Privacy Policy

1. How We Collect and Use Information

Information you provide us directly. When you register for a Shrtlst account, we collect your name, email address, postal code, and a password. You must be at least 18 years of age to register. Once registered, you may provide additional optional information through your account settings, including your date of birth, home city, and updated postal code. We use this information to operate and maintain your account, facilitate Services on your behalf, and communicate with you about your account.

Payment information. If you purchase a paid membership or make a booking through the Services, payment details are passed through to the applicable payment processor or Third-Party Booking Provider to complete the transaction. Shrtlst does not store or have visibility into your credit card or payment information.

Communications. We send two categories of email: (a) transactional and service emails — such as booking confirmations, account notices, billing reminders, policy updates, and security alerts — which are necessary for the operation of the Services and cannot be opted out of; and (b) marketing emails — such as promotions, curated travel content, and member offers — which you may opt out of at any time via the unsubscribe link in any marketing email or through your account settings. Opting out of marketing emails does not affect transactional or service communications.

Trip planning and concierge communications. If you engage with Trip Planning Services, we collect the information you share with our team in the course of those interactions — such as travel dates, destination preferences, group size, and special requests. This information is used solely to deliver your requested services and is not used for advertising purposes.

Information collected automatically. When you visit or use the Services, we automatically collect certain usage information, including:

• Log data — IP address, browser type, referring and exit pages, pages viewed, and timestamps
• Device data — device type, operating system, and unique device identifiers
• Cookies and similar technologies — small files placed on your device that help us recognize you, maintain your session, and understand how the Services are used. You may set your browser to refuse cookies, though some features of the Services may not function properly if you do
• Analytics data — we use third-party analytics tools to measure traffic and usage trends for the purpose of improving the Services

We use automatically collected information to operate and improve the Services, personalize your experience, monitor performance, and diagnose technical issues.

Information from third parties. If you register or log in using a third-party authentication service (such as Google), we may receive basic profile information from that provider — such as your name and email address — as permitted by your settings with that provider. You should review your privacy settings on any third-party service before connecting it to Shrtlst.

2. Sharing of Your Information

We do not sell your personal information. We may share your information only in the circumstances described below.

Service Providers. We share information with Third-Party Booking Providers, Member Benefit Partners, and other vendors and service providers that perform functions on our behalf — such as payment processing, analytics, and customer support tools. These parties receive only the information necessary to perform their function and may not use it for their own independent purposes.

Booking facilitation. When you make a booking through the Services, the information necessary to complete that reservation — such as your name and contact details — is passed through to the applicable Third-Party Booking Provider. Shrtlst does not have visibility into the full downstream booking chain and does not store your payment information. The applicable booking platform and accommodation provider govern how your data is handled once transmitted.

Trip Planning Services. Where you have engaged Trip Planning Services, your travel preferences and related information shared with your Shrtlst Ambassador may be shared with relevant Service Providers to the extent necessary to fulfill your requested itinerary or booking.

Business transfers. If Shrtlst is involved in a merger, acquisition, sale of assets, financing, or similar transaction, your information may be transferred as part of that transaction. We will notify you via email or a prominent notice on the Services if such a transfer occurs and your information becomes subject to a different privacy policy.

Legal compliance and protection. We may disclose your information if we have a good faith belief that doing so is necessary to: (i) comply with applicable law, regulation, legal process, or governmental request, including to meet national security or law enforcement requirements; (ii) enforce our Terms of Use; (iii) protect the rights, property, or safety of Shrtlst, our Members, or the public; or (iv) detect, investigate, or prevent fraud or security issues.

With your consent. We may share your information with third parties for purposes not described in this Privacy Policy where we have obtained your express consent to do so.

Aggregated or de-identified data. We may share information that has been aggregated or de-identified such that it cannot reasonably be used to identify you, for any purpose, without restriction.

3. How We Store and Protect Your Information

Storage and processing. Your information is collected and processed in the United States. If you are located outside the United States — including in the European Union or United Kingdom — please be aware that your information will be transferred to, stored, and processed in the United States or other countries where Shrtlst or its service providers maintain facilities. By using the Services, you consent to this transfer and processing. Where required by applicable law, we take steps to ensure that appropriate safeguards are in place for any such transfers.

Security measures. Shrtlst uses commercially reasonable technical, administrative, and physical safeguards to protect your information against unauthorized access, alteration, disclosure, or destruction. We take reasonable steps to verify your identity before granting access to your account. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for notifying us promptly at hello@shrtlst.com if you suspect any unauthorized access to your account.

Data retention. We retain your personal information for as long as your account is active or as needed to provide you with the Services. Following termination or deactivation of your account, we may retain your information for a commercially reasonable period for backup, audit, and legal compliance purposes. We may retain anonymized or aggregated data derived from your information indefinitely. Upon a verified request to delete your account, we will delete your personal information promptly, subject to our right to retain information where necessary to comply with legal obligations, resolve disputes, or enforce our agreements.

Breach notification. In the event of a security breach that compromises your personal information, Shrtlst will take reasonable steps to investigate and, where required by applicable law, notify affected individuals and relevant authorities in accordance with applicable breach notification requirements.

4. Your Choices About Your Information

Account information. You may review and update your account information at any time by logging into your account and visiting your account settings. If you wish to delete your account entirely, you may do so through your account settings. Upon receipt of a verified deletion request, we will delete your personal information as described in Section 3 above.

