Privacy Policy

Certified Best Beaches ("CBB", "we") is an independent directory of Blue Flag certified beaches, operated by DnDL Creative LLC. This page explains, in plain language, what data we handle and why. Questions any time: daniel@certifiedbestbeaches.com.

The short version

• You can browse every beach page without an account.
• Nothing that sets cookies or loads third-party scripts runs until you accept the cookie banner.
• We never sell your personal data, and we run no ad trackers.
• Marketing email is strictly opt-in, and every message has an unsubscribe link.

Cookies and local storage

When you first visit, we show a consent banner. Your choice is stored in your browser (cookie_consent) and gates everything below — decline, and consent-gated features simply stay off.

• Live chat (tawk.to). Our support chat widget loads only after you accept cookies. tawk.to sets its own cookies to keep your chat session working; their handling is described in the tawk.to privacy policy.
• Favorites. Hearting a beach stores it in your browser's local storage. It stays on your device unless you later create an account and sync it.
• Analytics. We currently run no analytics trackers. If we add privacy-respecting analytics later, it will be consent-gated behind the same banner and disclosed here first.

Accounts

If you create an account (traveler, business, or municipality), we store your email address, display name, role, language preference, and email preferences with our database and authentication provider, Supabase. Account features may also store your favorited beaches, claimed coupons, and booking requests so they work across devices.

Payments (Stripe)

Paid features — municipal subscriptions, featured business placements, and paid bookings — are processed by Stripe. Your card details go directly to Stripe and never touch our servers; we store only what we need to reconcile the transaction (for example a Stripe customer or payment reference). See the Stripe privacy policy.

Email (Resend)

Transactional email — sign-in links, booking confirmations, coupon claims, approval notices — is delivered through Resend. We keep a log of what we sent (recipient, template, delivery status) so we can troubleshoot problems and honor your preferences.

Targeted municipal email is opt-in only. A planned feature lets a town's tourism office reach travelers who favorited that town's beaches and explicitly opted in to hear from it. No opt-in, no email — and every send includes a one-click unsubscribe.

Affiliate links

Some pages include clearly-labeled links to travel partners (for example "Places to stay nearby" or "Things to do nearby"). If you book through one of these links, we may earn a commission at no extra cost to you. These are plain outbound links — we do not run partner scripts, pixels, or iframes on our pages, so following a partner link only shares data with that partner once you are on their site, under their own privacy policy. See our Terms of Service for the full affiliate disclosure.

Clancy (CI — Clancy Intelligence)

The "Ask Clancy" feature answers beach questions using an AI language model that reads from our own beach database — nothing else. Questions are processed server-side and are rate-limited per visitor and site-wide. To run and improve the feature we log the question text, a hashed (not raw) IP address, the answer served, and usage counts; we do not use your questions to train models, and answers are informational — not safety advice. Always check the live flag status and local guidance before you swim.

Retention and deletion

You can delete your account from your account page. Deletion cascades: your favorites, coupon claims, and booking history go with it. You can also request an export of your account data by emailing us.

Your rights (GDPR)

If you are in the EU/EEA or UK, you have the right to access, correct, export, delete, and object to or restrict the processing of your personal data, and to withdraw consent at any time (including re-opening the cookie banner choice by clearing your browser data for this site). To exercise any of these, email daniel@certifiedbestbeaches.com. You may also lodge a complaint with your local supervisory authority.

California note (CCPA/CPRA)

We do not sell or share personal information as defined by California law, and we honor deletion and access requests from California residents through the same email above.

Where data lives

Our infrastructure (Vercel hosting, Supabase database, Cloudflare media storage) is operated by US-based providers with global networks; data you submit may be processed in the United States.

Children

CBB is not directed at children under 13, and we do not knowingly collect their data.

Changes

If this policy changes materially, we will update the date at the top and, for account holders, note the change by email where appropriate.

See also our Terms of Service and contact page.