Privacy policy

Who I am

Atlas by Steph is a travel advisory operated by Steph Irwin, an independent travel advisor of Fora Travel, Inc. ("Fora"), based in California. California Seller of Travel Registration No. 2151995-50.

This policy covers atlasbysteph.com and the information I collect when you inquire about a trip, subscribe to the newsletter, book a call, or become a client. My trip inquiry form is hosted by Fora, and information you submit through it goes into Fora's platform, where Fora's own privacy policy applies alongside this one. You can read it at foratravel.com/legal/privacy-policy. When your information moves to a travel supplier to complete a booking, that supplier's privacy policy also applies.

What I collect, and when

When you submit a trip inquiry. My inquiry form is hosted by Fora and collects your contact details and the shape of the trip. Contact details: first, middle, last and preferred name, email address, phone number, preferred contact method, location, birthday, gender, mailing address, dates that matter to you, and any favorite hotels or brands you want me to know about. Trip details: where you want to go, the reason for the trip, when and how long you are thinking of traveling, who you are booking for, your total budget and what you would like to spend per night, where you are in your planning, what kind of help you are looking for, your travel style, and any requirements or preferences.

When you subscribe to the newsletter. Your email address, collected by Substack.

When you book a call. Cal.com collects your name, email, and the scheduling details, and passes them to me.

When you email me. Whatever you choose to send, at steph.irwin@fora.travel.

When you become a client. This is where it gets real, and it is deliberately separate from the inquiry stage. Booking travel requires the information travel requires, so once we are working together I may ask for legal names as they appear on passports or government ID, dates of birth, passport and Known Traveler numbers for flights, frequent flyer and hotel loyalty numbers, the people you are traveling with, and any allergy, dietary, medical, or accessibility needs you want your hotels, ships, or guides to know about. I ask for these when a booking actually needs them, not before. Payment for travel is processed through Fora's secure platform or directly by the supplier. I do not store your full credit card number on this website or in my own systems.

Automatically, when you visit the site. Standard web server information such as IP address, browser type, and pages visited. See the analytics section below for exactly what runs here, which is less than you are probably used to.

How I use it

To respond to your inquiry and plan your trip. To make and manage bookings on your behalf. To send the newsletter you signed up for. To keep the records I am required to keep as a registered California seller of travel. To understand, in aggregate, how people find and use the site so I can make it better. That is the list. I do not use your information to build advertising profiles, and I do not use it to market anything other than my own services.

Who sees it

I share your information only where the trip or the law requires it.

Fora Travel. My host agency. My inquiry form and my bookings both run through Fora's platform, which means client and traveler details live in Fora's systems and are governed by Fora's privacy policy as well as this one. Fora's policy is broader than mine, and notably Fora does use advertising technologies and discloses information in ways that some state laws treat as a "sale" or "share." That is Fora's practice on Fora's own website, not mine on this one.

Travel suppliers. The hotels, villas, cruise lines, tour operators, destination management companies, transfer providers, and travel insurance providers I book for you. They receive what they need to deliver your trip: names, contact details, and where relevant, passport information, loyalty numbers, and the needs you have asked me to communicate. Suppliers outside the United States are governed by the laws of their own countries.

Service providers that run this business. Substack runs the newsletter. Cal.com handles scheduling. Vercel hosts the website and provides analytics. Google provides email through Fora. Each processes your information only to provide their service to me, under their own privacy policies.

When the law requires it. If a valid legal process compels disclosure, I comply.

What I do not do. I do not sell your personal information. I do not rent it, trade it, or hand it to advertisers, and I do not share it for targeted advertising. I have not sold or shared personal information for those purposes in the preceding twelve months, and I do not intend to start.

Cookies and analytics

This site uses Vercel Web Analytics, which counts visits and page views without setting cookies and without tracking you across other websites. No analytics cookies are set by me, and there is no advertising pixel on this site.

Third-party services embedded on or linked from this site, including Cal.com, Substack, and the Fora inquiry form, may set their own cookies when you interact with them, governed by their own policies.

If that changes. If I ever add advertising or social platform tags, such as a Meta pixel, I will update this section before they go live and the effective date at the top will change.

Do Not Track. Some browsers send Do Not Track signals. This site does not need to respond to them, because it does not track you across the web in the first place.

Affiliate links

Some pages and posts may contain links to third-party booking platforms such as Viator. If you book through one of those links, I may earn a commission at no additional cost to you. Clicking through takes you to that company's site, where its privacy policy applies. Affiliate relationships are disclosed where the links appear.

How long I keep it

I keep your information for as long as it is needed for the purpose you gave it to me for, and then for as long as the law requires. Inquiries are kept while there is a realistic prospect of planning a trip together. Client and booking records are kept as long as needed to service your travel and to meet the record-keeping obligations that apply to a registered California seller of travel. Newsletter emails are kept until you unsubscribe. Information held in Fora's platform is also subject to Fora's retention practices. If you want your information deleted sooner, see the next section.

Your choices and your rights

You can, at any time:

Ask what I have. Email me and I will tell you what personal information I hold about you, and give you a copy.

Correct it. If something is wrong, I will fix it. In travel, a misspelled passport name is not a small error, so please do.

Delete it. Ask, and I will delete your personal information, except what I am legally required to retain and what is needed to complete travel you have already booked.

Unsubscribe. Every newsletter has an unsubscribe link that works. One click, no follow-up questions.

To exercise any of these, email steph.irwin@fora.travel. I will respond within 30 days, and I will not treat you differently for asking. If your information sits in Fora's platform, you can also contact Fora directly at privacy@foratravel.com.

California residents. The rights above are offered to everyone who asks, which covers the substance of what California privacy law asks of businesses far larger than this one. California's "Shine the Light" law also lets residents ask whether a business shared personal information with third parties for those third parties' own direct marketing. I do not, so there is nothing to disclose, but you are welcome to ask and get that answer in writing.

Visitors from the EU, UK, and elsewhere. This site and business operate from the United States, and information you provide is stored and processed in the United States. If you contact me from a jurisdiction with its own data protection law, such as the GDPR, the rights in this section are how I honor access, correction, and deletion requests. My legal bases for processing are your consent, the performance of our travel services agreement, and my legitimate interest in running this business.

Children

This website and my services are directed at adults, and are not intended for children under 18 to use unsupervised. I do not knowingly collect personal information from children through this site. When you book family travel, you may provide information about the minors traveling with you. I use it only to make their travel arrangements and share it only with the suppliers delivering the trip.

Security

I take reasonable measures to protect your information: reputable service providers, access limited to me, and sensitive traveler details handled through Fora's booking platform rather than scattered across systems or left sitting in email. No website or email can honestly promise perfect security, and I will not pretend otherwise. If a breach ever affects your personal information, I will notify you as required by law.

Changes to this policy

When this policy changes, the new version is posted here and the effective date at the top changes. If a change meaningfully affects how your information is handled, newsletter subscribers will hear about it directly.

Contact

Steph Irwin
Atlas by Steph, independent travel advisor of Fora Travel, Inc.
steph.irwin@fora.travel
California Seller of Travel Registration No. 2151995-50