Privacy Notice

Controller and principles

Black Qub LLC, 1309 Coffeen Avenue STE 1200, Sheridan, Wyoming 82801, USA, is responsible for this website. Contact: mail@blackqub.com, telephone +1 (307) 200 8654. We process data for the purposes described below, limit collection to what is needed and do not sell visitor profiles. References to GDPR rights and legal bases apply insofar as the GDPR applies.

Hosting and security logs

Replit and its infrastructure providers process request data such as IP addresses, URLs, search parameters, request times, browser information and errors to deliver and secure the website. Travel dates and party size can appear in search URLs; do not include sensitive information. Article 6(1)(f) GDPR: legitimate interests in reliable delivery and abuse prevention. Application rate limits use salted hashes in temporary process memory, not persistent raw-IP records. Entries expire after their configured limit window and are swept at intervals of up to one minute.

Cookies and preferences

sd-currency stores your requested display currency for up to one year (SameSite=Lax, path /). The same preference is stored in local storage until cleared. NEXT_LOCALE is a session language-preference cookie; browser session restoration can preserve it. These functional preferences support the service you request, not advertising or cross-site identification. Article 6(1)(f) GDPR and, where applicable, the requested-service storage exception. There are no optional tourist analytics or advertising cookies in the application. You can clear preferences through your browser.

Outbound click events

Book Directly with Operator routes through /out/:dealId. After validating the active deal and destination, we record an event ID, deal ID and timestamp. This event contains no IP address, user agent, account link or visitor identifier. We do not follow the external booking. Hosting logs remain separate. Article 6(1)(f) GDPR: aggregate listing performance and operational integrity, subject to your right to object.

Newsletter interests

With your express consent we store your email address, selected language, consent timestamp and consent version in PostgreSQL (Article 6(1)(a) GDPR). The form records your interest; submitting it does not send marketing emails or a confirmation email. You may withdraw consent or request deletion at mail@blackqub.com, without affecting earlier lawful processing. Providing these details is voluntary.

Contact by email

When you contact mail@blackqub.com, we process your address, message and any details you supply to answer your request. Article 6(1)(b) GDPR applies to contractual or pre-contractual requests; otherwise Article 6(1)(f) applies to responding to enquiries. Please do not send passport copies or health records. This website does not offer a contact form.

Operator accounts

Clerk authentication is limited to operator and administrator areas and their protected API routes. Clerk processes account and authentication/security data and may set the cookies needed for sign-in. Operator profiles and listing-management records are held in PostgreSQL. Tourists do not need an account and public pages do not load the Clerk client. Article 6(1)(b) GDPR covers account services; Article 6(1)(f) covers access security.

When an operator submits a listing, the audit log records the image-rights confirmation with the account and listing reference, server timestamp and policy version. Administrative image checks are also recorded to document policy compliance and review decisions. This is used to administer the operator relationship and protect rights (Article 6(1)(b) and (f) GDPR, insofar as applicable).

Images, fonts and service recipients

Next.js fetches Cloudinary and Pexels editorial images and the site logo server-side and serves optimised copies through this website; this path does not send the visitor's IP to the source image host. Browser-tab and Apple home-screen icons load directly from Cloudinary, which receives connection data including the IP address. Clicking original-image or credit links also connects directly to the respective provider. Manrope and DM Serif Display are downloaded at build time and served by this website. Article 6(1)(f) GDPR: readable presentation and editorial delivery. Replit and the configured PostgreSQL infrastructure support hosting and storage. Resend is not called by the newsletter-interest endpoint. No email-delivery processor is invoked by that form.

For operator memberships and advertising placements, Digistore24 is the designated German payment provider and may receive the billing and transaction information needed when that payment flow is activated. No active checkout is provided by this website at present. The applicable data-protection roles and contractual arrangements must be determined for the actual flow; no controller or processor role is asserted here.

Operator image uploads are sent to our server, where file type, dimensions, size and account quotas are checked. Images are reoriented and EXIF/GPS and other embedded metadata are removed before the processed image is transmitted to Cloudinary for media storage and delivery. Stored records include the operator, uploader account, optional listing reference, image identifier, alternative text, dimensions, storage size, moderation state and timestamps. Photos may show identifiable people; operators must hold the required permissions. Upload attempts are counted per account over a rolling hour and day, not by permanently storing raw IP addresses. Removal is first recorded in the database, then the Cloudinary asset is deleted; unsuccessful deletion is queued for a later cleanup. Public website display requires approval. Cloudinary delivery URLs are not a private document vault: someone who receives a URL may access the asset. Processing serves the operator relationship and protection of rights under Article 6(1)(b) and (f) GDPR, insofar as applicable. Transfers outside the EEA may occur; applicable safeguards, contractual roles and retention periods must be determined from the actual service arrangements. No certification or specific controller/processor role is asserted.

Exchange rates and operator payments

A configured exchange-rate source is contacted server-side for rate data, without visitor search inputs; absent a valid source only original prices are shown. This is not a browser connection to a rate provider. Digistore24 concerns separate operator purchases, not tourist booking or payment; the website does not process tourist travel payments.

International transfers

Black Qub LLC is based in the USA. Hosting, authentication, font delivery and other service providers may involve processing outside the EEA. Where applicable, transfers require an appropriate basis under Chapter V GDPR, such as an applicable adequacy decision or Article 46 safeguards, and supplementary measures where needed. We do not claim a particular certification, EU-only storage or an executed transfer agreement. Contact mail@blackqub.com for information about applicable safeguards.

Storage duration

We retain data only for its purpose and applicable legal duties. Currency cookies last up to one year, local storage until cleared and language cookies for the browser session. The application has no automated deletion schedule for newsletter interests or outbound events. Hosting logs, backups, correspondence and authentication data depend on their operational settings and applicable retention obligations; no fixed deletion period is promised here. You can request information or deletion at mail@blackqub.com.

Your rights

Where applicable you have rights of access, rectification, erasure, restriction, portability, withdrawal of consent and objection to legitimate-interest processing. You may complain to a competent supervisory authority, including in the place of your habitual residence or work. Send requests to mail@blackqub.com; we verify identity proportionately. No automated decisions with legal or similarly significant effects are made.

Security and minors

We use HTTPS in production, server-side access controls and technical abuse controls. No online transmission is guaranteed risk-free. The site is intended for adults planning travel; we do not knowingly seek children's contact details. Parents or guardians can contact us about deletion. This notice is updated when relevant processing changes.