically. When you visit or use the Services, including the App, we automatically collect certain usage information, including:

• Log data, such as IP address, browser type, referring and exit pages, pages or screens viewed, and timestamps
• Device data, such as device type, operating system, app version, and unique device identifiers
• Push notification tokens, if you allow notifications in the App, which we use to deliver notifications to your device
• Location information, if you enable location services for the App, which we use to show you curated venues and content near you. You can turn off location access at any time in your device settings; some features may not work without it
• Cookies and similar technologies, which are small files placed on your device that help us recognize you, maintain your session, and understand how the Services are used. You may set your browser to refuse cookies, though some features of the Services may not function properly if you do
• Analytics data, which we collect on our website and in the App using third-party analytics and diagnostic tools, including information about how you interact with the Services, features used, performance, and crash reports, to measure usage trends and improve the Services

We use automatically collected information to operate and improve the Services, personalize your experience, monitor performance, and diagnose technical issues.

Information from third parties. We may receive information about you from third parties, including:

• Authentication services: If you register or log in using a third-party authentication service (such as Google or Apple), we may receive basic profile information, such as your name and email address, as permitted by your settings with that provider. If you use Sign in with Apple and choose to hide your email address, we receive a private relay address instead of your actual email. You should review your privacy settings on any third-party service before connecting it to Shrtlst.
• App Stores: If you purchase a membership in the App, Apple or Google provides us with information needed to confirm your purchase and membership status.
• Travel agency and booking providers: We receive booking details, confirmations, and stay information from our travel agency partner, hotels, and other providers, including information used to verify completed stays for cash back.
• Payment processors: We receive confirmation of payments, payouts, and account verification status, but not your full payment card or bank account details.

2. Sharing of Your Information

We do not sell your personal information for money. We may share your information in the circumstances described below, including with advertising partners as described in Section 4, which may be considered a “sale” or “sharing” of personal information under certain state privacy laws.

Service providers. We share information with vendors that perform functions on our behalf, such as hosting, customer relationship management, email, text message, and push notification delivery, customer support, and analytics. These vendors receive only the information necessary to perform their function and may not use it for their own independent purposes. Payment processors and App Stores process payment and purchase information under their own terms and privacy policies.

Booking facilitation and providers. When you make a booking through the Services, or when our team books travel on your behalf, we share the information necessary to complete the booking with our travel agency partner, Third-Party Booking Providers, and the applicable hotels, airlines, and other providers. Depending on the booking, this may include traveler names and contact details, travel dates, loyalty program and known traveler numbers, passport details, and any accessibility, dietary, or special requests. Payment card information is handled as described in Section 1. When you claim a benefit from a Member Benefit Partner, we share the information needed to provide that benefit, such as your name and contact information. Shrtlst does not have visibility into the full downstream booking chain. Once transmitted, your information is handled under the privacy policies of the applicable travel agency, booking platform, provider, or partner.

Business transfers. If Shrtlst is involved in a merger, acquisition, sale of assets, financing, or similar transaction, your information may be transferred as part of that transaction. We will notify you via email or a prominent notice on the Services if such a transfer occurs and your information becomes subject to a different privacy policy.

Legal compliance and protection. We may disclose your information if we have a good faith belief that doing so is necessary to: (i) comply with applicable law, regulation, legal process, or governmental request, including to meet national security or law enforcement requirements; (ii) enforce our Terms of Use; (iii) protect the rights, property, or safety of Shrtlst, our Members, or the public; or (iv) detect, investigate, or prevent fraud or security issues.

With your consent. We may share your information with third parties for purposes not described in this Privacy Policy where we have obtained your express consent to do so.

Aggregated or de-identified data. We may share information that has been aggregated or de-identified such that it cannot reasonably be used to identify you, for any purpose, without restriction.

3. How We Store and Protect Your Information

Storage and processing. Your information is collected and processed in the United States. If you are located outside the United States — including in the European Union or United Kingdom — please be aware that your information will be transferred to, stored, and processed in the United States or other countries where Shrtlst or its service providers maintain facilities. By using the Services, you consent to this transfer and processing. Where required by applicable law, we take steps to ensure that appropriate safeguards are in place for any such transfers.

Security measures. Shrtlst uses commercially reasonable technical, administrative, and physical safeguards to protect your information against unauthorized access, alteration, disclosure, or destruction. We take reasonable steps to verify your identity before granting access to your account. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for notifying us promptly at hello@shrtlst.com if you suspect any unauthorized access to your account.

