Table of Contents
The Carry-On Co. is a travel content and concierge business operated by an independent proprietor doing business as "The Carry-On Co.," based in the United States. For the purposes of applicable data protection laws, including the EU General Data Protection Regulation ("GDPR") and the UK GDPR, The Carry-On Co. acts as the data controller of personal information collected through the Site and Services, except where otherwise noted (for example, where a third-party payment processor acts as an independent controller of your payment data).
This Policy applies to carryonco.net, all subdomains and city-guide pages hosted under it, our booking and inquiry forms, our newsletter, and our paid service tiers: Flight + Stay Finder, Full Itinerary, and Done-For-You Concierge, as well as digital city guides sold through Gumroad and any "Cheap Europe Club" membership.
We collect information in three categories: information you give us directly, information collected automatically, and information we receive from third parties. The table below summarizes what we collect and why.
| Category | Examples | Source |
|---|---|---|
| Identity & contact data | Full name, email address, phone number (if provided) | Trip inquiry form, newsletter signup, direct email |
| Travel & preference data | Travel dates, destinations, number of travelers, budget range, hotel/flight preferences, dietary or accessibility needs you disclose, special occasion details | Trip inquiry form, email/chat correspondence |
| Transaction data | Service tier purchased, order date, amount paid, product purchased (e.g., city guide title), transaction/order ID | Stripe, Gumroad (payment card details are never received or stored by us — see Section 9) |
| Technical & usage data | IP address (truncated/anonymized where feasible), browser type and version, device type, operating system, referring/exit pages, pages viewed, time spent on page, general geographic location (city/country level, derived from IP) | Google Analytics (GA4), server logs, hosting provider (Vercel) |
| Marketing & communication data | Newsletter subscription status, email open/click activity, opt-in/opt-out preferences | Beehiiv |
| Correspondence | Content of emails, form submissions, or messages you send us, including any files or itinerary details you share | Direct communication with hello@carryonco.net, Formspree submissions |
We do not knowingly collect government identification numbers, passport numbers, payment card numbers, precise real-time geolocation, biometric data, or health information through the Site. If you voluntarily include such information in a free-text field (for example, mentioning a medical condition relevant to travel accommodations), we will only use it for the limited purpose of fulfilling your specific request and will not retain it longer than necessary for that purpose.
The Site uses cookies and similar technologies (such as local storage and tracking pixels) to operate correctly, understand how visitors use the Site, and improve our content and services.
You can control or delete cookies through your browser settings at any time. Most browsers allow you to refuse or delete cookies, though doing so may affect the functionality of the Site. You may also install the Google Analytics Opt-out Browser Add-on to prevent your data from being used by Google Analytics. Where required by law (including under the EU ePrivacy Directive and GDPR), we will obtain your consent before placing non-essential cookies and will provide a mechanism to withdraw that consent.
We use the information we collect for the following purposes:
We do not use your personal information to make decisions that produce legal or similarly significant effects about you through solely automated means (see Section 20), and we do not sell your personal information to third parties for their own independent marketing purposes.
If you are located in the European Economic Area, United Kingdom, or another jurisdiction that requires a documented legal basis for processing personal data, we rely on the following bases:
We do not sell, rent, or trade your personal information to third parties for their independent marketing purposes. We share information only in the following circumstances:
| Provider | Purpose | Data Shared |
|---|---|---|
| Stripe, Inc. | Payment processing for Flight + Stay, Full Itinerary, Done-For-You, and Club Membership purchases | Name, email, purchase amount and metadata (Stripe collects payment card details directly; we never receive or store full card numbers) |
| Gumroad, Inc. | Sale and delivery of digital city guides | Name, email, purchase details (payment handled entirely by Gumroad) |
| Formspree, Inc. | Processing of trip inquiry/booking form submissions | Name, email, phone (if given), trip details submitted in the form |
| Beehiiv, Inc. | Newsletter delivery and subscriber management | Email address, subscription and engagement status |
| Google LLC (Google Analytics / GA4) | Website traffic analytics | Device/browser data, IP-derived location, pages viewed, referral source |
| Vercel Inc. | Website hosting and content delivery | Standard server/request logs (IP address, timestamp, requested URL) |
Each of these providers is contractually and/or by policy restricted to using your information only to provide services to us, and each maintains its own privacy policy governing its handling of your data as an independent processor or, in limited cases (such as payment processing), an independent controller. We encourage you to review the privacy policies of Stripe, Gumroad, Formspree, Beehiiv, and Google.
Itineraries and site content may include links to third-party booking platforms and suppliers, including but not limited to airlines, Booking.com, hotel chain direct-booking sites, Viator, GetYourGuide, Omio, and similar travel platforms. When you click through to and transact on these third-party sites, you leave carryonco.net and your interaction is governed by that third party's own privacy policy and terms. We are not responsible for the privacy practices of these independent third parties, and we recommend reviewing their policies before providing any personal or payment information.
All payment card and financial account information is collected and processed directly by our third-party payment processors, Stripe and Gumroad, both of which are PCI-DSS compliant. The Carry-On Co. does not collect, transmit, or store your full payment card number, CVV, or bank account number at any point. We receive only confirmation that a payment was made, the amount, the associated product/service, and order metadata necessary to fulfill your purchase.
