Privacy notice

Last updated: 10 May 2026

The Guide TCI is a travel guide for the Turks and Caicos. This notice explains what personal data we collect when you visit tci.guide or join the waitlist, why we collect it, how we use it, who we share it with, and your rights under the laws that apply to you.

What this notice covers, and what's coming. tci.guide is currently a pre-launch waitlist landing page. The Guide TCI is being built as a personalized travel guide where behavioral data is part of how the product gets better — that's a deliberate design choice, and we want to be straightforward about it. This notice covers what's true today. We will publish a comprehensive updated notice before the public product launches, covering account features, personalization, AI conversations, and partner relationships in full.

Who we are

The Guide TCI ("we", "us", "our") is the data controller for the data described in this notice. Our operating entity and registered jurisdiction will be confirmed in the next version of this notice, before the public product launch.

For privacy questions or to exercise your rights, contact legal@tci.guide. We aim to respond within 30 days.

What we collect

Waitlist signup

When you join the waitlist, we collect:

• Your email address — submitted by you on the signup form.
• Your IP address — recorded automatically from your network connection.
• Your browser's user-agent string — sent automatically by your browser.
• Timestamps — when you signed up and when (if) you confirmed your email.
• A confirmation token — a random single-use string we generate so you can verify your email by clicking a link.

Site analytics and behavioral data (anyone who visits)

We use Google Analytics 4 to understand how visitors use this site. GA4 sets analytics cookies (_ga, _ga_<property-id>) and records:

• Pageviews and session activity
• Approximate location at city / country level (not precise location)
• Device, browser, and operating system
• How you arrived at our site (referring page or search query, where shared by your browser)
• Events related to specific user interactions, such as form submissions

We also keep our own server-side records of operational events on the same infrastructure that runs the service.

What we'll collect once the full product launches

The post-launch product will collect substantially more, and we will publish an updated notice before that launch. Forward-looking summary so you know where this is going:

• Account data — email, password hash, optional name, basic preferences you choose to share
• Behavioral data — how you interact with logged-in features, captured via GA4 and our own server-side records
• Conversations with our AI assistant, where you opt in — used for personalization and improving the assistant; not sold or shared with third parties for general AI-model training
• Affiliate referral data — when you click an affiliate link, the partner sees a referral code identifying The Guide TCI as the source

Why we collect it

Honestly: we collect data to make the product better, more personalized, and financially sustainable. Specifically:

• To run the waitlist — notify you when we open, send the confirmation email, prevent abuse of the form.
• To understand site usage — pre-launch analytics help us understand visitor patterns and inform our product.
• To personalize the product (post-launch) — behavioral signals help us recommend the right restaurant, neighborhood, or activity for who you actually are.
• To improve the product — usage patterns help us identify topics where users want more.
• To support the business model (post-launch) — we use behavioral and stated-preference data to identify partnership opportunities (affiliate referrals, sponsored placements). We do not and will not sell your personal data; affiliate referrals send you to a third party with a referral code identifying The Guide TCI as the source.
• To prevent abuse and protect the service — IP address and user-agent are used for short-window rate limiting and spam triage.

Legal basis (UK GDPR / EU GDPR)

If you are in the UK or the European Economic Area, our lawful bases under UK GDPR and EU GDPR are:

• Consent (Article 6(1)(a)) — for waitlist signup (you actively submit your email and confirm via the email link). Post-launch this extends to account creation, opt-in marketing communications, AI conversation capture, and marketing cookies.
• Legitimate interests (Article 6(1)(f)) — for analytics (understanding how the site is used), rate-limiting and spam-triage (security), and our own server-side operational records. Our interest is providing and improving the service. You can object at any time and we provide opt-out paths below.
• Contract (Article 6(1)(b)) — will apply post-launch where you sign up for paid features. We are not yet offering any.

Where your data is stored and who processes it

• Amazon Web Services (AWS) (United States) — application database and web hosting.
• Postmark (United States) — sends the confirmation email and any future waitlist notification email.
• Google Workspace (United States) — email inbox provider for The Guide TCI.
• Google Analytics 4 / BigQuery (United States) — visitor analytics and analytics warehouse.

These services are based in the United States, which means your data is transferred outside the UK, the EEA, or the Turks and Caicos Islands. These transfers rely on the providers' standard contractual clauses and equivalent safeguards published in their data processing agreements.

We do not sell your data, and we do not share it with anyone outside the providers listed above except where required by law. Affiliate partner links (post-launch) send you to a third party at the moment you click — under that partner's own privacy practices.