Data retention. We retain personal information only as long as reasonably necessary for the purposes described in this Privacy Policy, using the following periods:

• Account information: for as long as your account is active, and up to 12 months after your account is closed
• Travel profile and trip planning information: for as long as your membership is active, and up to 24 months after it ends, so that your preferences are available if you return
• Privé application information for applications that are not approved: up to 12 months after the decision
• Call recordings: up to 12 months after the call
• Payment, booking, cash back, and other transaction records: up to 7 years, as needed for tax, accounting, and legal compliance

We may retain information longer where required by law or necessary to resolve disputes or enforce our agreements. We may retain anonymized or aggregated data that cannot reasonably be used to identify you indefinitely. Upon a verified request to delete your account, we will delete your personal information promptly, except for information we are required or permitted by law to retain.

Breach notification. In the event of a security breach that compromises your personal information, Shrtlst will take reasonable steps to investigate and, where required by applicable law, notify affected individuals and relevant authorities in accordance with applicable breach notification requirements.

4. Your Choices About Your Information

Account information. You may review and update your account information at any time through your account settings on the website or in the App. To review, update, or delete your travel profile information, contact us at hello@shrtlst.com. You may delete your account entirely through your account settings on the website or in the App. Deleting your account does not cancel a membership purchased through an App Store; you must cancel that membership through your App Store account settings. Upon receipt of a verified deletion request, we will delete your personal information as described in Section 3 above.

Marketing communications. You may opt out of marketing emails at any time by clicking the unsubscribe link in any marketing email or by updating your preferences in your account settings. If you have opted in to marketing text messages, you may opt out by replying STOP. If you have opted in to promotional push notifications, you may opt out through the App’s notification settings or your device settings. We will process opt-out requests promptly. As noted in Section 1, you may not opt out of transactional and service emails, as these are necessary for the operation of the Services.

Cookies. You may control cookie preferences through your browser settings. Most browsers allow you to refuse cookies, delete existing cookies, or alert you when cookies are being set. Please note that disabling cookies may affect the functionality of certain features of the Services. For more information about cookies and how to manage them, visit www.allaboutcookies.org.

Online advertising. We work with advertising partners, such as Meta and Google, to show ads for Shrtlst on other websites, apps, and social media platforms, and to measure how well those ads perform. These partners may collect information about your use of the Services through cookies, pixels, software development kits (SDKs), and similar technologies, including pages visited, actions taken (such as starting an application or completing a purchase), and device and browser information. We may also share hashed (encoded) contact information, such as your email address, with advertising partners so they can show our ads to you or to people with similar interests, or exclude you from ads. If the App uses advertising tracking, we do so only with your permission where required by your device’s operating system.

Under certain state privacy laws, this activity may be considered “sharing” personal information for cross-context behavioral advertising, “targeted advertising,” or a “sale.” You may opt out at any time by using the “Your Privacy Choices” link in the footer of our website or in the App’s settings, or by enabling a Global Privacy Control signal in your browser, as described below. You may also learn more about interest-based advertising and your choices at the Network Advertising Initiative (https://www.networkadvertising.org) and the Digital Advertising Alliance (https://www.aboutads.info).

We never use your travel profile information, sensitive information, or trip planning details for advertising.

Global Privacy Control and Do Not Track. Our website recognizes Global Privacy Control (GPC) signals. If your browser sends a GPC signal, we will treat it as a request to opt out of the sale or sharing of your personal information and targeted advertising for that browser, and, if you are logged in, for your account. Some browsers also offer a “Do Not Track” setting; because there is no industry standard for responding to Do Not Track signals, the Services do not currently respond to them.

Access and correction. You may access and correct your account information through your account settings on the website or in the App at any time. To access or correct your travel profile information, or if you cannot access or correct your information through your account settings, contact us at hello@shrtlst.com.

Location and notifications. You can turn off location access and push notifications for the App at any time through your device settings. Some features, such as showing venues near you, may not work without location access.

5. Children’s Privacy

The Services are intended for adults only. You must be at least 18 years of age to register for a Shrtlst account or use the App, as set forth in our Terms of Use. Shrtlst does not knowingly collect personal information directly from anyone under the age of 18, and we do not direct the Services to children.