Marketing communications. You may opt out of marketing emails at any time by clicking the unsubscribe link in any marketing email or by updating your preferences in your account settings. We will process opt-out requests promptly. As noted in Section 1, you may not opt out of transactional and service emails, as these are necessary for the operation of the Services.

Cookies. You may control cookie preferences through your browser settings. Most browsers allow you to refuse cookies, delete existing cookies, or alert you when cookies are being set. Please note that disabling cookies may affect the functionality of certain features of the Services. For more information about cookies and how to manage them, visit www.allaboutcookies.org.

Online advertising. We may permit third-party advertising and analytics networks to collect information about your use of the Services over time through cookies and similar technologies for the purpose of displaying relevant advertisements on other websites and apps. To learn more about interest-based advertising and your opt-out options, visit the Network Advertising Initiative at https://www.networkadvertising.org or the Digital Advertising Alliance at https://www.aboutads.info. If you access the Services on a mobile device, you may not be able to control all tracking technologies through browser settings; please refer to your device’s settings for available options.

Do Not Track. Some browsers offer a “Do Not Track” setting. The Services do not currently respond to Do Not Track signals, as there is no industry-standard approach to honoring such signals at this time.

Access and correction. You may access and correct your personal information through your account settings at any time. If you have questions about accessing, reviewing, or correcting your information and cannot do so through your account settings, please contact us at hello@shrtlst.com.

5. Children’s Privacy

The Services are intended for adults only. You must be at least 18 years of age to register for a Shrtlst account, as set forth in our Terms of Use. Shrtlst does not knowingly collect personal information from anyone under the age of 18. If we learn that we have inadvertently collected personal information from a person under the age of 18, we will delete that information as quickly as possible. If you believe we may have collected information from or about a minor, please contact us at hello@shrtlst.com.

Notwithstanding the foregoing, Shrtlst also complies with the Children’s Online Privacy Protection Act (COPPA) with respect to children under the age of 13 and does not knowingly collect personal information from children under 13 under any circumstances.

6. EU and UK Privacy Rights (GDPR)

This section applies to Members and Users located in the European Union, European Economic Area, or United Kingdom (collectively, “EU/UK Users”). Shrtlst processes personal data of EU/UK Users in accordance with the EU General Data Protection Regulation (GDPR) and, where applicable, the UK GDPR.

Legal basis for processing. We process your personal data on the following legal bases:

• Performance of a contract — processing necessary to provide you with the Services you have enrolled in, including account management, booking facilitation, and member communications
• Legitimate interests — processing necessary for our legitimate business interests, such as improving the Services, fraud prevention, and security, where those interests are not overridden by your rights
• Legal obligation — processing necessary to comply with applicable laws and regulations
• Consent — where we rely on your consent, such as for marketing communications or for your agreement to immediate access and waiver of the statutory cooling-off period at enrollment, you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal

Your rights. As an EU/UK User, you have the following rights with respect to your personal data, subject to applicable limitations:

• Right of access — the right to request a copy of the personal data we hold about you
• Right to rectification — the right to request correction of inaccurate or incomplete personal data
• Right to erasure — the right to request deletion of your personal data in certain circumstances
• Right to restriction — the right to request that we restrict processing of your personal data in certain circumstances
• Right to data portability — the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller
• Right to object — the right to object to processing based on legitimate interests or for direct marketing purposes
• Right to withdraw consent — where processing is based on consent, the right to withdraw that consent at any time

To exercise any of these rights, please contact us at hello@shrtlst.com. We will respond to verified requests within the timeframe required by applicable law. We may need to verify your identity before processing your request.

International transfers. As described in Section 3, your personal data may be transferred to and processed in the United States, which may not provide the same level of data protection as your home jurisdiction. Where required, we rely on appropriate safeguards for such transfers, including standard contractual clauses approved by the European Commission.

Complaints. If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with your local supervisory authority. In the UK, this is the Information Commissioner’s Office (ICO) at https://ico.org.uk. In the EU, you may contact the supervisory authority in your country of residence.

7. Additional California Privacy Disclosures

Shrtlst does business with consumers in the State of California and complies with the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). Additional disclosures required under California law — including a description of the categories of personal information we collect, your California privacy rights, and how to exercise them — are available at https://shrtlst.com/privacy/ccpa.

8. Links to Other Websites and Services

The Services may contain links to third-party websites, services, or content that are not owned or controlled by Shrtlst. This Privacy Policy applies only to information collected through the Services. Shrtlst does not endorse and is not responsible for the privacy practices, content, or security of any third-party website or service. When you leave the Services via a link, we encourage you to review the privacy policy of the destination site. Your use of any third-party website or service is governed solely by that party’s own terms and privacy policy.

9. How to Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the manner in which we handle your personal information, please contact us at:

Unbiased Insight, Inc. d/b/a Shrtlst
hello@shrtlst.com

For EU/UK privacy-related requests, including requests to exercise your rights under the GDPR, please contact us at the same address and include “Privacy Request” in the subject line.

10. Changes to This Privacy Policy

Shrtlst may update this Privacy Policy from time to time to reflect changes in our business, practices, or applicable law. When we make material changes, we will notify you by updating the “Last Modified” date at the top of this policy and, where appropriate, by sending you an email notice or posting a prominent notice on the Services. We encourage you to review this policy periodically. Your continued use of the Services after any changes take effect constitutes your acceptance of the updated policy.