WONDERLY
Privacy Policy
Global Edition — covers both the B2C Application and the B2B Tour Operator Subsystem
Effective Date: August 24, 2026
Owned and operated by Product Savvy Consulting
THIS POLICY DESCRIBES HOW PRODUCT SAVVY CONSULTING COLLECTS, USES, SHARES, AND PROTECTS PERSONAL DATA THROUGH WONDERLY, INCLUDING PRECISE LOCATION DATA USED BY PACK RADAR AND NAVIGATION FEATURES. IT APPLIES TO INDIVIDUAL USERS (“TRAVELERS”) AND, WHERE NOTED, TO INFORMATION PROCESSED ON BEHALF OF TOUR OPERATORS. IT SHOULD BE READ TOGETHER WITH THE WONDERLY B2C TERMS & CONDITIONS, THE WONDERLY B2B TERMS & CONDITIONS, AND, FOR TOUR OPERATORS, THE DATA PROCESSING ADDENDUM.
1. Introduction and Scope
This Privacy Policy explains how Product Savvy Consulting (“Product Savvy,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal data in connection with the Wonderly group-travel platform, including the consumer (B2C) application and the Tour Operator (B2B) subsystem (together, the “Service”).
This Policy applies globally. Because Wonderly does not restrict itself to a single primary market, we apply the protections described in this Policy — including the data-subject rights described in Section 10 — to all Users, regardless of where they are located, except where a right or mechanism (such as the right to lodge a complaint with a specific supervisory authority) is by its nature specific to a particular jurisdiction.
This Policy does not, on its own, form a contract. Your use of the Service is also governed by the Wonderly B2C Terms & Conditions and EULA or, if you access the Service through a Tour Operator, the Wonderly B2B Terms & Conditions and EULA, which are incorporated by reference.
2. Who We Are
Product Savvy Consulting LLC, a Maryland limited liability company, with its registered address at 1 Research Ct, Suite 450, Rockville, MD 20850, USA, is the controller of personal data described in this Policy, except where this Policy states that a Tour Operator acts as controller (Section 13).
Contact: support@productsavvy.com.
Product Savvy has no office, subsidiary, or employees in the European Union, the European Economic Area, or the United Kingdom, and has made a business decision not to appoint a representative under GDPR Art. 27 or UK GDPR Art. 27 at this time. Product Savvy is aware that, given the Service's global availability and its use of continuous location-tracking features (Pack Radar, navigation tracking), this may not fall within the limited exemption from the Art. 27 representative requirement, and has accepted that risk. Individuals in the EU/EEA/UK may still exercise the rights described in Section 10.1 by contacting us directly at the address above.
3. Information We Collect
3.1 Information you provide to us
Account and profile information: name, email address, password, profile photo, headline, “about you” text, home city, and similar fields you choose to complete or share via Nearby Discovery.
Trip, Group, and Activity content: trip names, routes, waypoints, itineraries, descriptions, marketing images, and related content you or a Group you belong to create.
Group Chat metadata: sender, timestamp, and delivery/read-state information. Group Chat message content is end-to-end encrypted; Product Savvy cannot read the content of your messages.
Support and correspondence: information you provide when you contact us for support or otherwise communicate with us.
3.2 Information collected automatically
Precise and approximate location data, collected when you enable navigation, Pack Radar, or related location-sharing features, at sampling intervals that vary by transportation mode.
Device and usage data: device identifiers, operating system, app version, IP address, general geographic area derived from IP address, crash logs, and in-app activity (features used, session length, and similar diagnostics).
Cookies and similar technologies used on our marketing website and, where applicable, in-app, as described in Section 4.
3.3 Information from Tour Operators and other Users
If a Tour Operator adds or imports you as a traveler (including via CSV import), it provides us with your first name, last name, and email address, and represents to us that it had a lawful basis to do so (see the B2B Terms, Section 9).
