Privacy Policy

PeakWave ("we", "us", "our") is operated by PeakWave LTD, a company registered in England and Wales (company number 17118746). Our registered office is 61 Leas Road, Warlingham, CR6 9LP.

PeakWave LTD is the data controller for the personal data processed through this platform. We provide an online platform at peakwave.co that connects seasonal workers ("candidates") with employers in the ski, yacht, watersports, and festival industries ("employers").

If you have any questions about this policy, you can reach us at hello@peakwave.co.

We collect the following categories of personal data:

Candidates

• Account information: name, email address, phone number, date of birth, nationality, gender
• Profile data: positions, preferred locations, qualifications, visa status, experience level, bio, languages, availability dates, profile photo, video introduction
• Activity data: last active timestamp, placement status, referral activity

Employers

• Account information: contact name, company name, email address, website
• Business data: business type, locations, roles hiring for

All users

• Messages: content of messages exchanged through the platform
• Technical data: IP address, browser type, device information, pages visited, and app interaction events

Companion and native app features

Optional Google Calendar connections use calendar names and selected busy intervals to help you plan free time. We cannot read event titles, descriptions or guests, or edit events. Selected calendar identifiers, date ranges and generic busy intervals are stored privately; the refresh credential is encrypted. Calendar names are shown during selection and are not saved. Disconnecting removes the connection and its imported intervals. If Google is unavailable, the encrypted revocation request is retained for at most seven days. You can also remove access in your Google Account.

Google Calendar data is used only for the planning features you choose. Derived free windows are shared only with friends and dates you explicitly select. This data is not used for advertising, sold, or used to train AI models. PeakWave follows the Google API Services User Data Policy, including its Limited Use requirements.

Rota image recognition runs on your device. The image and extracted text are discarded; only busy times you review and confirm are saved. Your Companion data download lets you choose and save your private records. Keep downloaded files somewhere you trust.

• Private Freestyle clips: videos you select, descriptions, trick or moment names, activity, filming date and upload permission confirmation. Original files are held privately in Supabase while Mux prepares video and poster copies for private playback. Your device keeps upload recovery details, without a copy of the video or its upload token. If you choose community sharing, we also store the reviewed audience, votes, comments and moderation records. Optional contest entry records your consent, qualifying votes, result revisions and private trophy history.
• Session tracking: precise GPS location points, route, sport, timing, distance, elevation, speed, run count, wave count, and session notes when you start a tracking session
• Piste comparisons: if you explicitly publish a piste time, we process that recording's GPS points to estimate your passage through fixed gates. This feature does not retain the uploaded trace. It stores your chosen public name, section, activity, date, timing estimate, uncertainty and compact source identifiers. Your published name and result appear on public comparison boards until withdrawn or hidden after review. You can download your results and reports; deleting your account removes these records.
• Background location: location updates may continue while the screen is off during an active tracking session, only if you grant the relevant device permission
• Live crew location: if you choose to share with a confirmed crew, PeakWave stores a short-lived location marker until it expires or you stop sharing
• Motion data: optional experimental fall detection processes accelerometer readings on your device during an active session to look for a hard fall followed by stillness. Raw motion readings are not included in the session backup
• Notifications and widgets: push subscription endpoints and keys, or an Apple or Android delivery token, if you enable push notifications. App tokens expire after seven days without renewal; disabled registration records are removed after thirty days. Notifications contain generic copy. We also store a local home-resort widget snapshot on your device
• Community content: forum posts, replies, crew chat messages, condition reports, reactions, vouches, profile links, and user reports you choose to submit
• Event submissions: if you add an event, for example from an area page, we store what you enter (the event name, venue, nearest place, date and times, category, link and description) with the account that sent it. You must be signed in to add an event. We review every submission before it is published; a published listing shows the event details, never your name or email address

We use your personal data to:

• Create and maintain your account and profile on the platform
• Display candidate profiles to employers for the purpose of recruitment
• Enable messaging between candidates and employers through the platform
• Send transactional emails (account confirmation, message notifications, remain-available nudges and one-tap checks that your availability is still current)
• Send occasional PeakWave news and conditions updates by email, only if you tick the optional box at signup or turn it on in Settings. You can turn it off in Settings at any time
• Record, display, sync, and delete your tracking sessions and live crew location shares when you choose to use Companion features
• Provide push notifications, in-app notifications, emails, widgets, Calls, Briefings, Passport, and Wrapped prompts according to your settings
• Process experimental fall-detection signals during active sessions when you enable the feature
• Moderate community and messaging content, including reports submitted by users
• Review event submissions before they appear on PeakWave, and email our team when a new one arrives, with the event details you entered
• Track referrals and administer the referral programme
• Tell businesses that recruit seasonal staff about PeakWave (see section 6, Business contacts)
• Analyse usage patterns to improve the platform (via PostHog, no data is sold to third parties)
• Prevent fraud and maintain the security of the platform

Under UK GDPR, we process your data on the following bases:

• Contract: processing necessary to provide the platform services you signed up for (account creation, profile display, messaging)
• Consent: optional analytics cookies, and news and conditions update emails if you opt in
• Legitimate interest: platform security, fraud prevention, service improvements, featuring candidate profile summaries on public pages so employers can find them (see section 5, and you can opt out at any time), and telling businesses that recruit seasonal staff about PeakWave (see section 6)

We do not sell your personal data to anyone. We share data with the following categories of recipients only as necessary to operate the platform:

• Supabase (database and authentication hosting, EU Central region)
• Vercel (website hosting)
• Mux (processing, storage and private delivery of Freestyle videos and posters when you upload a clip)
• Resend (transactional email delivery)
• PostHog (privacy-focused product analytics)
• Google (optional Calendar connections, Android notification delivery through Firebase Cloud Messaging, and analytics or advertising measurement where separately configured)
• Browser or platform push services (push notification delivery, if you enable notifications)
• Cloudflare (DNS and security)

Full candidate profiles (name, age, nationality, right to work, positions, locations, qualifications, languages, photo, bio and video) are displayed only to employers signed in to the platform, to the candidate, and to candidates they have linked with through "travelling with". Anyone else who opens a profile link, including search engines, sees only the short public summary described below, and nothing at all if the candidate has opted out of being featured. We tell search engines not to index candidate profiles.

On public pages, such as our homepage, festival pages and the candidate directory for visitors who are not signed in as an employer, we may feature a short profile summary to help employers find you: your first name and the initial of your surname, your profile photo, the roles you are looking for, your seasons, dates, preferred places and how recently you were active. Profile photos and surname initials appear only once we have switched them on; until then a summary shows your first name only. We never show your full surname, age, nationality, right to work or contact details on these pages. Email and phone number are hidden by default and only shared at the candidate's discretion.

We do this on the basis of our legitimate interest in helping candidates get hired, which is why you created a profile. Every candidate is included by default. You can opt out at any time with the public showcase setting in your profile or by emailing hello@peakwave.co, and your summary will be removed from public pages. We told existing candidates by email before we started showing profile photos.

We may tell employers who are recruiting, in anonymised or aggregated form, how many candidates are available for a role, place and period, and whether they have said they have the right to work there.

Event listings from other sources

Some events on area pages come from public event feeds: DATAtourisme (France, under Licence Ouverte 2.0), Eventfinda, Ticketmaster and Skiddle. Each listing names its source and links to the source's own event page. We fetch these listings on our servers and do not send these sources any personal data about you.

Ticketmaster: some event information on PeakWave is provided by the Ticketmaster Discovery API. When you follow a Ticketmaster link you leave PeakWave, and Ticketmaster collects and uses data under its own privacy policy, available at privacy.ticketmaster.com. The same applies to the other sources' pages under their own policies.

This section explains how we handle personal data about people who work for businesses that recruit seasonal staff, such as ski and tour operators, chalet companies, hotels, yacht and watersports businesses and festival organisers, when we did not collect that data from you directly. It is the information we must give you under Article 14 of the UK GDPR.

What we hold

Your name, work email address, job title and the company you work for, together with public business information such as the company's website, location, the seasons and roles it recruits for and whether it is advertising vacancies. We also keep a record of the emails we send you, whether they were delivered, and your replies, including any request not to be contacted.

Where it comes from

• Company websites and public job adverts
• Instantly SuperSearch, a business contact data provider
• Apollo, a business contact data provider we used in the past

Why we use it and our lawful basis

We use it to tell businesses that recruit seasonal staff about PeakWave, which is free for employers and candidates, and to follow up when you reply. Our lawful basis is legitimate interests: letting relevant businesses know about a free way to find seasonal staff. We only write to work addresses about your company's recruitment, we keep emails short and infrequent, and every email tells you how to opt out. In the UK we only email limited companies, LLPs and PLCs, never sole traders or ordinary partnerships. In France we only write to professional addresses about the recipient's role. We never email consumers, and we only send these emails where the law allows it without prior consent.

