1. Introduction

OnSeason ("we", "us", "our") operates onseason.ai and related services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services, including our AI website builder, booking engine, and distribution network (the "Services"). We are committed to protecting your personal data in line with the EU General Data Protection Regulation (GDPR) and other applicable laws.

2. Data Controller

The data controller responsible for your personal data is OnSeason. You can contact us at privacy@onseason.ai (or hello@onseason.ai) for any privacy-related questions or to exercise your rights.

3. Data We Collect

We may collect:

Account and identity data: name, email address, company name, and role when you register or contact us.
Usage data: how you use our website and Services (e.g. pages visited, actions taken), including via analytics tools.
Communication data: messages you send via our contact form or email, and our responses.
Technical data: IP address, browser type, device information, and similar data necessary for security and operation.
Cookie data: as described in our Cookie Policy.

4. How We Use Your Data

We use your data to:

Provide, operate, and improve the Services.
Create and manage your account and process your requests.
Respond to inquiries and send relevant product or support communications.
Analyse usage to improve our website and Services.
Comply with legal obligations and protect our rights and security.

5. Legal Basis (GDPR)

We process personal data where: (a) necessary to perform our contract with you (e.g. providing the Services); (b) necessary for our legitimate interests (e.g. improving the Services, security) where not overridden by your rights; (c) you have given consent (e.g. marketing, where applicable); or (d) we have a legal obligation to do so.

6. Data Retention

We retain your data only for as long as necessary to fulfil the purposes set out in this policy, including to satisfy legal, accounting, or reporting requirements. When data is no longer needed, we delete or anonymise it. Indicative retention periods:

Contact and demo enquiries: up to 24 months from your last interaction.
AI Visibility Report leads (email + submitted URL): up to 18 months from your last interaction, unless you become a customer or ask us to delete it earlier.
Anonymous product analytics (PostHog, Vercel Analytics): up to 12 months, aggregated.
Cookie consent record (stored locally on your device): until you clear it or the policy version changes.

7. Your Rights

Under GDPR you have the right to:

Access your personal data and receive a copy.
Rectification of inaccurate or incomplete data.
Erasure ("right to be forgotten") in certain circumstances.
Restriction of processing in certain circumstances.
Data portability — receive your data in a structured, machine-readable format.
Object to processing based on legitimate interests or for direct marketing.
Withdraw consent where processing is based on consent.
Lodge a complaint with a supervisory authority (e.g. in your country of residence).

To exercise any of these rights, contact us at hello@onseason.ai. We will respond within the timeframes required by applicable law.

8. Sharing and International Transfers

We may share data with service providers who assist in operating our website and Services (e.g. hosting, analytics), subject to strict confidentiality and data protection obligations. Some of these providers may be located outside the European Economic Area. Where we transfer data to such countries, we ensure appropriate safeguards (e.g. standard contractual clauses approved by the European Commission) are in place.

The main sub-processors we currently rely on for this website are:

Vercel Inc. (US) — website hosting and edge delivery.
PostHog (EU-hosted, eu.i.posthog.com) — anonymous product analytics. Session recording is disabled and IP addresses are not stored.
Sanity.io (EU-hosted) — content management for the blog and lead capture (AI Visibility Report).
OpenAI, Anthropic and Perplexity — used only when you voluntarily run the AI Visibility Report on your own website; the URL you submit is sent to these providers to generate the analysis. No personal data other than what appears on your submitted page is shared.

8a. Client-Side Analytics Buffering

Before you make a cookie choice, we temporarily hold anonymous page-view events in your browser's sessionStorage (up to 50 events, tab-scoped). If you accept analytics cookies, these events are sent to our analytics providers; if you decline, or if your browser sends Do Not Track, they are discarded and never leave your device. This lets us understand the first pages accepting users viewed without transmitting anything before consent.

9. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page and update the "Last updated" date. Continued use of the Services after changes constitutes acceptance of the revised policy. For material changes, we may provide additional notice (e.g. by email or a notice on our website).

11. Contact

For questions about this Privacy Policy or our data practices, contact us at hello@onseason.ai or via our contact page at onseason.ai/contact.