Privacy policy

Travis Wake Charters LLC (“Travis Wake Charters,” “TWC,” “we,” “us”) runs captained charters, wakesurf lessons and a summer camp on Lake Travis, Texas. We’re a small business. The people who see your information are the owner, the manager, and the captain or deckhand running your trip. There is no marketing department and no data broker on the other end of this. The software this site runs on (the booking, payments, waivers, crew app and the booking assistant) is the XRise Tech platform, owned by a separate company of the same owner; it is software we license, and the records described on this page belong to TWC and are kept in TWC’s own accounts with the providers listed below.

Reach us at info@traviswakecharters.com or 512-839-4573. That’s the same phone and inbox for a privacy question as for a booking question.

When you book online we ask for your name, email address and phone number, and we record the trip itself: the boat, the date and time, how many guests, the price, the deposit and balance, any promo code, and your confirmation code.

The checkout form also asks a short questionnaire, and the answers are stored on your booking:

• How many children under 13 are in your party. A number only. We don’t ask for their names or ages. The captain needs it to bring the right life vests.
• The occasion, what activities you’re into, and which gear you’d like on board.
• A free-text “special requests” box. The form suggests first-timers, birthdays, allergies and preferred ramp, so whatever you type there is what we hold, including health details if you choose to give them. It goes to the captain running your trip.
• How you heard about us.

We use all of it to run your trip, take payment, email you, and hand the captain a manifest. If you book by phone instead, a member of staff types the same details in for you.

Your customer record. The first time you book, buy or sign something with your email address we create one customer record for you, with an ID of its own, and everything after that (bookings, signed waivers, shop orders, gift certificates, messages we sent you, a place in line) is linked to it. That is how a returning guest is recognised and how we can give you a copy of everything we hold, or delete it, in one go. We never create a record from a waiver alone, because the waiver has no email field.

If your group splits the bill. The person who booked can give us the names and, optionally, the email addresses and phone numbers of the people paying a share, and each of those people may add or correct their own details on the share page. For each payer we keep the name, email, phone, the share and what was paid, the payment processor’s references for the payment and any refund, and whether they asked for text reminders. A friend never sees another friend’s details beyond first names, and the organiser sees who has paid. Payer records are kept with the booking they belong to, for as long as the booking is kept.

A home postal code, for some guests. We don’t ask for one when you book. We hold one for people whose records came across from FareHarbor, the booking system we used before this one. Its export included a home ZIP code and it came over with the rest of the contact record. We use it for nothing but knowing roughly where our guests travel from. It goes to none of the companies listed under “Who else sees your information,” and if you’d like yours removed, ask and we’ll delete it. Nothing about your booking depends on it.

Every guest signs a liability waiver before boarding. Signing it records your full typed name, a drawn signature, your initials on each marked section, your date of birth, a phone number for you, and an emergency contact’s name and phone number.

The waiver does not ask for your email address, and there is nowhere on it to enter one. The only way we hold an email for you is if you booked the trip yourself. See “Booking a charter or a lesson” above.

For a guest under 18, the parent or legal guardian signs. We record that the signer is signing for a minor, plus the guardian’s name, their relationship to the minor, and their phone number. We do not ask for a phone number for the child. The number we need is the adult’s.

If you have signed with us before, we can fill part of the form in for you. A returning guest’s waiver can be prefilled with their name and phone number. You can change either of them. We never prefill an emergency contact or a child’s date of birth: you enter those fresh each time. Your signature is never filled in for you. You draw it fresh every time, because a signature you did not make that day is not a record of your agreement. That is also why signing before does not excuse you from signing again: each waiver covers one trip, on one date.

We also record, automatically, the IP address and browser the waiver was signed from, and the exact time. That’s not analytics. It’s the evidence that a particular person signed a particular document at a particular moment, which is the entire point of collecting a signature. It is kept with the waiver.

