How we handle your data.

Who we are

destination.com is operated by PMA Studios LLC, a Florida limited liability company. Technology, advertising and payment services for the site are provided by PGAM Media as our service provider. This policy covers the destination.com website, its emails and its accounts. Questions and requests go to privacy@destination.com.

Information we collect

What you give us: your email address when you subscribe, and optionally your name, home airport, destinations you are interested in and a phone number for SMS fare alerts. If you create an account, the details you sign up with (email, name, or the profile of the sign-in provider you choose). Trips, plans, saved items, follows and preferences you create. Booking confirmation emails and attachments you forward or upload to Trip Watch. Passenger details you enter when booking a flight or hotel through us. Payment for a membership is entered on Stripe's form; we do not receive or store your card number.

What we collect automatically: your IP address and the approximate location derived from it (country, region, city), browser and device type, pages viewed, the page that referred you and any campaign (UTM) parameters in the link. When analytics is allowed (see Section VI) we also set a first-party visitor identifier cookie (dc_vid) and record page views and on-site events against it. When you click a link in one of our emails we record the click against a hashed form of your address. When you click through to a partner we record the click.

How we use it

To send the newsletter, fare alerts and other emails you asked for; to run your account, trips, price watches and Trip Watch; to process bookings and payments; to personalise emails and recommendations using your stated preferences and what you read and click; to measure and improve the site; to show advertising on our pages and to measure our own advertising campaigns; to prevent abuse (for example, rate-limiting sign-up forms by IP address); and to meet legal obligations.

AI processing

Some features send what you give us to Anthropic's Claude API for processing: booking emails and attachments you forward or upload to Trip Watch are read by the model to extract flights, hotels and reservations into your trip; the trip planner sends your destination, dates, budget and preferences to generate an itinerary; and the concierge sends your question. The output is stored with your trip or account.

Cookies and similar technologies

Essential (always on): sign-in and session cookies from Clerk, security and rate-limiting, your newsletter subscriber cookie, your consent choice (dc_consent, kept for 12 months) and a short-lived cookie recording which consent rules apply to your region (dc_cregion, 1 day).

Analytics (only when allowed): Google Analytics 4, Microsoft Clarity (session recordings and heatmaps), the HubSpot tracking code, our first-party visitor identifier dc_vid (12 months) and our own first-party page and event logs.

Advertising (only when allowed): the Meta Pixel, the Pinterest Tag, ad serving by Aditude and the programmatic demand partners it works with, and the PGAM Media audience measurement tag.

Affiliate partners set their own cookies on their own sites when you click through to them from ours.

Your choices: consent, opt-out and Global Privacy Control

If you visit from the European Economic Area, the United Kingdom or Switzerland, analytics and advertising cookies and tags stay off until you choose “Accept all”. Everywhere else they are on by default and you can switch them off with “Reject non-essential”. You can change your choice at any time from “Privacy choices” in the footer.

If your browser sends a Global Privacy Control (GPC) signal, we treat it as an opt-out of advertising: advertising tags do not load, and the advertising conversion events we would otherwise send from your visit to Meta and Pinterest are not sent. This applies even if you previously chose “Accept all”.

When you reject analytics we stop setting the dc_vid identifier and remove an existing one on your next page load.

Email: every marketing email has an unsubscribe link, and you can manage what you receive at /newsletter/preferences. Creating an account does not subscribe you to email; the sign-up form has an unticked box for that.

Service providers and partners

We share information with the following providers, for the purposes stated:

PGAM Media — our service provider for technology operations, advertising sales and payment processing. It runs the site's systems on our behalf, holds the Stripe account through which memberships and direct bookings are charged, and is bound by a services agreement that restricts how it uses your information.

Vercel — website hosting, content delivery and file storage. Neon — database hosting. Upstash — caching and rate limiting. Clerk — accounts and sign-in. HubSpot — our subscriber and customer records, email preferences and website tracking. Resend — sending email. Our inbound email provider — receiving the booking emails you forward to us. Twilio — SMS alerts, if you give us a phone number. Anthropic — AI processing as described in Section IV.

Stripe — membership payments. Duffel — flight search and booking. LiteAPI — hotel search and booking. Liveblocks — real-time collaboration on shared trips. Mapbox — maps (your browser requests map tiles from Mapbox directly).

Google Analytics and Microsoft Clarity — analytics, when allowed. Meta (Facebook, Instagram) and Pinterest — advertising measurement through their tags and Conversions APIs, when allowed, and the audience uploads described in Section VIII. Aditude and its advertising partners — ads shown on our pages, when allowed. PGAM Media’s audience platform — audience measurement across PGAM Media sites, when allowed.

Affiliate networks and partners, when you click through to them: Travelpayouts (Aviasales), Partnerize (Expedia Group), CJ, Impact, CardRatings (QuinStreet), Ticketmaster and GetYourGuide. For credit-card offers via CardRatings, when advertising is allowed we record the click with your visitor identifier, Meta browser cookies, IP address and browser so that an approved application can be reported to Meta as a conversion.

Your browser's push service, if you turn on push notifications.

We also disclose information where required by law or to protect our rights and users.

Advertising audiences and conversion events

We upload SHA-256 hashed email addresses of subscribers who clicked specific campaign emails to Meta Custom Audiences, so that we can show ads to, or exclude, those people on Meta's platforms. Meta matches the hashes against its own users.

We also send conversion events to Meta and Pinterest through their Conversions APIs — for example a newsletter sign-up, a subscriber becoming an engaged reader, or an approved credit-card application — with hashed identifiers (such as your email address) and, for events from your visit, your IP address and browser. Events from your visit are sent only when advertising is allowed for that visit.

Unsubscribing, rejecting advertising, sending GPC or deleting your account stops future uploads about you from those routes. When you delete your account we also ask Meta to remove your hashed address from our audiences.

Data retention

Account data (trips, saved items, preferences, forwarded bookings) is kept until you delete it or delete your account. Subscriber data is kept while you are subscribed; when you unsubscribe we stop sending straight away and keep a suppression record so that we do not email you again. Membership and payment records are kept for billing, tax and accounting. Commission records are kept with the link to you removed.

Usage logs — page views, email clicks and partner clicks — do not currently have an automatic expiry; they are deleted when you delete your account or ask us to delete them. Cookie lifetimes are listed in Section V.

Deleting your account and your rights

To delete your account, use Manage account → Delete account from the account menu on the website, or in the app open You → Account → Delete account, or email privacy@destination.com from the address on your account.

Deleting your account erases your trips, bookings, forwarded emails, price watches, saved items, preferences, push subscriptions and the usage logs we can link to you; deletes your contact record in HubSpot and removes you from our Resend mailing lists; and asks Meta to remove your hashed address from our advertising audiences. Membership and payment records are kept for billing and tax, and commission records are kept with the link to you removed.

Depending on where you live you may have rights to access, correct, delete or port your data, to object to or restrict processing, and to opt out of certain advertising. To exercise them, contact privacy@destination.com. We will respond within 30 days.

Children's privacy

Our site is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will take steps to delete such information.

Changes to this policy

We may update this Privacy Policy from time to time. We will post the new policy on this page and update the “Last updated” date above.

Contact us

If you have any questions about this Privacy Policy, please contact us at privacy@destination.com.