Privacy Policy

Who we are

Retreat Ledger is an independent retreat review and discovery directory published by Retreat Ledger LLC (referred to below as "we" or "us"). This policy explains what information we collect when you use the site, why we collect it, and what we do and do not do with it. If anything here is unclear, write to [email protected] and a person will answer.

What we collect, and when

We only collect information you choose to give us, plus a small amount of technical data needed to run the site safely. Specifically:

• Reviews. When you submit a review we collect the name you choose to display, your email address (used for moderation and to tell you when your review is published; never shown publicly), your ratings, and what you write. Reviews are moderated by a person before publication.
• Owner claims and accounts. When you claim a retreat we collect your name, email, phone number if you provide one, your role at the retreat, and any verification details you share. Owner sign-in is passwordless: we email you a one-time link, so we never store a password for you.
• Contact and inquiry forms. When you write to us or request a Digital Presence Assessment, we keep what you send so we can respond to it.
• Newsletter. If you subscribe, we store your email address and where on the site you subscribed. Nothing else.
• Technical data. Like nearly every website, our infrastructure processes IP addresses to serve pages and prevent abuse. We never store the address itself. For analytics and review integrity we store a short, salted hash of it that is rotated every day, so the same visitor produces a different value tomorrow and the identifier cannot be used to follow anyone over time, including by us. We treat that hash as personal data under GDPR rather than claiming it is anonymous, because being careful about the distinction is the point.

Analytics

We measure how retreat profiles are used (page views and clicks to a retreat's website or booking page) with our own first-party system. These counts are shown, in aggregate, to the retreat's verified owner. That system sets no cookies and uses the daily-rotating identifier described above, so it runs for everyone.

We also use Google Analytics to understand which retreats and destinations people search for. Google Analytics sets cookies, and those are not necessary to deliver the site, so we ask before we turn it on. Until you agree, it is loaded in a mode that stores nothing on your device. If you decline, nothing about the site changes and the first-party counts above keep working. You can change your mind by clearing this site's data in your browser, which brings the choice back.

We have IP anonymisation enabled in Google Analytics. We do not run advertising, we do not build advertising profiles, and we have not enabled Google's advertising or remarketing features. Google is a separate controller for the data it collects, and its own privacy policy governs that processing.

Cookies

Two kinds, and that is the complete list.

• Strictly necessary. If you sign in as a retreat owner or an administrator, a session cookie remembers who you are. No consent is required for these and they cannot be switched off without breaking sign-in.
• Analytics, only with your consent. Google Analytics cookies, set only after you accept. Declining or ignoring the request means they are never set.

There are no advertising cookies and no cross-site tracking cookies. You will only see a cookie request on this site because there is genuinely something to ask about; we are not going to show you a banner for cookies that keep you signed in.

Payments

Paid placement subscriptions are processed by Stripe, a dedicated payment provider. Your card details go directly to Stripe and never touch our servers. We receive from Stripe only what we need to manage the subscription: the plan, its status, and the billing email. Stripe's own privacy policy governs the payment itself.

Email

We send transactional email (review confirmations, claim decisions, sign-in links, subscription receipts) through a delivery provider acting on our instructions. If you subscribe to the newsletter, you can leave it at any time by replying to any edition or writing to us, and we will remove you promptly.

What we never do

• We do not sell your personal information. To anyone. For anything.
• We do not share reviewer email addresses with retreat owners.
• We do not run advertising, and we have not enabled Google's advertising or remarketing features.
• We do not ask for information a directory has no business holding.

Who we share information with

We use a small number of service providers to run the site: Cloudflare (hosting and security), Stripe (payments), Google (Analytics, only with your consent, and Places data for listing photographs), and our email delivery provider. Each receives only what it needs to do its job. If you request a Digital Presence Assessment, the details you submit on that form are shared with our studio partner so the assessment can be prepared; the form says so at the point of submission. Beyond that, we disclose information only if the law genuinely requires it.

How long we keep things

Published reviews stay published, because a directory whose history quietly evaporates is not worth trusting. Moderation records, claim records, and inquiries are kept as long as they are useful for running the site honestly, then deleted. Sign-in sessions expire on their own. Newsletter addresses are kept until you unsubscribe.

Why we are allowed to hold it

If you are in the UK or the EU, the GDPR requires us to name a lawful basis for each thing we do, so here they are in plain terms:

• Contract (Art. 6(1)(b)) for owner accounts, claims, and subscription billing. We cannot give you a dashboard without holding an account.
• Consent (Art. 6(1)(a)) for the newsletter, and only the newsletter. You may withdraw it at any time using the unsubscribe link in every edition, and withdrawing is as easy as subscribing was.
• Legitimate interests (Art. 6(1)(f)) for security, abuse prevention, and the rotating first-party analytics described above. We use the least identifying method that still answers the question.
• Legal obligation (Art. 6(1)(c)) for tax and accounting records relating to payments.

Retreat listings include business contact details published by the retreats themselves or drawn from public directories. We rely on legitimate interests for that, and any retreat can ask us to amend or remove its listing details by writing to us.

Where your information goes

Retreat Ledger LLC is based in the United States, so if you are outside the US your information is transferred there. Our processors (named above) offer Standard Contractual Clauses, and we rely on those for transfers out of the UK and EU.

Your choices and rights

Whatever jurisdiction you are in, you can ask us to show you what we hold, correct it, delete it, give you a portable copy, restrict what we do with it, or object to it entirely. Where we rely on consent you can withdraw it. Write to [email protected] from the address in question and we will act within thirty days. We will not charge you, and we will not make the site worse for you because you asked.

Note that deleting your account information is different from deleting a published review; we will discuss the specifics with you honestly, including where the law gives you the final word.

If you are in California: we do not sell or share personal information as the CCPA defines those terms, and we never have. There is no "Do Not Sell" link because there is nothing to opt out of. You have the same access, deletion, correction, and non-discrimination rights described above.

If you are in the UK or EU and think we have got something wrong, you may complain to your national supervisory authority, and in the UK to the Information Commissioner's Office. We would rather you told us first.

Children

The site is intended for adults. We do not knowingly collect personal information from anyone under sixteen, and we will delete any we discover.

Changes to this policy

If we change this policy in a way that matters, we will update the effective date above and, where the change is significant, say so plainly on the site. We will never bury a meaningful change in a footnote.

Contact

Retreat Ledger LLC is the data controller for everything described here.

Retreat Ledger LLC
30636 Southwest Ruth Street
Wilsonville, OR 97070, United States
[email protected]

This policy is reviewed and updated periodically. Last updated 31 July 2026.