Our summer camp is for ages 8 to 14, which means some campers are under 13. Registration is completed by a parent or legal guardian. The form asks for the parent’s name, email and mobile number, and all three are required. We do not ask campers to register themselves, we do not create accounts for children, we do not ask a child for information directly, and we do not advertise to children.

We do not knowingly collect personal information directly from children under 13, the age the Children’s Online Privacy Protection Act (COPPA) uses. A parent or legal guardian provides any child’s details, on the waiver or the camp registration, and a parent can ask us to see or delete them.

About the camper, the parent gives us:

• First and last name.
• Date of birth. We ask for the date rather than the age so we can check how old the camper will be during the week they’re registered for. A child who signs up in February for an August week has a birthday in between.
• Allergies and medical needs, in the parent’s own words. Food allergies, asthma, medication, swimming ability, anything the crew should know. There’s a box to tick if there’s nothing to report.

The camp packet. Before the first day a parent or legal guardian completes and signs the camp packet online, from a link that belongs to that one camper. It records the guardian’s name, relationship, phone, email and home address, an optional second guardian, the camper’s allergies, medications, conditions and recent injuries, the physician’s name and phone, optional insurance details, swim ability, the people who may and may not collect the camper, an emergency contact, a photo opt-out, the guardian’s initials on each section, a typed name, a drawn signature, and the time, internet address and device it was signed from. It is kept permanently with our other signed waivers.

What it’s used for, and nothing else: running the week safely. The instructors get a roster with the medical notes on it, in full, because a note that says “carries an EpiPen” is only useful if it’s in front of the person who needs to read it. The parent’s phone number is there so we can reach them during camp hours.

Who can see it: the owner and the manager who runs camp, and, for the day sheet of allergies, medications, swim ability and pickup names, the crew working that camp week. Camper records are locked to staff roles in the database itself, they are not readable by the public, by other customers, or by an anonymous request to our systems. They aren’t sold, shared with other parents, or used for marketing.

A parent or guardian can ask at any time to see what we hold about their child, correct it, or have it deleted after camp. See “Seeing, correcting or deleting your information” below. If you’d rather not send medical details through a web form, call 512-839-4573 and give them to us on the phone instead.

Our referral form asks a customer for their own name, email and phone, and for their friend’s name, email and phone, plus an optional personal message. We store all of it, along with which program the referral is for and whether the reward has been paid out.

So if you’re the friend: someone gave us your contact details, and you never visited this site. We think that deserves saying plainly rather than burying. Here is exactly what happens next. We use your name, email and phone to get in touch with you once, about a trip your friend thought you’d enjoy. That’s it. We don’t add you to a mailing list, we don’t sell your details, and we don’t pass them to anyone else. The form asks the person submitting it to confirm they have your permission, but we can’t verify that, and we’re not going to pretend we can.

If you want out, you’re out. Email info@traviswakecharters.com or call 512-839-4573 and say you were referred and want your details removed. We delete the referral record, and we don’t need a reason. Nothing about your friend’s account or booking changes because you asked.

The custom packages form collects your name, email and phone, plus what you’re planning: group size, preferred date, the kind of package, the experience you want, a budget range, any special requirements, and a free-text description of what you have in mind. We use it to quote your trip and to follow up. It’s stored as an inquiry record that only the owner can read.

A few more forms collect information. Here is what each one asks for and why.

• Call-me-back requests. Your name and phone number, and optionally an email address and a note. We use them to call you back about the trip you asked about.
• Cancellation alerts. Your name, email, phone number, the dates you want, your party size and any notes. We use them to tell you when a booked date opens up.
• Getting in line before the season opens. Your name, email, phone number, the date, trip and length you picked, your party size, your place in line, and whether you ticked the box for a text. We use them to email (and, if you asked, text) you your place and, when your turn comes, a private booking link. The entry stays on the list until you use the link, let it expire, leave the line from the link in our email, or the date passes; after that it is kept as a lead for up to two years and then deleted.
• The summer camp interest list. A parent’s name and email, optionally a phone number, the number and ages of the campers, the months you are interested in, and any notes. We use them to tell you when camp registration opens.
• Gift certificates. The buyer’s name and email, and optionally the recipient’s name, email and a message. These go to Stripe with the payment so the certificate can be issued.
• The email and text signup. Your email address, and optionally your first name and phone number. See “Email and text messages” for how each is used.
• Messages our staff send you. When a member of staff emails or texts you from our system, we keep a log of what was sent, to whom and when.

