Privacy policy

Tour Canada Off-Season is a directory of shoulder-season travel packages run by independent operators. We do not sell trips. When you decide to book, we send you to the operator’s own booking page and they take it from there.

This policy covers this website only. The moment you land on an operator’s site, their privacy policy applies instead of ours — worth a look before you hand over anything.

We are a small operation based in Ontario, Canada. One person reads the mail: ferdous@hey.com.

Everything in this section is something you typed into a form. There are no accounts here, so nothing is collected in the background about who you are.

Enquiry about a package

Your name, email, country, the month you want to travel, the size of your party, and your message. We send it on to the operator you enquired about — passing it along is the entire purpose of the form.

Listing a package (operators)

Your name, email, the business website, and a description of the package.

Sharing a place

Your name, your story, and an email address if you choose to give one. Approved stories are published on the site with your first name; the email is never shown and is only used to reply to you.

Waitlist

Your email address, and nothing else.

We never ask for payment details, dates of birth or passport numbers. If a page ever asks you for those, it is not this one.

• A referral cookie. When you press “Book with provider” we set tc_sid — a random id, first-party, HttpOnly, expiring after a year. Its only job is to count referrals, so an operator can see how many travellers we sent and any referral fee can be attributed. It holds no name and goes to no advertiser.
• Saved packages and recently viewed. Kept in your browser’s local storage, on your device. They are never sent to us. Clear your browser data and they are gone.
• Analytics. We use Cloudflare Web Analytics, which is cookieless and does no cross-site tracking. It tells us that a page was viewed, not who viewed it.
• Spam filtering. Our forms may run Cloudflare Turnstile, and we rate-limit requests by IP address. That is how we keep the enquiry inbox usable.
• Your browser’s language. We read it to guess which market you are in — for our own reporting, and to pre-fill the country field on the enquiry form. If we guess wrong, just change the field.

In Canada we work under PIPEDA, which turns on meaningful consent: you fill in a form knowing where it goes, and we only use what you gave for the reason you gave it.

If you are in the EU or the UK, the GDPR and UK GDPR give you the same rights and a bit more vocabulary. Our bases are consent for anything you submit through a form, and legitimate interests for counting referrals, keeping spam out, and seeing which places and months people care about.

• The operator you enquired about receives your enquiry — name, email, country, month, party size and message. From then on they hold their own copy under their own policy.
• Cloudflare hosts the site and stores the data, processing it on our behalf.
• Google is used only for staff sign-in to our admin area. Travellers never sign in to anything here.

That is the whole list. We do not sell data, we run no advertising network, and nothing here goes to a data broker.

The site runs on Cloudflare: Workers for the site itself, a D1 database in Cloudflare’s EEUR (eastern Europe) region, R2 for images, and KV for small bits of configuration. Cloudflare’s network is global, so the pages you read may be served from a machine near you wherever you are.

• Enquiries are anonymised after 12 months. The identifying fields are stripped and only the shape of the enquiry — place, month, party size — is kept for reporting.
• Submissions we turned down are deleted after 12 months. A scheduled job handles both of these; nobody has to remember.
• Everything else — published place stories, accepted operator submissions, waitlist emails — stays while it is still doing its job, and goes when you ask us to remove it.

You can ask for deletion at any time, including before those clocks run out. We do not make you explain why.

You can ask what we hold about you, get a copy of it, have it corrected, or have it deleted. Email ferdous@hey.com and say what you want; a person reads it and replies.

Under PIPEDA you can also complain to the Office of the Privacy Commissioner of Canada if we handle your request badly. In the EU or UK you additionally have rights of access, rectification, erasure, restriction, portability and objection, you may withdraw consent at any time, and you may complain to your local supervisory authority.

One limit worth being straight about: if you have already enquired with an operator, we can delete our copy but not theirs. Ask them directly for that one.

When this changes we update the date at the top of the page. If a change actually affects what happens to your data — rather than tidying a sentence — we will say so here rather than hope you notice.

Privacy questions, deletion requests, or a correction to something we published: ferdous@hey.com. No ticket system, no form — just email.

Our terms of use cover what this site is, how booking with an operator works, and what happens to anything you submit.