Privacy Policy

Merianda Vacations is a product of Merianda Estates, LLC, a Texas limited liability company ("we," "us"). This policy explains what we collect when you use meriandavacations.com and the installable app (the "Service"), how we use it, and your choices.

• Trip details you enter: destination, dates, where you are staying, the number and ages of travelers (including children's ages), mobility needs (such as wheelchair, stroller or limited walking), walking limits, rest breaks, interests, dietary notes, must-sees, things to avoid, budget and any free-text notes. Mobility and dietary details can be sensitive; only enter what you are comfortable sharing, and do not enter names, medical records or other identifying details.
• Plans we generate for you, your chat edits, share links you create and any "Report an issue" feedback.
• Chat planner messages: if you use "Chat to plan", we store what you type and the trip details the assistant pulled from it, with a random chat ID and a one-way salted hash of your IP address. Your messages are sent to our AI provider (Anthropic) only to fill in your trip details, are used for security, abuse prevention and improving the planner, and are deleted after 30 days like other free-preview data. Please don't type names, medical details or payment information in the chat.
• Terms acceptance record: when you tick the agreement box, we store the time, the version of the Terms you accepted, a one-way salted hash of your IP address (not the address itself) and your browser's user-agent string with that trip, as a record of your acceptance.
• IP address and technical data: we use your IP address to apply free-preview and abuse limits. Our hosting provider also keeps standard server logs (such as IP address, browser type and pages requested) for security and operations. We keep only a one-way salted hash of your IP address with contact messages and Terms acceptances, for three purposes only: security, abuse and spam prevention, and keeping a record of who accepted which version of the Terms and when.
• Contact form messages: your name, email, topic, any trip link you include and your message, plus the time it was sent, a one-way salted hash of your IP address and your browser's user agent, used to reply to you and for security and to prevent spam and abuse.
• Email address, if you provide one (for example at checkout or to sign in, when available). When you buy a plan, we use the email you give at checkout to send you one purchase email with your private plan link, a PDF of your plan and your purchase details. It is a transactional email, not marketing.
• Payment information: card payments are handled by Stripe. We receive limited details such as the amount, status, email and a payment reference. We never receive or store your full card number.
• Usage analytics: see Cookies and Google Analytics below, including how to opt out.

We and third parties use cookies and similar technologies (such as browser storage) for site functionality, analytics and personalization. When you are in the United States and most other places, we show a short notice and analytics runs unless you opt out. If you visit from the United Kingdom, the European Economic Area, Switzerland or India, analytics stays off unless you click Accept.

Cookies set on meriandavacations.com

• mv_owner (essential, about 1 year): a random ID that lets this browser open, unlock, edit and share the trips it created. Paid plans can also be opened on any device with the private share link we email you; anyone with that link can view the plan until it is deleted.
• mv_pv (essential to pricing, about 90 days): keeps the price you are shown consistent during our pricing test, so the price at checkout matches the price you saw.
• mv_cc (essential, ends when you close your browser): the two-letter country our hosting provider detects from your IP address, used only to show the right cookie choices. We do not store your IP address in it.
• _ga and _ga_* (analytics, Google Analytics, about 13 months): distinguish visits so we can count how the site is used. Not set if you opt out, if your browser sends Global Privacy Control, or (in the UK, EEA, Switzerland and India) until you click Accept.

Browser storage (stays on your device)

• mv_consent (your Accept, Reject or opt-out choice), mv_notice_dismissed (that you closed the cookie notice), mv_tips_bar_dismissed, mv:install-dismissed and mv_ga_once:* (so a purchase is counted once). These stay until you clear your site data.
• Planner inputs and preview results in session storage (cleared when you close the tab), and offline copies of trips you open (IndexedDB and the app cache).

Third parties

• Google Analytics (Google LLC): loads the Google tag from www.googletagmanager.com and sends usage events to Google only when analytics is allowed, as described above.
• Stripe: payments happen on Stripe's own checkout page (checkout.stripe.com), which sets its own cookies for payment and fraud prevention under Stripe's privacy policy. Stripe does not set cookies on our site.
• Vercel (our hosting provider): serves the site and processes IP addresses and request logs to deliver pages and keep the service secure. It does not set cookies on our site.

We do not currently use advertising pixels or ad cookies. If we add any, they will follow the same choices described here.