Merch checkout runs through Stripe. Stripe collects your name, email, phone number and a US shipping address, and passes us what we need to fill the order: your name, email and shipping address, what you bought, what you paid, and Stripe’s reference for the payment. We use the address to print a label and the email to tell you it shipped.

This one matters, so it’s stated flatly. Your card number, expiry date and security code are entered on a page or form hosted by our payment processor and are never sent to, or stored on, our servers. There is no field anywhere in this application that accepts a card number.

• Stripe. You’re handed off to Stripe’s own checkout page to pay. Stripe gets your name, email, the amount and a description of what you’re buying.
• Square. When Square is the live processor, either you’re handed off to a Square-hosted payment page, or you type your card into a form that Square renders inside our page from Square’s own servers. Either way the card goes to Square and we receive a single-use token, never the digits.

Card on file. When you pay a deposit, the processor saves your card at their end against your booking, so the balance can be charged automatically the day before your trip and so any damage or cleaning charge you authorized in the waiver can be collected. The card lives with Stripe or Square. What we hold is their reference number: enough to charge the balance, match a payment to your booking and issue a refund, and nothing that could be used as a card anywhere else. The full terms of that authorization are in our Terms of Service and the waiver.

Two different things happen with photographs, and they have different rules.

Condition photos. Before and after every trip the captain photographs the boat: the deck, any damage, and a shot of it back on the slip as proof of return. These are operational records, not pictures of you, but guests can appear in the background of them. They are stored in our file storage and viewed by the owner and the crew. The files are served by direct link: the links aren’t published anywhere and only staff have them, but anyone given a link could open that file. We’re telling you that rather than calling it private.

Marketing photos. We may photograph or record your trip and use it in our marketing. If you’d rather not appear, tell your captain before departure and we’ll honor it. The full term is the photos and media section of our Terms of Service, and there’s a media release in the waiver you sign. You can also change your mind later: email us and we’ll take a photo down.

Email you’ll get from us. A booking confirmation, a link to sign your waiver, a receipt, and a follow-up about a day after your trip asking how it went. Those are part of running your booking. Camp registrations get a receipt and camp details at the parent’s email address. Email is delivered by Resend on our behalf.

Occasional emails about the business. We send these to past guests and to anyone who signed up for them on this site: a new service, a seasonal note. Every one of those carries an unsubscribe link at the bottom: one click, no login, no confirmation screen. You land on a page that tells you you’re off the list, and you are. You can also reply to any of them or email info@traviswakecharters.com and we’ll take you off by hand. We’ll keep sending the emails about your actual booking. You can’t opt out of your own confirmation, and unsubscribing from the newsletter never stops a confirmation, a receipt or a waiver link.

Text messages. Texts are sent through Twilio. There are three kinds:

• Texts about your trip or request. If you give consent to texts at checkout, on a call-me-back request or on the waitlist, our staff may text you one to one about your trip or your request.
• Marketing texts. The email and text signup on the /sms, shop, gift and booking pages asks for separate, optional consent to marketing texts. We send them only to people who ticked that box.
• Alerts to our own business line. When a booking comes in, our system texts our own phone with your name, the trip and the confirmation code.

Reply STOP to any text from us to opt out, and we record that you did. Message and data rates may apply.

Our own staff can also turn on push notifications for new bookings on their phones. That’s a crew feature; nothing about it touches a guest’s device.

