Privacy policy

socotra.guide is an independent travel and photography guide for Socotra island. This page explains what we collect, why we are allowed to, who else sees it, how long we keep it, and what you can make us do about it. It is written to cover everything Article 13 of the GDPR requires, in plain English rather than in the usual boilerplate.

Who runs this site

socotra.guide is operated by Martin Bonov (KICKFLIP, Sofia, Bulgaria), who is the data controller for everything described here. For any privacy question, or to exercise any of the rights below, write to office@socotra.guide.

We have not appointed a data protection officer. That address reaches the person who actually decides how this site handles data.

What we collect, why, and on what legal basis

We collect four things. Three of them only happen because you did something. The fourth is an anonymous count of visits that stores nothing on your device.

Trip inquiries

When you submit the inquiry form we store what you typed: your name, your email, and optionally your phone or WhatsApp number, your country, the month you are thinking of, how many days you want on the island, how many of you are travelling, which operator you would prefer, what you are hoping to do, and anything you write in the message box. Two things are attached automatically: the page or search that sent you to us, and any campaign tags (utm_source, utm_medium, utm_campaign) present in the address bar, so we can tell which writing brings people here.

Purpose: to answer you and to introduce you to a Socotra tour operator who can quote for the trip.

Legal basis: Article 6(1)(b) GDPR, steps taken at your request before entering into a contract. You asked to be put in touch; this is what being put in touch requires.

How long: 24 months after the last message exchanged about that inquiry, then the record is deleted. We keep it that long because trips to Socotra are often planned one season and taken the next.

Email you send us directly

If you write to office@socotra.guide rather than using the form, we hold that message and your address in our mailbox on the same terms: to answer you, under Article 6(1)(b) where you are asking about a trip and Article 6(1)(f), our legitimate interest in running a working inbox, for everything else. We delete correspondence 24 months after the thread goes quiet.

Photographer accounts

If you sign up as a contributing photographer we store your email address, a password (hashed by Supabase Auth, never visible to us in readable form), your display name, a username derived from it, an optional bio, website, Instagram link and avatar, and the photos, captions and location details you submit.

Purpose: to run the account, to attribute your work, and to contact you about your submissions.

Legal basis: Article 6(1)(b) GDPR, performance of the contributor agreement between you and us.

How long: for as long as the account is open. Ask us to close it and we delete the login and the profile within 30 days. Photos you already published stay online with your credit unless you ask us to take them down, which we also do within 30 days.

Operator upvotes

When you upvote a tour operator we store a random identifier that your browser generated for itself, and which operator you voted for. No name, no email, no IP address, no account is attached to it. It exists so that one browser counts once.

Legal basis: Article 6(1)(f), our legitimate interest in a vote count that is not trivially inflated.

How long: for as long as the operator directory publishes vote counts, because deleting a vote would falsify a number other readers rely on. Clearing your browser storage removes the identifier from your side, and the remaining row is then attached to nothing.

Visit measurement

We count visits with Pulse, an analytics tool built by KICKFLIP and running on our own infrastructure. It sets no cookies, writes nothing to your browser storage, and gives you no identifier that survives the day. It records which pages were opened and for how long, where the visit came from, roughly which device, browser, language and country are in use, scroll depth, clicks on certain links, whether the trip inquiry form was started or sent, with the group size, trip length and travel month of a sent inquiry (never your name, contact details or message), and page-load speed. Your IP address is never stored: it is reduced to a coarse network, then hashed with a secret that changes daily, so the same visitor cannot be recognised tomorrow. Nothing is combined with data from any other site.

Legal basis: Article 6(1)(f), our legitimate interest in understanding and improving the site. There is no consent banner because nothing is stored on or read from your device, so the ePrivacy consent rule is not engaged. Google Analytics ran on this site until August 2026 and has been removed. The cookie notice has the full detail.

How long: 12 months. After that only anonymous daily totals remain, which are no longer about any individual visit.

What we do not do

There is no newsletter and no marketing list, so nothing here rests on your consent and there is no consent for you to withdraw. If we ever add one, it will be an explicit opt-in and this page will say so before it launches.

