Privacy Policy

PeakWave ("we", "us", "our") is operated by PeakWave LTD, a company registered in England and Wales (company number 17118746). Our registered office is 61 Leas Road, Warlingham, CR6 9LP.

PeakWave LTD is the data controller for the personal data processed through this platform. We provide an online platform at peakwave.co that connects seasonal workers ("candidates") with employers in the ski, yacht, watersports, and festival industries ("employers").

If you have any questions about this policy, you can reach us at hello@peakwave.co.

We collect the following categories of personal data:

Candidates

• Account information: name, email address, phone number, date of birth, nationality, gender
• Profile data: positions, preferred locations, qualifications, visa status, experience level, bio, languages, availability dates, profile photo, video introduction
• Activity data: last active timestamp, placement status, referral activity

Employers

• Account information: contact name, company name, email address, website
• Business data: business type, locations, roles hiring for

All users

• Messages: content of messages exchanged through the platform
• Technical data: IP address, browser type, device information, pages visited, and app interaction events

Companion and native app features

• Session tracking: location points, route, sport, timing, distance, elevation, speed, run count, wave count, and session notes when you start a tracking session
• Background location: location updates may continue while the screen is off during an active tracking session, only if you grant the relevant device permission
• Live crew location: if you choose to share with a confirmed crew, PeakWave stores a short-lived location marker until it expires or you stop sharing
• Motion data: optional experimental fall detection uses accelerometer readings during an active session to look for a hard fall followed by stillness
• Notifications and widgets: push subscription endpoints and keys if you enable push notifications, plus a local home-resort widget snapshot on your device
• Community content: forum posts, replies, crew chat messages, condition reports, reactions, vouches, profile links, and user reports you choose to submit

We use your personal data to:

• Create and maintain your account and profile on the platform
• Display candidate profiles to employers for the purpose of recruitment
• Enable messaging between candidates and employers through the platform
• Send transactional emails (account confirmation, message notifications, remain-available nudges)
• Record, display, sync, and delete your tracking sessions and live crew location shares when you choose to use Companion features
• Provide push notifications, in-app notifications, emails, widgets, Calls, Briefings, Passport, and Wrapped prompts according to your settings
• Process experimental fall-detection signals during active sessions when you enable the feature
• Moderate community and messaging content, including reports submitted by users
• Track referrals and administer the referral programme
• Analyse usage patterns to improve the platform (via PostHog, no data is sold to third parties)
• Prevent fraud and maintain the security of the platform

Under UK GDPR, we process your data on the following bases:

• Contract: processing necessary to provide the platform services you signed up for (account creation, profile display, messaging)
• Consent: optional analytics cookies
• Legitimate interest: platform security, fraud prevention, and service improvements

We do not sell your personal data to anyone. We share data with the following categories of recipients only as necessary to operate the platform:

• Supabase (database and authentication hosting, EU West region)
• Vercel (website hosting)
• Resend (transactional email delivery)
• PostHog (privacy-focused product analytics)
• Google (analytics and advertising measurement, where configured)
• Browser or platform push services (push notification delivery, if you enable notifications)
• Cloudflare (DNS and security)

Candidate profile data (name, positions, locations, qualifications, photo, bio, video) is displayed to authenticated employers on the platform. Email and phone number are hidden by default and only shared at the candidate's discretion.

We retain your account and profile data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where we are required by law to retain it.

Messages are retained for 12 months after the conversation ends, then permanently deleted.

Tracked sessions synced to your account are retained until you delete the session, delete your tracking data, or delete your account. Local-only sessions remain on your device until you delete them or clear app data.

Live crew location shares expire at the next UTC midnight unless you stop sharing earlier. Push subscriptions are removed when you unsubscribe or when delivery fails.

Reported community content and moderation records are retained as needed to protect the service, enforce our terms, and meet legal obligations.

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten")
• Restrict processing of your data
• Object to processing based on legitimate interest
• Data portability: receive your data in a structured, machine-readable format
• Withdraw consent at any time (where processing is based on consent)

To exercise any of these rights, email us at hello@peakwave.co. We will respond within 30 days.

We use PostHog for product analytics, and Google Analytics or Google Ads measurement where configured. These tools help us understand how people find and use PeakWave. We do not sell your personal data.

You can opt out of analytics by disabling cookies in your browser settings, using a browser extension such as uBlock Origin, or adjusting device privacy settings in the native app.

We take reasonable technical and organisational measures to protect your data, including:

• Encryption in transit (HTTPS/TLS) and at rest
• Row-level security on all database tables (Supabase RLS)
• Authentication via secure password hashing (bcrypt)
• Regular security reviews of code and infrastructure

PeakWave is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at hello@peakwave.co and we will delete it promptly.

We may update this privacy policy from time to time. If we make significant changes, we will notify you via email or a notice on the platform. The "last updated" date at the top of this page indicates when the policy was last revised.

If you have any questions or concerns about this privacy policy or how we handle your data, please contact us:

PeakWave LTD
61 Leas Road, Warlingham, CR6 9LP
hello@peakwave.co

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been handled unlawfully.