If you work for us, we hold your name, email, phone number, your roles, and your pay rate. The time clock records when you clocked in and out, which trip it was against, and any note you left. Payout records are kept as payroll records. If you turn on push notifications, we store the subscription your browser gives us and the type of device it came from, so we can send the alert and clean up the subscription when it stops working. You sign in with your own account and a six-digit code emailed to you at each sign-in, and what you can see is limited by your role. A captain sees their own trips, not the books. Sign-in attempts are logged (a hash of the email and IP address, the browser, and the outcome) and the log is cleared after 90 days.

This site does not run any third-party analytics or advertising tool. No Google Analytics, no advertising pixel, no session recorder, no heatmaps, no third-party tracker of any kind. Nothing here follows you to another website. We don’t track you across the web.

We do not store your name, email address, phone number or IP address with these records. When you complete a booking, that booking’s record notes how you first found us (for example “Google” or “Instagram”) so we know which channels work. It is not used for advertising and is never shared. Visit records are kept with our other operational records, and if you ask us to delete them we will.

When you send us an inquiry or make a booking, we may also store the campaign tags and the referring site from your visit with that inquiry or booking, so we know how people found us. To do that, your browser keeps a small note in its own local storage with the campaign tags, the referring site and the first page you landed on. It holds no name, email, phone or identifier, it is not a cookie, and clearing your browser data removes it.

Two more things live in your browser’s local storage. The shop keeps your cart there, so it is still there when you come back. And staff devices keep a small flag so our own visits are not counted. Neither is a cookie.

No cookies are set for public visitors.

The only cookies this site sets are for staff:

• A staff sign-in cookie. Only if you log in to the admin or crew area. It keeps you signed in. Guests browsing or booking never get one.
• A short-lived cookie during a QuickBooks connection. Only on an owner-only settings page, only while connecting the accounting integration, and it holds a random security value, not anything about you.

Your browser also caches this site’s pages so it loads faster and works with a weak signal at the dock. That cache lives on your device and holds page files, not information about you.

Like any website, ours runs on a host, Vercel, which keeps standard web-server logs of requests, including IP addresses. We use those to keep the site up and to investigate abuse, not to build a profile of you.

We don’t sell personal information and we don’t share it for advertising. We do use a small number of companies to run the business, and each one gets only what it needs:

Each of those companies has its own privacy policy and its own retention rules, which we don’t control.

The home postal code described under “Booking a charter or a lesson” is not sent to any of them. It stays in our own database and is used only by us.

Beyond that, we may share information with our insurer and our lawyers if there’s an incident or a claim (that is specifically why signed waivers exist) and with anyone the law requires, such as in response to a valid subpoena or court order. If the business is ever sold, its records would go with it, and this policy would continue to apply to what was collected under it.

Honest answer first: some records we can’t delete on request, and we’d rather say so than promise otherwise.

• Signed waivers: kept for years. A waiver is the legal record that a person accepted the risks of a trip. A claim can be brought long after the day on the water, and for someone who was a minor when they signed, longer still. We keep waivers, including the signature, initials, date of birth, emergency contact and the signing IP address, for as long as a claim could realistically be made. We will not delete a waiver on request.
• Bookings and payment records: kept for years. These are the business’s tax and accounting records. We keep them for as long as tax and accounting rules require, which is a period of years, and our processors and our accounting software keep their own copies of the same transactions. We can’t remove a paid booking from our books because you’ve asked.
• Camp registrations are kept as the record of who attended, what the crew were told, and what was paid. After camp has run and the payment is settled, a parent can ask us to delete a camper’s medical notes and we will, keeping only what the payment record needs.
• Referrals are kept until the reward is redeemed or expires. Ask to be removed and we delete the record straight away.
• Custom inquiries are kept while we’re quoting and for a while afterwards. Ask and we’ll delete them.
• Trip photos are kept as the condition record for that trip. Ask us to remove one you’re in and we will.
• Booking assistant chats (the concierge at /chat) are kept for 90 days when the chat went nowhere, then deleted automatically; a chat that became a call back, a custom enquiry, a place in line or a booking is kept with that record. Emails, phone numbers and anything shaped like a card number are replaced with placeholders before the chat is stored, and we keep a hash of your connection rather than your IP address. See “Who else sees your information” for Anthropic, which processes the conversation.
• Split-payment payer records are kept with the booking, as part of its payment record.
• A place in line for a date (see “Other forms on the site”) is kept until it is used, withdrawn or expires, then as a lead for up to two years.
• The TWC Tech Box. Our boats may carry a small tracker that logs where the boat went and how long the engine ran on each trip. It records the boat’s position and engine time only: no names, no phones, no audio, nothing about who was aboard. The trip is matched to the booking that was on the boat so we can cost fuel and maintenance; that match is a business record and is kept with the booking.
• Crew records (time entries, pay rates and payouts) are kept as payroll records for as long as employment records must be kept.
• Home postal codes (see “Booking a charter or a lesson”) sit on the customer record for as long as that record exists, but nothing requires us to keep one. Ask and we delete it straight away, without touching your bookings or your waiver.

