Legal
Privacy policy
Side Quest Booking is booking software used by dive schools, charters and other activity businesses. This page explains what we collect, why, who else sees it, how long we keep it, and what you can ask us to do with it.
Who we are
Side Quest Booking is operated by MitchBrownPhotoFreediving LLC, in Hawaii, United States. You can reach us at [email protected].
If you booked with a business that uses Side Quest Booking
Your booking is with that business, not with us. They decide what to ask you and what to do with your answers; we hold your details for them and on their instructions. If you want to see, correct or remove your details, contact the business you booked with first. We will act on their request, and if you cannot reach them, write to us and we will help.
What is collected
When you book
- Your name, email address and phone number.
- Your date of birth, if the business has an age limit.
- Practical details such as gear sizes and check-in status.
- Your answers to the business's questions. For diving and freediving this often includes health questions, such as asthma, heart conditions or medication.
- Your signature and the waiver you signed. If you are booking for a child, the guardian's name and relationship to the child.
- What you paid, any refunds, and any tip you chose to leave.
When your business uses Side Quest Booking
- Your team's names, email addresses and roles.
- Sign-in records, including the IP address and browser used.
- Your business details, prices, schedule and payment settings.
What is not collected
- Card numbers. Card details go straight to our card payment processor. We never see or store them.
- PayPal and Venmo sign-ins. Those happen on PayPal's own pages.
Health answers
Health answers are handled with extra care. Crew working the day see only whether a guest is cleared to take part, never the answers themselves. Our own support staff cannot see them unless the business's owner grants a separate, time-limited permission, and every use is logged where the business can read it.
How we measure booking pages
To show businesses where people get stuck, booking, form, waiver, gift card, tip and booking-management pages record anonymous steps, such as "date picked" or "waiver started", and how long a step took.
- No cookie is used. A random number is kept in your browser tab and disappears when you close it.
- No name, email or phone number is sent with these steps, and we do not record what you type.
- We use no advertising trackers, no third-party analytics and no cross-site tracking. The only cookie we set keeps business staff signed in to their dashboard.
Why we use it
- To take and manage your booking, send you confirmations and reminders, and let the business run the day safely.
- To take payments and give refunds.
- To answer support questions and keep the service secure.
- To meet legal duties, such as keeping payment records for tax.
We do not sell your information, share it for advertising, or market to a business's customers.
Connecting Google Calendar
A business can choose to connect a Google account. When it does:
- We use the account's email address to identify the connection, and list the calendars it can write to so the business can choose one.
- Side Quest Booking creates, updates and removes its own schedule events in the chosen calendars. If calendar read-back is turned on, it reads changes to its own events to update crew assignments. Other events are not stored.
- We store the connected email, the chosen calendars, settings, encrypted access tokens, and references to the events we manage. These can include crew names and email addresses.
- Google information is used only for these features, in line with Google's API Services User Data Policy, including its Limited Use requirements. It is never sold, used for advertising, or used to train AI models.
- The business can disconnect at any time in Side Quest Booking, or from its Google account settings. Disconnecting removes the connection and its tokens. Events already written stay in Google Calendar.
Who else sees it
| Who | What they get | Why |
|---|---|---|
| The business you booked with | Your booking, answers and signed documents | So they can run your activity |
| Stripe | Amount, booking reference and the payer's contact details. Card details go to them, not us. | Card and wallet payments |
| PayPal | Amount and booking reference, if you choose PayPal or Venmo | PayPal and Venmo payments |
| Email address, name and the email itself | Sending booking emails | |
| Cloudflare | Web traffic passing through, including IP address, and our encrypted backups | Protecting the site, and storing backups off site |
If a business connects its own Google Calendar, schedule details are copied there for that business. We may change email provider; if we do, this list is updated first.
Where it is kept
On our own servers in Hawaii, United States. Encrypted backups are also kept at a second location and in Cloudflare's storage. If you are outside the United States, your information is transferred here.
How long it is kept
| Information | Kept for |
|---|---|
| Health answers | 90 days after your activity. Whether you were cleared is kept. |
| Date of birth | 90 days after your activity, then only the year |
| Other answers to the business's questions | 2 years after your activity |
| Signed waivers | 10 years after your activity, or until a child turns 20 if later |
| Bookings and payments | 10 years, for tax and in case of a claim |
| Emails sent to you | 12 months |
| Staff sign-in records | 90 days |
Your choices
Depending on where you live, you may be able to see a copy of your information, correct it, have it removed, or object to how it is used. Guests should contact the business they booked with; business staff can write to us directly.
One limit, said up front: a signed waiver cannot be removed on request during its keeping period. It is the record of an agreement between you and the business, and they may need it if there is a claim. Your contact details and answers can otherwise be removed. Encrypted backups are kept for up to 90 days, so removed information leaves the last backup within 90 days.
Children
Businesses may take bookings for children. A child cannot sign their own waiver: a parent or guardian signs, and their name and relationship are recorded. Side Quest Booking is not aimed at children, and a parent or guardian should make the booking.
Security
Each business's information is kept apart inside the database itself. Passwords are stored hashed, sensitive keys are encrypted, and our support staff need the owner's approval to look inside a business's account. No service can promise perfect security, but if your information is exposed, we will tell the affected businesses within 72 hours of finding out.
Changes
If we change this policy in a way that matters, we will update the date at the top and tell businesses using Side Quest Booking before it takes effect.