Members may provide information about their minor children, such as names and traveler details, so that we can plan and book travel that includes them. We collect this information only from the parent or authorized adult member, use it only to plan and book that travel, and share it only with the providers needed to fulfill those bookings. We do not use information about minors for marketing or advertising.

If we learn that we have collected personal information directly from a person under the age of 18, we will delete that information as quickly as possible. If you believe we may have done so, please contact us at hello@shrtlst.com.

6. EU and UK Privacy Rights (GDPR)

This section applies to Members and Users located in the European Union, European Economic Area, or United Kingdom (collectively, “EU/UK Users”). Shrtlst processes personal data of EU/UK Users in accordance with the EU General Data Protection Regulation (GDPR) and, where applicable, the UK GDPR.

Legal basis for processing. We process your personal data on the following legal bases:

• Performance of a contract: processing necessary to provide you with the Services you have enrolled in, including account management, booking facilitation, Trip Planning Services, cash back payouts, and member communications
• Legitimate interests: processing necessary for our legitimate business interests, such as improving the Services, recording calls for quality and training, fraud prevention, and security, where those interests are not overridden by your rights
• Legal obligation: processing necessary to comply with applicable laws and regulations, including tax and accounting requirements
• Consent: where we rely on your consent, such as for marketing emails and text messages, promotional push notifications, location access in the App, advertising cookies and tracking, and your agreement to immediate access and waiver of the statutory cooling-off period at enrollment. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal

Special categories of data. Some information you may choose to provide, such as accessibility or health information, or clubs and associations that reveal religious beliefs or trade union membership, is considered a special category of personal data under the GDPR. We process special category data only with your explicit consent, which you give when you provide it for travel planning purposes, and only to plan, book, and personalize your travel. You may withdraw your consent at any time by contacting us at hello@shrtlst.com, and we will delete that information from your travel profile.

Your rights. As an EU/UK User, you have the following rights with respect to your personal data, subject to applicable limitations:

• Right of access: the right to request a copy of the personal data we hold about you
• Right to rectification: the right to request correction of inaccurate or incomplete personal data
• Right to erasure: the right to request deletion of your personal data in certain circumstances
• Right to restriction: the right to request that we restrict processing of your personal data in certain circumstances
• Right to data portability: the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller
• Right to object: the right to object to processing based on legitimate interests or for direct marketing purposes
• Right to withdraw consent: where processing is based on consent, the right to withdraw that consent at any time

To exercise any of these rights, please contact us at hello@shrtlst.com. We will respond to verified requests within the timeframe required by applicable law. We may need to verify your identity before processing your request.

International transfers. As described in Section 3, your personal data may be transferred to and processed in the United States, which may not provide the same level of data protection as your home jurisdiction. Where required, we rely on appropriate safeguards for such transfers, including standard contractual clauses approved by the European Commission.

Complaints. If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with your local supervisory authority. In the UK, this is the Information Commissioner’s Office (ICO) at https://ico.org.uk. In the EU, you may contact the supervisory authority in your country of residence.

7. Additional California Privacy Disclosures

Shrtlst does business with consumers in the State of California and complies with the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). Additional disclosures required under California law — including a description of the categories of personal information we collect, your California privacy rights, and how to exercise them — are available at https://shrtlst.com/privacy/ccpa.

8. Links to Other Websites and Services

The Services may contain links to third-party websites, services, or content that are not owned or controlled by Shrtlst. This Privacy Policy applies only to information collected through the Services. Shrtlst does not endorse and is not responsible for the privacy practices, content, or security of any third-party website or service. When you leave the Services via a link, we encourage you to review the privacy policy of the destination site. Your use of any third-party website or service is governed solely by that party’s own terms and privacy policy.

9. How to Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the manner in which we handle your personal information, please contact us at: Unbiased Insight, Inc. d/b/a Shrtlst, hello@shrtlst.com.

For EU/UK privacy-related requests, including requests to exercise your rights under the GDPR, please contact us at the same address and include “Privacy Request” in the subject line.

10. Changes to This Privacy Policy

Shrtlst may update this Privacy Policy from time to time to reflect changes in our business, practices, or applicable law. When we make material changes, we will update the “Last Modified” date at the top of this policy and may notify you by email or through a prominent notice on the Services or in the App. Where applicable law requires us to notify you of changes, we will do so. If we make a material change to how we use personal information we have already collected, we will obtain your consent where required by law. We encourage you to review this policy periodically. Your continued use of the Services after changes take effect constitutes your acceptance of the updated policy.