Do you have to give us any of this

None of it is required by law. Reading the site requires nothing at all: no account, no form, no cookie choice.

The inquiry form needs a name and an email, and a photographer account needs an email and a display name, because without them we cannot reply to you or credit you. That is a practical requirement of the service, not a statutory one. If you do not provide them, the form will not submit and we cannot help. Every other field is optional, and leaving one blank costs you nothing except that the operator gets a vaguer brief.

Who else sees your data

• Supabase: hosts the database, the authentication and the uploaded images, in the EU region. It also sends the confirmation email when a photographer account is created.
• Cloudflare: serves the website (Workers and DNS). It processes IP addresses to route your request and to tell real visitors from automated abuse (legitimate interest).
• Google Workspace: carries the email that tells us a new inquiry has arrived, so it receives what you entered in the inquiry form. The notification goes to our own inbox at office@socotra.guide.
• Pulse: our own analytics, built and hosted by KICKFLIP, which is us. Receives the anonymous visit measurements described above and nothing else. No third party sees them.
• Tour operators: this one is a person, not a system. Nothing on this site forwards anything automatically. When an inquiry arrives, someone here reads it and emails it on to the operator you selected, or to one with capacity on your dates, so they can quote for your trip. Operators have no access to the database and no standing feed of leads.

We never sell your data. We never share it for advertising.

Files your browser fetches from other companies

Parts of the page are loaded by your browser straight from other providers, which means each of them sees your IP address and which page you are on. We ask them for files, never for anything about you, and none of them is given your name, your email or your inquiry.

• Google Fonts: the typefaces, on every page.
• OpenFreeMap, CARTO and Esri: map tiles, only on pages that show a map.
• Open-Meteo: the forecast, only on pages that show weather.

Where your data goes

The database is in the EU. Cloudflare, Google and the map and weather providers above run global networks, so a request can be answered by a server outside the European Economic Area, including in the United States. Where that happens, the transfer relies on the safeguards in that provider's own data processing terms: the European Commission's standard contractual clauses and, for the US providers that hold it, certification under the EU-US Data Privacy Framework.

One transfer deserves naming on its own. The tour operators we introduce you to are on Socotra, in Yemen, a country with no EU adequacy decision and no equivalent data protection law. Forwarding your inquiry sends your name, your email and your trip brief there. We do it only because it is what you asked for and the introduction cannot happen without it, which is the derogation in Article 49(1)(b) GDPR. If you would rather we did not, say so in the message box and we will answer you ourselves instead.

No automated decisions about you

We do not profile visitors and nothing here makes an automated decision that produces legal effects or similarly significant effects for you. The site does score and rank places and operators by published rules, but those scores describe places and operators, not you, and every visitor sees the same ones.

Your rights

Under the GDPR you can ask us to do all of the following.

• Access: get a copy of the personal data we hold about you, and be told what we do with it.
• Rectification: have anything inaccurate corrected and anything incomplete filled in.
• Erasure: have it deleted, the so-called right to be forgotten.
• Restriction: have us freeze the data and stop using it while a dispute about its accuracy or our basis for holding it is resolved.
• Portability: receive the data you gave us in a structured, machine-readable file, or have us send it to someone else where that is technically possible.
• Objection: object at any time to anything we do on the basis of legitimate interest, which here means the visit measurement, the upvote counting and our inbox. Tell us and we stop, unless we can show compelling grounds that override your objection.
• Withdrawal of consent: where consent is ever the basis, withdraw it at any time without affecting what was lawful before you did. As of today nothing on this site runs on consent, so there is nothing to withdraw.

Email office@socotra.guide. We answer within one month, free of charge. If a request is unusually complex we may take up to two further months, and we will tell you inside the first month if that happens.

Complaints

If you think we have handled your data badly, tell us first and we will try to fix it. You do not have to. You can complain directly to our supervisory authority, the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни), at cpdp.bg. If you live in another EU or EEA country, you can complain to your own national data protection authority instead.

Cookies

See the cookie notice for exactly what is stored on your device, why, and how to clear it.

Changes

If we change this policy materially we will update the last updated date at the top of this page. We do not email anyone about policy changes because we do not have a list to email.