If another User invites you to a Group, forms a Group with you, or shares a Trip with you, we receive information about that connection and the shared content.
3.4 Payment information
Paid subscriptions are processed by our payment processor, Stripe. Product Savvy does not itself store full payment card numbers; Stripe collects and processes that information subject to its own privacy policy and terms.
4. Cookies and Similar Technologies
As of the Effective Date, Product Savvy does not use analytics, advertising, or tracking cookies or pixels on the Wonderly marketing website or in the Application beyond what is strictly necessary for the site or app to function (for example, session and authentication cookies). If we begin using analytics, advertising, or other non-essential cookies in the future, we will update this Policy, name the specific tools in use, and, where you are located in the EU/EEA/UK or another jurisdiction requiring it, implement a cookie-consent mechanism offering granular opt-in before any non-essential cookie is set.
5. How We Use Information and Our Legal Bases
We use personal data for the following purposes. For Users in the EU/UK/EEA, we identify the legal basis we principally rely on under the GDPR/UK GDPR for each purpose; other jurisdictions' laws may characterize these bases differently.
To provide and operate core features — accounts, profiles, Groups, Trips, RSVPs, chat, and related functionality (performance of a contract with you).
To provide navigation, Pack Radar, and other location-based features you enable (performance of a contract, and, where required by applicable law for precise location data, your consent).
To process billing and manage subscriptions (performance of a contract; compliance with legal obligations such as tax and accounting law).
To generate anonymized Public Trip snapshots from Trips that reach “Ready” status, as described in the B2C Terms (our legitimate interest in operating a discovery feature, balanced against the anonymization protections described there).
To maintain safety, investigate misuse, prevent fraud, and enforce our Terms (legitimate interests in protecting the Service and its Users, and compliance with legal obligations).
To analyze, maintain, and improve the Service, including generating aggregated or de-identified analytics and, where using personal data (rather than de-identified or aggregated data) to train or improve artificial-intelligence or machine-learning models, only where we have identified an appropriate legal basis, including your consent where required (legitimate interests, or consent where required).
To send you service communications (performance of a contract; legitimate interest) and, where you have opted in, marketing communications about new features, tips, or offers (consent, which you may withdraw at any time — see Section 6).
To comply with legal obligations, respond to lawful requests from public authorities, and establish, exercise, or defend legal claims (legal obligation; legitimate interest).
6. Marketing Communications and Your Choices
As of the Effective Date, Product Savvy does not send marketing emails or marketing push notifications. We may introduce marketing communications in the future. Before we do, where required by applicable law, we will implement an opt-in consent mechanism (such as an account-setup or in-app preference toggle) and will not send marketing communications to you unless you have opted in through that mechanism or another lawful basis applies. Once introduced, you will be able to opt out of marketing communications at any time by using the unsubscribe link in any marketing email, adjusting your in-app notification settings, or contacting us using the information in Section 19. Opting out of marketing communications will not opt you out of transactional or service communications necessary to operate your account (such as security alerts, billing notices, or safety-related messages), which you will continue to receive unless you delete your account.
7. How We Share Information
With other Users, according to your settings — for example, Group members can see Group Trips, and Nearby Discovery participants see the fields you have opted to share (see the B2C Terms and in-app privacy controls).
With a Tour Operator, if you are a traveler under that Operator — limited to your matched profile information and your activity within that Operator's own Groups, never your other trips, groups, or activity outside that engagement (see Section 13 and the B2B Terms, Section 7).
With service providers and sub-processors who process personal data on our behalf: Google LLC (Google Maps Platform — mapping, directions, places, geocoding), Mapbox, Inc. (offline map data), Stripe, Inc. (payment processing), and Supabase, Inc. (database and authentication hosting). This is the complete current list of sub-processors as of the Effective Date; we will update this Policy before engaging any additional sub-processor.
For legal reasons — to comply with law, respond to lawful requests, protect the rights, property, or safety of Product Savvy, our Users, or the public, or enforce our Terms.