One more piece of honesty: our database provider takes backups. A record we delete at your request can survive in a backup for a period we don’t set and can’t reach into. It won’t come back into use, but we’re not going to claim it’s gone from every copy the moment we press delete.

Email info@traviswakecharters.com or call 512-839-4573, or use the buttons on our ask for your data or delete it page. Tell us what you want and enough for us to find you: the email address you booked with, or your confirmation code. We may need to check you are who you say you are before we hand over or delete anything, especially for a request about a child.

What we can do:

• Tell you what we hold about you, and send you a copy.
• Correct anything that’s wrong.
• Delete what isn’t a legal or tax record: a referral, an inquiry, a marketing contact, a photo you’re in, notes we no longer need.
• Stop sending you marketing email or marketing texts.
• For a parent: show you your child’s camp record, correct it, or delete the medical notes after camp.

What we can’t do: delete a signed waiver, or erase a paid booking from our accounts. “How long we keep things” explains why. If that’s the answer you get, you’ll get it straight, not as a runaround.

We answer within 45 days, the window the Texas Data Privacy and Security Act sets, and we won’t charge you or treat you differently for asking.

In plain terms, and without overselling it:

• Traffic between your browser and this site is encrypted, which is what the padlock in your address bar means.
• Card details are handled by Stripe and Square, who specialize in exactly that, and not by us.
• Our database enforces who can read what at the database itself, not just in the app. Camp registrations and waivers are locked to specific staff roles and are not readable by the public or by other customers.
• Staff sign in with their own accounts, and what each person sees depends on their role.

What we won’t say is that your information is guaranteed safe. No system is, ours included, and an operator who promises otherwise is telling you something they can’t know. What we will commit to: if we find out that personal information has been exposed, we’ll tell the people affected and meet our obligations under Texas law about notifying you.

Texas has its own privacy law, the Texas Data Privacy and Security Act, in effect since July 2024, and it gives Texans rights to know what a business holds about them, get a copy, correct it, delete it, and opt out of having it sold or used for targeted advertising. Parts of that law don’t apply to businesses small enough to meet a federal small-business definition, and where our business lands on that line is a question for our lawyer, not something to settle in a footnote here.

So we’ve written this page to give you those rights either way. “Seeing, correcting or deleting your information” is how you use them. And two of them we can answer right now, from how this system is built rather than from a promise: we don’t sell personal information, and we don’t use it for targeted advertising or automated profiling and there is no advertising or cross-site tracking technology on this site at all (see “Cookies, analytics and tracking”).

If you live somewhere with a different privacy law and you think it gives you a right we haven’t listed, write to us and we’ll deal with it in good faith rather than argue about jurisdiction.

If we start collecting something new, or hand your information to a company that isn’t listed under “Who else sees your information,” this page gets updated and the date at the top changes. A privacy policy that describes a system the business no longer runs is worse than no page at all, so we’d rather keep this one true than keep it flattering. The version posted here is the current one.