We retain personal information only for as long as reasonably necessary to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law. As general guidelines:
We implement reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, disclosure, alteration, and destruction, including the use of reputable, encrypted, industry-standard third-party processors (Stripe, Gumroad, Formspree, Beehiiv) for handling sensitive functions such as payments and communications, and HTTPS encryption for data transmitted to and from the Site. However, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of any account credentials associated with third-party platforms you use to interact with us (e.g., your Gumroad or Stripe account).
The Carry-On Co. is based in the United States, and the Services are operated from the United States. If you access the Site or Services from outside the United States, including from the European Economic Area, United Kingdom, or elsewhere, your information will be transferred to, stored, and processed in the United States and other jurisdictions where our service providers operate, which may have data protection laws different from those of your home jurisdiction. Where required, we and our service providers rely on appropriate safeguards for such transfers, including Standard Contractual Clauses or equivalent mechanisms adopted by our third-party processors (such as Stripe, Google, and Beehiiv, each of which maintains its own cross-border transfer compliance framework).
Depending on your jurisdiction, you may have some or all of the following rights regarding your personal information:
To exercise any of these rights, email us at hello@carryonco.net with the subject line "Privacy Request." We will respond within 30 days, or as otherwise required by applicable law, and may need to verify your identity before processing your request.
If you are located in the European Economic Area or United Kingdom, in addition to the rights listed in Section 13, you have the right to lodge a complaint with your local data protection supervisory authority if you believe our processing of your personal information violates applicable law. A list of EU supervisory authorities is available here; UK residents may contact the Information Commissioner's Office (ICO). We encourage you to contact us first at hello@carryonco.net so we can attempt to resolve any concern directly.
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA"), provides you with specific rights, including the right to know what personal information we collect, use, and disclose; the right to request deletion; the right to correct inaccurate information; the right to opt out of the "sale" or "sharing" of personal information (we do not sell or share personal information as those terms are defined under the CCPA); and the right not to be discriminated against for exercising these rights.
In the 12 months preceding the effective date of this Policy, we have collected the categories of personal information identified in Section 2, for the business purposes identified in Section 5, from the sources identified in Section 3, and disclosed such categories to the service providers identified in Section 7. We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age.
Residents of other U.S. states with comprehensive privacy laws (including but not limited to Virginia, Colorado, Connecticut, Utah, Oregon, Texas, and Montana) may have similar rights of access, correction, deletion, portability, and opt-out of targeted advertising or profiling. To exercise any applicable state-law right, contact us using the information in Section 24.
Some browsers offer a "Do Not Track" (DNT) signal. Because there is not yet a common industry standard for how to respond to DNT signals, the Site does not currently respond differently based on the receipt of a DNT signal. We will update this Policy if that practice changes.
The Site and Services are intended for adults capable of forming a legally binding contract and are not directed to individuals under the age of 18. We do not knowingly collect personal information from anyone under 18 years of age. If we become aware that we have inadvertently collected personal information from someone under 18, we will take reasonable steps to delete that information promptly. If you believe a minor has provided us with personal information, please contact us at hello@carryonco.net.
We only send newsletter and promotional emails to individuals who have affirmatively opted in via our Beehiiv signup form or by submitting the trip inquiry form and consenting to communications. Every marketing email includes a one-click unsubscribe link. Transactional emails relating to an order, inquiry, or booking you have initiated are not considered marketing and may continue even if you unsubscribe from the newsletter, as they are necessary to fulfill our contract with you.
You may request deletion of your personal data at any time by emailing hello@carryonco.net with the subject line "Delete My Data." We will honor verified deletion requests within 30 days, except where we are legally required or permitted to retain certain information (for example, transaction records required for tax compliance, or information needed to resolve disputes or enforce our agreements). Where full deletion is not possible, we will anonymize the data where feasible.
We do not use your personal information for automated decision-making, profiling, or algorithmic processing that produces legal or similarly significant effects concerning you (for example, we do not use automated systems to approve or deny bookings, set individualized pricing based on personal characteristics, or make eligibility determinations without human review).
In the event of a data breach affecting your personal information that creates a risk to your rights and freedoms, we will notify affected individuals and applicable regulators without undue delay and in accordance with applicable law (including, where relevant, the 72-hour notification requirement under GDPR Article 33 and applicable U.S. state breach notification statutes).
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will revise the "Last Updated" date at the top of this page and, where required by law, provide additional notice (such as a banner on the Site or an email to subscribers). We encourage you to review this Policy periodically. Your continued use of the Site or Services after any changes take effect constitutes acceptance of the revised Policy.
This Policy, and any dispute arising out of or relating to it or to our collection or use of your personal information, shall be governed by and construed in accordance with the laws of the State of Tennessee, United States, without regard to its conflict of laws principles, except to the extent that mandatory data protection laws of your country of residence (such as GDPR for EEA/UK residents, or the CCPA for California residents) apply and cannot be waived, in which case those mandatory provisions will govern to the extent required. Nothing in this Policy limits any non-waivable statutory rights you may have under the law of your place of residence.
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:
The Carry-On Co.
Email: hello@carryonco.net
Website: carryonco.net
We aim to respond to all privacy-related inquiries within 30 days.