In connection with a business transaction — a merger, acquisition, financing, reorganization, or sale of assets, subject to standard protections for transferred personal data.
Aggregated or de-identified data that cannot reasonably be used to identify you may be shared without restriction.
Product Savvy does not sell personal information for monetary or other valuable consideration, and does not share personal information (including precise location, device identifiers, or email addresses) with any third party for cross-context behavioral advertising, as those terms are used in the CCPA/CPRA and similar state laws.
8. International Data Transfers
Wonderly's application data is hosted in Canada. Product Savvy Consulting LLC is organized in the United States, and certain of our sub-processors (Stripe, Google Maps, and Mapbox) are U.S. companies that may process data in the United States. Wonderly is used globally, so personal data may be accessed from, stored in, and transferred to countries other than the one in which you reside.
Where we transfer personal data of individuals in the EU, EEA, UK, or Switzerland to Canada, we rely on the applicable adequacy decisions recognizing Canada (in relation to organizations subject to Canadian federal privacy law) as providing an adequate level of protection, so no additional transfer mechanism is generally required for that transfer. Where personal data is transferred to the United States or another country not covered by an adequacy decision — for example, in connection with our use of Stripe, Google Maps, or Mapbox — we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or the relevant sub-processor's own participation in the EU-U.S. Data Privacy Framework, to the extent applicable.
9. Data Retention
We retain personal data for as long as needed to provide the Service and for legitimate business or legal purposes, including resolving disputes and enforcing our agreements. In general:
Account and profile data is retained until you delete your account, subject to Section 6.3 of the B2C Terms (some data is retained after deletion where the license described there applies, or where required by law); we retain such data only for as long as reasonably necessary for those purposes.
For travelers engaged through a Tour Operator, trip history tied to a Group is soft-hidden from your own account view once that Group reaches End of Life, but the underlying records remain accessible to the Tour Operator for 12 months following End of Life before deletion.
Billing records are retained as required by applicable tax, accounting, and financial recordkeeping law.
10. Your Privacy Rights
10.1 If you are located in the EU, EEA, UK, or Switzerland
Subject to certain exceptions and conditions under applicable law, you have the right to: request access to your personal data; request correction of inaccurate data; request erasure of your data; request restriction of processing; request portability of data you provided to us; and object to processing based on our legitimate interests, including for direct marketing. Where we rely on your consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal. You also have the right to lodge a complaint with your local data protection supervisory authority.
10.2 If you are located in California or another U.S. state with a comprehensive privacy law
Depending on your state of residence, you may have rights to: know what personal information we have collected about you; delete personal information; correct inaccurate personal information; opt out of the “sale” or “sharing” of personal information (we do not sell personal information for money, and believe we do not “share” it for cross-context behavioral advertising, subject to confirmation per Section 7); limit the use of sensitive personal information, which may include precise geolocation data collected through Pack Radar and navigation features; and not be discriminated against for exercising these rights. You may designate an authorized agent to exercise these rights on your behalf, subject to verification.
10.3 Other jurisdictions
If you are located in Canada, Australia, Brazil, or another jurisdiction with its own data protection law, you may have similar rights under that law (for example, PIPEDA in Canada, the Privacy Act in Australia, or the LGPD in Brazil). We will honor requests made under such laws to the extent they apply to you.
10.4 How to exercise your rights
For account deletion, use the in-app account deletion flow described in the B2C Terms. For other requests, contact us using the information in Section 19. We may need to verify your identity before fulfilling a request, and we will respond within the timeframe required by applicable law (for example, generally 30 days under the GDPR/UK GDPR, or 45 days under the CCPA/CPRA, each subject to permitted extensions).
11. Precise Location Data — Special Notice
Pack Radar, navigation location tracking, and related features rely on your device's precise geolocation. Precise location data is treated as a sensitive category of data under several privacy laws (including the CPRA). We collect it only where you enable the relevant feature, apply role- and Group-based access controls so that only the participants and, in the B2B context, the Tour Operator's own Group, can view it, and let you disable location-sharing features at any time in-app, subject to the functional limitations described in the Terms. Historical navigation location samples are subject to row-level-security controls and the retention practices described in Section 9.