Who we share it with

We use Instantly to send these emails and record deliveries and replies, Bouncer to check that an email address can receive mail, and Google Workspace to host our email. They process the data on our instructions. We do not sell business contact data. Some of these providers process data outside the UK; where they do, we rely on the safeguards in their data processing terms, such as UK adequacy regulations or the UK International Data Transfer Addendum.

How long we keep it

We keep outreach data for up to 24 months after our last contact with you, then delete it. If you ask us not to contact you, we keep a minimal suppression record (your email address and the date you opted out) so that we never contact you again.

Your rights and how to opt out

You can object to these emails at any time and we will stop. Reply "stop" to any email, or write to hello@peakwave.co. You also have the rights listed in section 8, including access, correction and erasure, and the right to complain to the ICO. If you create an employer account, the rest of this policy applies to you as an employer.

Removing a Freestyle clip or deleting your account immediately removes the clip from your collection and prevents new playback access. Previously issued playback links expire within three minutes; downloaded copies cannot be recalled. Original uploads remain until their upload access expires, with a short margin for requests already in progress. Processing and deletion failures keep a private cleanup record so removal can be retried. Completed cleanup records are kept for 30 days. Signing out hides device upload drafts; account deletion removes them from that device.

If you enter a Freestyle contest, ending your stay does not remove an earned private trophy. Changing or removing supporting evidence can correct a result or retract an award. After clip removal, your private history may retain the trick name and retracted award, without its video. This history is not added to public Passport. Deleting your account removes your judging entries and award history.

Request deletion of your PeakWave account and personal data. This option is available on the web without reinstalling the app, including for accounts with employer access.

We retain your account and profile data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where we are required by law to retain it.

Messages remain in your conversation history until they are removed through account deletion or a data deletion request. We do not currently delete conversations automatically after a fixed period.

Tracked sessions synced to your account are retained until you delete the session, delete your tracking data, or delete your account. Local-only sessions remain on your device until you delete them or clear app data.

Live crew location shares expire at the next UTC midnight unless you stop sharing earlier. Push subscriptions are removed when you unsubscribe or when delivery fails.

Reported community content and moderation records are retained as needed to protect the service, enforce our terms, and meet legal obligations.

Event submissions waiting for review expire when the event ends. The private record of a submission that was rejected, withdrawn or expired is deleted 90 days after its last change; for a published event it is deleted 180 days after the event ends. Records of our moderation decisions are kept for two years. Daily submission limit counters are deleted when they expire.

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten")
• Restrict processing of your data
• Object to processing based on legitimate interest
• Data portability: receive your data in a structured, machine-readable format
• Withdraw consent at any time (where processing is based on consent)

To exercise any of these rights, email us at hello@peakwave.co. We will respond within 30 days.

Google advertising and measurement are disabled in the native iOS and Android apps. Optional PostHog product analytics remains subject to your consent.

Your analytics choice also applies to optional server-side product events. The native app disables automatic content capture and session replay. We do not use your precise location, activity or motion data for advertising and do not sell this data.

We use PostHog for product analytics, and Google Analytics or Google Ads measurement where configured. These tools help us understand how people find and use PeakWave. We do not sell your personal data.

These optional browser analytics tools do not load unless you accept analytics cookies. Rejecting them does not affect the core PeakWave service. You can accept, reject, or change your choice at any time using Cookie settings in the footer.

We take reasonable technical and organisational measures to protect your data, including:

• Encryption in transit (HTTPS/TLS) and at rest
• Row-level security on all database tables (Supabase RLS)
• Authentication via secure password hashing (bcrypt)
• Regular security reviews of code and infrastructure

PeakWave is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at hello@peakwave.co and we will delete it promptly.

We may update this privacy policy from time to time. If we make significant changes, we will notify you via email or a notice on the platform. The "last updated" date at the top of this page indicates when the policy was last revised.

If you have any questions or concerns about this privacy policy or how we handle your data, please contact us:

PeakWave LTD
61 Leas Road, Warlingham, CR6 9LP
hello@peakwave.co

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been handled unlawfully.