We use Google Analytics 4 (provided by Google LLC) to understand how the site is used, for example which pages are visited, whether a plan preview finished, and when someone starts checkout, completes a purchase, installs the app, creates a share link or downloads a PDF. We send only event names and plan type and price; we do not send your trip details, names or email to Google Analytics. Google signals and ad personalization are switched off, and advertising storage stays denied. Google may process this data in the United States and other countries under its own privacy policy.

Your Privacy Choices (Do Not Sell or Share My Personal Information): we do not sell your personal information for money. Some state laws, such as those in California and Texas, may treat analytics or advertising cookies as a "sale", "sharing" or targeted advertising. You can opt out at any time on our Your Privacy Choices page (linked in the footer of every page). Opting out turns off Google Analytics and any future advertising tags in that browser.

We honor the Global Privacy Control (GPC) signal. If your browser sends it, we treat you as opted out automatically. In the UK, EEA, Switzerland and India, the Google tag does not load until you click Accept, and Reject or the X keeps it off. Your choice is saved in your browser; if you opt out later, we stop sending data from then on, and you can also clear the _ga cookies in your browser.

• to generate, verify, save, display, edit, export and share your plans;
• to process payments and unlock purchased plans;
• to apply usage limits, prevent fraud and abuse, and keep the Service secure;
• to record your acceptance of our Terms;
• to understand and improve the Service (including, with your consent, analytics); and
• to comply with law and enforce our Terms.

We share information only with providers that help us run the Service, for the purposes above:

• Anthropic (AI model): processes your trip details to generate and edit plans.
• Google (Google Maps Platform / Places API): receives stop names and areas to check places, and the destination you type in the "Where are you going?" box (as you type, to suggest places); and, only with consent, Google Analytics.
• Stripe: payment processing.
• Vercel: website hosting and server logs.
• Neon: database storage for trips, contact messages and limits.
• Resend: sending email, including the purchase email with your plan link and PDF and, if you sign up, the newsletter (see Newsletter). Resend receives your email address and that email's contents.
• HostGator: hosts our info@ mailbox, which receives alerts with the contents of messages you send through our contact form.

Our team in India. Members of the Merianda team in Mysuru, India may access personal data to provide and support the Service (for example, to fix a plan, answer a contact message or investigate a problem). This means your information may be accessed from outside the country where you live. They use it only for the purposes in this policy.

If you click an affiliate or booking link, you leave our site and the partner's own privacy policy applies; we log the click (partner, destination and page) without your trip contents. We may also disclose information if required by law, to protect rights and safety, or as part of a merger or sale of the business.

If you sign up for our weekly travel tips (in the site footer, after a free preview, on your plan page, or by ticking the optional box at checkout), we store your email address, where you signed up, the sign-up wording you saw, the date, your country, a one-way hashed form of your IP address, and any optional destination interests or accessibility preference you choose. We use this only to send the newsletter and keep a record of your consent. Buyers are never added unless they tick the box.

We send about one email a week. Every email has an unsubscribe link that takes effect immediately; you can also use the contact form. We track link clicks in the newsletter to see which tips are useful, but not email opens. We may remove subscribers who haven't clicked anything in six months.

Resend sends the newsletter for us as our processor and stores the subscriber list (email address, interests and subscription status) for that purpose. After you unsubscribe, we keep your email address and unsubscribe date only so we don't email you again.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not use your trip details to train our own AI models.

How long we keep data. We keep free trip previews, contact messages, and related logs (including hashed IP addresses) on our website and database for no more than 30 days, then delete them. Paid plans are kept until 30 days after your trip's end date, then deleted. Please download your PDF itinerary within that time. We also keep encrypted backup copies of limited records, such as purchase records, Terms acceptance records, contact messages, and logs, stored separately from our website servers, to help with disputes or legal claims. These backups are deleted no later than 60 days after the data was first collected. Payment card details are handled by Stripe and are never stored by us. Analytics data collected with your consent is kept by Google Analytics under its own settings (2 months).

We use reasonable safeguards such as encrypted connections (HTTPS), access controls, limited access to IP address logs and encrypted backups. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

The Service is meant for adults planning trips. It is not directed to children under 13, and we do not knowingly collect personal information from them. Parents may enter children's ages to plan a trip; please do not enter children's names or other identifying details.

You can opt out of analytics on Your Privacy Choices, clear cookies and site data in your browser, remove trips from "My trips" on your device, and turn off share links. Depending on where you live, you may have rights to access, correct, delete or get a copy of your personal information, or to object to certain uses. To make a request, use the contact method below; we may need to verify the request.

We may update this policy. We will post the new version here and change the "Last updated" date.

To contact us about this policy or your information, email us or use our contact form.