12. Children's Privacy
Wonderly is not directed to children under the minimum age described in the B2C Terms (generally 16, or the minimum age of digital consent in your jurisdiction if higher, or the minimum age of digital consent in your jurisdiction if lower and locally permitted). We do not knowingly collect personal information from anyone below that age. If we learn that we have done so without the consent required by law, we will take reasonable steps to delete the information and deactivate the associated account. A parent or guardian who believes we may have collected information from a child should contact us using the information in Section 19.
13. Tour Operator (B2B) Notice — Your Data When You Join an Operator's Group
If you engage with Wonderly as a traveler under one or more Tour Operators, this section explains how your data is handled in that context, consistent with the B2B Terms.
You keep a single global Wonderly account. Personal (B2C) activity and operator-affiliated activity are unified in your own logged-in experience.
A Tour Operator only ever has access to your matched profile information and to activity occurring within that Operator's own Groups — never your other trips, groups, or activity outside that engagement, including your activity with other Tour Operators.
For personal data the Tour Operator provides to us or that we process on its behalf (for example, via CSV import), the Tour Operator is the controller and Product Savvy acts as processor, under the terms of a Data Processing Addendum available to Tour Operators. Requests regarding that data may need to be directed to the relevant Tour Operator in the first instance, consistent with applicable law.
Once a Group reaches End of Life, your trip history tied to that Group is soft-hidden from your own account view, but remains accessible to the Tour Operator for its own recordkeeping, as described in Section 9.
14. Security
We use technical and organizational measures designed to protect personal data, including encryption of data in transit and at rest, and role- and Group-scoped access controls limiting who can view Group, Trip, and location data to the participants and, in the B2B context, the relevant Tour Operator's own team. Internal access by Product Savvy personnel, including the platform-administration access described in the B2B Terms Section 12, is limited to what is needed for support, billing, or platform-integrity purposes.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Product Savvy does not currently hold a third-party security certification (such as SOC 2 or ISO 27001) and does not represent that it does.
15. Data Breach Notification
If we become aware of a security incident affecting your personal data, we will notify affected individuals and, where required, applicable regulators and Tour Operators, without undue delay and in accordance with applicable law and, for Tour Operators, the notification commitments in the Data Processing Addendum.
16. Automated Decision-Making
Product Savvy does not make any decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you. Where the Service takes automated action that affects your access — for example, locking a Tour Operator account after a payment failure that is not resolved within the grace period described in the B2B Terms — that action is based on objective, disclosed account and billing status rather than profiling, and does not involve automated decision-making of the kind regulated under GDPR Art. 22 or similar laws.
17. Do Not Track
Some browsers offer a “Do Not Track” signal. Because there is no accepted industry standard for responding to such signals, we do not currently respond to them differently than we would otherwise. [To be revisited if/when a jurisdiction-specific legal requirement to honor such signals applies to Product Savvy, e.g., under evolving U.S. state law such as California's opt-out preference signal requirements.]
18. Changes to This Policy
We may update this Policy from time to time. If we make material changes, we will provide notice through the Service, by email, or by other reasonable means, and will update the “Effective Date” above. Your continued use of the Service after changes become effective constitutes acceptance of the revised Policy, except where applicable law requires your affirmative consent to the change, in which case we will seek that consent.
19. Contact Us
If you have questions about this Policy or wish to exercise a privacy right, contact us at: Product Savvy Consulting LLC, 1 Research Ct, Suite 450, Rockville, MD 20850, USA — support@productsavvy.com. As noted in Section 2, Product Savvy has not appointed a representative in the EU or UK under GDPR/UK GDPR Art. 27; EU/UK individuals should use the contact information above.