This Privacy Policy explains how LadyMayla collects, uses, stores, and protects personal information when you use our website and private travel portal.
Last updated: August 2026
1. Introduction
LadyMayla (“we”, “us”, “our”) provides a private, invitation-based digital travel experience for group journeys to São Tomé and Príncipe. We are committed to handling personal information carefully, collecting only what we need to operate the waiting list and private portal, and protecting that information with appropriate technical and organisational measures.
This Privacy Policy should be read together with any communications you receive from us and any additional notices provided at the point of collection. It is not legal advice. If you have questions about how the law applies to you, seek independent advice.
2. Who we are
LadyMayla is operated by LadyMayla and authorised staff acting on her behalf for the planning and communication of private group travel experiences. For privacy requests related to this platform, please use the contact options in Section 16.
3. Scope
This policy applies to personal information processed through:
- the public LadyMayla website;
- the waiting list registration and email verification flow;
- traveller magic-link authentication;
- the private traveller portal (itineraries, flights, visa guidance, FAQ, assistant, and support);
- admin tools used by authorised staff to manage travellers and content.
It does not cover third-party websites we may link to (for example external flight booking providers). Those services have their own privacy practices.
4. Information we collect
4.1 Identity and contact data
First name, last name, email address, and optional phone number when you join the waiting list or update your profile.
4.2 Travel preference data
Country of residence / departure country, preferred departure city, passport nationality, passport validity confirmation (where provided), preferred journey, and number of travellers.
4.3 Account and access data
Waiting list status, email verification status, portal access status, invitation and activation timestamps, and session records needed to keep you signed in securely.
4.4 Communications
Support messages you send to LadyMayla, and travel assistant conversation content when you use the in-portal assistant.
4.5 Technical and security data
Limited technical information such as IP address (for rate limiting and abuse prevention), user agent, authentication token metadata, cookie consent preference stored in your browser, and security/audit events related to account actions.
4.6 What we do not intentionally collect
We do not ask for payment card details through this platform. We do not use privacy-by-obscurity as our access model: private trip content requires authorised portal access.
5. How we collect information
- Directly from you, when you submit the waiting list form, sign in, update travel preferences, ask the assistant, or contact support.
- Automatically, when the service creates secure sessions, verifies email or magic links, applies rate limits, or records operational audit events.
- From authorised staff actions, when LadyMayla or admins approve, invite, or revoke traveller access as part of operating the private journey.
6. How we use information
We use personal information to:
- register and manage waiting list interest;
- verify email addresses and send transactional messages (confirmation, invitations, magic links);
- grant, manage, and revoke private portal access;
- personalise visa guidance and flight-route suggestions based on the details you provide;
- show verified trip and travel information to authorised travellers;
- respond to support requests and improve the quality of assistance;
- protect the platform against abuse, fraud, and unauthorised access;
- comply with legal obligations and maintain necessary operational records;
- understand basic product usage where you have accepted optional analytics cookies.
We do not sell traveller personal information. We do not use your waiting list or portal data for unrelated third-party advertising networks.
7. Legal bases for processing
Depending on your location and applicable law, we rely on one or more of the following bases:
- Contract / pre-contract steps, to manage your waiting list registration, invitations, and portal access related to travel planning.
- Legitimate interests, to secure the service, prevent abuse, improve reliability, and communicate service-related updates, balanced against your rights and expectations.
- Consent, where required for optional cookies/analytics, or where you voluntarily provide optional details.
- Legal obligation, where we must retain or disclose information to meet applicable legal requirements.
8. Cookies and similar technologies
8.1 Essential cookies
Essential cookies are required for the service to work securely. In particular, we use an httpOnly session cookie after successful magic-link or admin authentication so authorised users can access protected areas. These cookies are necessary for security and are not used for advertising.
8.2 Preference storage
Your cookie banner choice is stored locally in your browser so we can remember whether you accepted optional cookies or essential-only use.
8.3 Optional analytics
If you select “Accept all”, we may use light analytics to understand how the public site and portal are used and to improve the experience. If you select “Essential only”, we will not use optional analytics cookies for that purpose.
8.4 Managing cookies
You can clear cookies and local storage in your browser settings at any time. Doing so may sign you out of the portal and may show the cookie banner again.
9. Sharing and processors
We share personal information only as needed to operate LadyMayla, including with trusted service providers acting on our instructions, such as:
- hosting and infrastructure providers that run the application and database;
- email delivery providers used for verification, invitations, and magic links;
- optional AI providers used to power the travel assistant when that feature is enabled (conversation content may be processed to generate a response);
- authorised staff who administer travellers, content, and support.
We may also disclose information if required by law, to protect rights and safety, or in connection with a legitimate business transfer where appropriate safeguards continue to apply.
External booking providers linked from the portal process any booking data under their own terms and privacy policies.
10. Retention
We retain personal information only for as long as needed for the purposes described in this policy, including waiting list management, active travel planning, support, security, and legal requirements.
When you request account deletion and that request is completed, we anonymise or remove personal profile fields, support message content, and assistant conversation history associated with your account, and we revoke portal access. Limited operational records (for example security audit logs) may be retained where necessary to protect the integrity of the service.
11. Security
We apply layered safeguards appropriate to a private travel platform, including:
- access control for portal and admin areas;
- hashed one-time tokens for email verification and magic links;
- httpOnly session cookies with secure attributes in production;
- password hashing for admin accounts;
- rate limiting on sensitive actions;
- security-focused HTTP headers;
- session revocation when access is withdrawn or accounts are deleted.
No online service can guarantee absolute security. Please protect your email inbox, as magic links are sent there, and contact us promptly if you believe your access has been compromised.
12. International transfers
LadyMayla serves travellers internationally and may use infrastructure or processors located in different countries. Where personal information is transferred across borders, we take steps designed to ensure an appropriate level of protection consistent with this policy and applicable law.
13. Your rights
Subject to applicable law, you may have rights to access, correct, update, restrict, or delete personal information, to object to certain processing, and to withdraw consent where processing is consent-based.
Practical ways to exercise these rights:
- update travel preferences in the private portal after you are invited;
- request deletion from portal privacy once you have access;
- contact us through portal support or the channels in Section 16.
We may need to verify your identity before fulfilling a request. If you are not yet invited to the portal, email us using the address you registered on the waiting list so we can locate your record.
14. Children
LadyMayla is intended for adults organising travel. We do not knowingly collect personal information from children for independent portal accounts. If you believe a child has provided personal information, contact us and we will take appropriate steps.
15. Changes to this policy
We may update this Privacy Policy from time to time to reflect product, legal, or operational changes. The “Last updated” date at the top will change when we do. We encourage you to review this page periodically. Continued use of the service after an update means you acknowledge the revised policy.
16. Contact
For privacy questions, access requests, or concerns about how LadyMayla handles personal information:
- invited travellers: use Speak with LadyMayla in the portal, or submit a deletion request via portal privacy;
- waiting list members: reply to a LadyMayla transactional email using the same address you registered, or join again only if you still need access and then contact support after invitation.
Join the waiting list at waiting list if you do not yet have portal access.