Draft for review · last updated 30 September 2026. Items in [brackets] need to be filled in before launch. This draft is not legal advice.

1. Who we are

Open Lifts is operated by [Company legal name], [registered address], company number [number] (“Open Lifts”, “we”, “us”). We are the controller of the personal data described in this policy. Questions or requests: privacy@openlifts.com. [If appointed: our Data Protection Officer can be reached at the same address.]

2. What we collect

Account data — your email address, password (stored hashed) or, if you continue with Google, your name, email and Google account ID.

Membership and payment data — your plan and renewal dates and billing history. Card details are collected and stored by our payment provider [e.g. Stripe]; we only see the card type, last four digits and expiry.

Trip and preference data — trips you save, answers you give in Plan my trip (dates, group size, children's age bands, skiing levels, priorities, what you've booked), resorts you follow and your alert settings.

Messages and reports — what you send us through the contact form, and lift reports you submit.

Device and usage data — IP address, device and browser type, pages viewed, approximate country, and a push-notification token if you turn on push alerts.

We do not collect precise location, and we do not ask for special categories of data. Children's age bands in Plan my trip are used only to rank resorts and are not linked to any child's identity.

3. Why we use it, and our legal basis

To provide the service you asked for (performance of a contract): your account, the Annual pass, forecasts for your saved trips, alerts, and replies to your messages.

To take payment and keep records (contract and legal obligation): billing, invoices, tax and accounting records.

To run, secure and improve Open Lifts (legitimate interests): preventing fraud and abuse, fixing bugs, measuring which features are used, and checking lift reports to improve forecast accuracy.

Product emails (legitimate interests, or consent where the law requires it): renewal notices and service updates. You can opt out of non-essential emails at any time.

Analytics and marketing cookies (consent): only if you accept them in the cookie banner.

4. Booking partners and affiliate links

When you click a link to book a stay, package, ski pass, flight or transfer, you leave Open Lifts for a partner's site. We pass a referral code so the partner can credit us with a commission; we do not send your name, email or trip details. Anything you enter on the partner's site is handled by that partner under its own privacy policy, as an independent controller. Commissions never change our data or rankings.

5. Who we share data with

We use service providers who process data only on our instructions: hosting and database [provider], payments [e.g. Stripe], email delivery [provider], push notifications [provider], analytics [provider], customer support tools [provider], and Google (only if you use “Continue with Google”). We do not sell your personal data and we do not share it with resorts or lift operators. We may disclose data where required by law, or to protect our rights and users' safety.

6. International transfers

Some providers may process data outside the European Economic Area. Where they do, we rely on an adequacy decision or the European Commission's Standard Contractual Clauses, with additional safeguards where needed. Ask us for a copy of the relevant safeguards.

7. How long we keep it

Account, trip and preference data: while your account is open, and deleted within [30] days of closing it. Billing records: as long as tax law requires (currently [X] years). Support messages: [24] months. Usage logs: [13] months. Lift reports may be kept in anonymised form to improve forecasts.

7a. The waitlist

If you join the waitlist we store your email, the language of the page, the resort and month you chose (both optional), whether you asked for the weekly email, the country we derive from your connection (we do not store your IP address — only a one-way hash of it, used to limit abuse), how you reached the page (campaign tags, referral code and referring page), when you signed up and confirmed, and the version of the wording you agreed to. We use it only to confirm your place, to email you at launch and — if you ticked it — to send the weekly email. We keep it for 12 months after you sign up unless you open an account, and delete it sooner on request to privacy@openlifts.com. Every email has a one-click unsubscribe.

8. Your rights

You can ask us to access, correct, delete, restrict or port your personal data, and you can object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time without affecting earlier processing. Most settings — alerts, email preferences, closing your account — are in Account. For anything else, email privacy@openlifts.com; we reply within one month. You also have the right to complain to a data protection authority — [lead supervisory authority, e.g. the authority in the country where we are established] — or the authority where you live.

9. Cookies

We use strictly necessary cookies to keep you signed in and remember your settings. Analytics and marketing cookies are used only with your consent, which you can change at any time in [Cookie settings].

10. Children

Open Lifts is not intended for children under 16, and we do not knowingly create accounts for them.

11. Security

We use encryption in transit, hashed passwords, access controls and regular reviews of our providers. No system is completely secure; if a breach affects you, we will tell you and the authorities as the law requires.

12. Changes to this policy

We will post any changes here and update the date above. If a change materially affects how we use your data, we will tell you by email or in the app before it takes effect.