Cookies

This site currently uses two categories of cookie:

• Essential session cookie — a signed cookie used by the application. Does not track you across sites.
• Analytics cookies (Google Analytics 4) — _ga and _ga_<property-id>; default 14-month retention. Used to understand site usage in aggregate.

Marketing and affiliate cookies will be disclosed when added.

Cookie consent banner. A consent banner is being prepared and will ship before the public product launches. Pre-launch, this site is set to noindex and analytics is informational rather than monetized — but that does not eliminate the obligation under UK GDPR / EU PECR or equivalents, and we recognize that. Until the banner ships, you can opt out of GA4 today by:

• Installing Google's official opt-out browser add-on at tools.google.com/dlpage/gaoptout
• Using your browser's private / incognito mode
• Blocking analytics scripts at the browser or extension level (uBlock Origin, Privacy Badger, etc.)

How long we keep it

• Waitlist record — until you ask us to delete it. Unconfirmed records auto-delete after 90 days; confirmed records auto-delete if the waitlist has not reached you within 3 years. The IP address and user-agent purge after 90 days regardless. During the 90-day window before deletion of an unconfirmed record, we may send up to two reminder emails to complete signup.
• GA4 user-level data — 14 months by default (Google's setting). User-level data is reset for any individual visitor 14 months after their last activity.
• Server-side operational records — retained on our own infrastructure. We have not yet locked a retention window; we will document and apply one before the public product launches.
• Account data, conversation history, and behavioral profile (post-launch) — retention windows will be specified in the comprehensive post-launch notice.

Personalization and monetization

The Guide TCI is being built as a personalized travel guide. Behavioral and stated-preference data is used to:

• Recommend restaurants, neighborhoods, activities, and travel options that match who you are
• Identify partnership opportunities — we may earn commissions from affiliate referrals (your click goes to a third party with a referral code identifying The Guide TCI as the source) or display sponsored placements (clearly marked as sponsored)
• Identify topics where users want more
• Improve the product over time

We do not sell personal data. We do not make fully automated decisions about your access to the service. Where we use algorithmic personalization, you can request a review of how it applied to you.

AI conversations (post-launch)

The Guide TCI will offer an AI assistant that you can chat with about TCI travel and life. If you opt in, your conversations will be stored and may be used for personalization and improving the assistant. You will be able to opt out at any time, delete your conversation history, and request a copy of your data. Conversation data may pass through a third-party AI model provider as part of generating responses, under that provider's data-handling agreement; we do not sell or share AI conversation data with third parties for general AI-model training.

Your rights

Depending on where you live, you have rights that include:

• Access — ask us what data we hold about you.
• Erasure — ask us to delete your record (UK GDPR / EU GDPR Article 17 or local equivalent).
• Rectification — ask us to correct anything inaccurate.
• Withdraw consent — ask us to remove you from the waitlist (deletes your record), or opt out of cookies / tracking categories.
• Object — to legitimate-interests processing (analytics, rate-limiting, operational records).
• Portability — ask us to send you a copy of your record (waitlist data; once available, also your behavioral profile and conversation history) in a portable format.
• Opt out of specific tracking categories — analytics, marketing cookies (when added), AI conversation capture (post-launch).
• Lodge a complaint with the data protection authority where you live — for example, the UK Information Commissioner's Office (ICO) for the UK, or the relevant supervisory authority for your EU member state.

To exercise any of these rights, email legal@tci.guide.

For residents of the Turks and Caicos Islands: the TCI does not currently have a dedicated statutory data protection regime or regulator. We voluntarily apply UK GDPR-equivalent practices to all data as our baseline standard. If you have concerns we cannot resolve, you retain general civil and constitutional remedies under TCI law.

EU and UK representative

The Guide TCI does not currently have an appointed representative in the European Union or the United Kingdom under GDPR Article 27. The pre-launch site is set to noindex, traffic is low, and the waitlist is open to anyone who finds the page. We will reassess this position before the public product launches and may appoint representatives, restrict access, or take other measures at that point.

What we don't do

• We do not sell your personal data.
• We do not make fully automated decisions about your access to the service.
• We do not share behavioral data with third parties beyond the disclosed processors (and, post-launch, the affiliate partners you click through to).
• We do not use your data to train third-party AI models for general use; AI conversation data (post-launch) may pass through an AI model provider only for generating responses to you.

Children

This site is not directed at children under 16, and we do not knowingly collect data from children. If you believe a child has signed up, contact legal@tci.guide and we will delete the record.

Changes to this notice

If we change this notice, we will update the date at the top. Significant changes (new data collected, new processors, new purposes) will be notified by email to everyone on the waitlist. Before the public product launches, this notice will be replaced with a comprehensive notice covering account features, personalization, AI conversations, and partner relationships in full.

← Back