Privacy policy.

Travis Wake Charters LLC (“Travis Wake Charters,” “TWC,” “we,” “us”) runs captained charters, wakesurf lessons and a summer camp on Lake Travis, Texas. We’re a small business — the people who see your information are the owner, the manager, and the captain or deckhand running your trip. There is no marketing department and no data broker on the other end of this.

Reach us at info@traviswakecharters.com or 512-839-4573. That’s the same phone and inbox for a privacy question as for a booking question.

When you book online we ask for your name, email address and phone number, and we record the trip itself: the boat, the date and time, how many guests, the price, the deposit and balance, any promo code, and your confirmation code.

The checkout form also asks a short questionnaire, and the answers are stored on your booking:

• How many children under 13 are in your party. A number only — we don’t ask for their names or ages. The captain needs it to bring the right life vests.
• The occasion, what activities you’re into, and which gear you’d like on board.
• A free-text “special requests” box. The form suggests first-timers, birthdays, allergies and preferred ramp — so whatever you type there is what we hold, including health details if you choose to give them. It goes to the captain running your trip.
• How you heard about us.

We use all of it to run your trip, take payment, email you, and hand the captain a manifest. If you book by phone instead, a member of staff types the same details in for you.

A home postal code, for some guests. We don’t ask for one when you book. We hold one for people whose records came across from FareHarbor, the booking system we used before this one — its export included a home ZIP code and it came over with the rest of the contact record. We use it for nothing but knowing roughly where our guests travel from. It goes to none of the companies in section 13, and if you’d like yours removed, ask and we’ll delete it — nothing about your booking depends on it.

Every guest signs a liability waiver before boarding. Signing it records your full typed name, a drawn signature, your initials on each marked section, your date of birth, a phone number for you, and an emergency contact’s name and phone number.

The waiver does not ask for your email address, and there is nowhere on it to enter one. The only way we hold an email for you is if you booked the trip yourself — see section 02.

For a guest under 18, the parent or legal guardian signs. We record that the signer is signing for a minor, plus the guardian’s name, their relationship to the minor, and their phone number. We do not ask for a phone number for the child — the number we need is the adult’s.

If you have signed with us before, we fill the form in for you. When you enter your mobile number, we look for waivers you have already signed on this guest’s trips and bring back what you told us last time — your name, date of birth, emergency contact, and any child you signed for. You can change any of it. Your signature is never filled in for you. You draw it fresh every time, because a signature you did not make that day is not a record of your agreement. That is also why signing before does not excuse you from signing again: each waiver covers one trip, on one date.

We also record, automatically, the IP address and browser the waiver was signed from, and the exact time. That’s not analytics — it’s the evidence that a particular person signed a particular document at a particular moment, which is the entire point of collecting a signature. It is kept with the waiver.

Our summer camp is for ages 8 to 14, which means some campers are under 13. Registration is completed by a parent or legal guardian — the form asks for the parent’s name, email and mobile number, and all three are required. We do not ask campers to register themselves, we do not create accounts for children, we do not ask a child for information directly, and we do not advertise to children.

About the camper, the parent gives us:

• First and last name.
• Date of birth. We ask for the date rather than the age so we can check how old the camper will be during the week they’re registered for — a child who signs up in February for an August week has a birthday in between.
• Allergies and medical needs, in the parent’s own words. Food allergies, asthma, medication, swimming ability, anything the crew should know. There’s a box to tick if there’s nothing to report.

What it’s used for, and nothing else: running the week safely. The instructors get a roster with the medical notes on it, in full, because a note that says “carries an EpiPen” is only useful if it’s in front of the person who needs to read it. The parent’s phone number is there so we can reach them during camp hours.

Who can see it: the owner and the manager who runs camp. Camper records are locked to those two roles in the database itself — they are not readable by the public, by other customers, or by an anonymous request to our systems. They aren’t sold, shared with other parents, or used for marketing.

A parent or guardian can ask at any time to see what we hold about their child, correct it, or have it deleted after camp — see section 15. If you’d rather not send medical details through a web form, call 512-839-4573 and give them to us on the phone instead.

Our referral form asks a customer for their own name, email and phone — and for their friend’s name, email and phone, plus an optional personal message. We store all of it, along with which program the referral is for and whether the reward has been paid out.

So if you’re the friend: someone gave us your contact details, and you never visited this site. We think that deserves saying plainly rather than burying. Here is exactly what happens next. We use your name, email and phone to get in touch with you once, about a trip your friend thought you’d enjoy. That’s it. We don’t add you to a mailing list, we don’t sell your details, and we don’t pass them to anyone else. The form asks the person submitting it to confirm they have your permission — but we can’t verify that, and we’re not going to pretend we can.

If you want out, you’re out. Email info@traviswakecharters.com or call 512-839-4573 and say you were referred and want your details removed. We delete the referral record, and we don’t need a reason. Nothing about your friend’s account or booking changes because you asked.

The custom packages form collects your name, email and phone, plus what you’re planning: group size, preferred date, the kind of package, the experience you want, a budget range, any special requirements, and a free-text description of what you have in mind. We use it to quote your trip and to follow up. It’s stored as an inquiry record that only the owner can read.

Merch checkout runs through Stripe. Stripe collects your name, email, phone number and a US shipping address, and passes us what we need to fill the order: your name, email and shipping address, what you bought, what you paid, and Stripe’s reference for the payment. We use the address to print a label and the email to tell you it shipped.

This one matters, so it’s stated flatly. Your card number, expiry date and security code are entered on a page or form hosted by our payment processor and are never sent to, or stored on, our servers. There is no field anywhere in this application that accepts a card number.

• Stripe. You’re handed off to Stripe’s own checkout page to pay. Stripe gets your name, email, the amount and a description of what you’re buying.
• Square. When Square is the live processor, either you’re handed off to a Square-hosted payment page, or you type your card into a form that Square renders inside our page from Square’s own servers. Either way the card goes to Square and we receive a single-use token, never the digits.

Card on file. When you pay a deposit, the processor saves your card at their end against your booking, so the balance can be charged automatically the day before your trip and so any damage or cleaning charge you authorized in the waiver can be collected. The card lives with Stripe or Square. What we hold is their reference number — enough to charge the balance, match a payment to your booking and issue a refund, and nothing that could be used as a card anywhere else. The full terms of that authorization are in our Terms of Service and the waiver.

Two different things happen with photographs, and they have different rules.

Condition photos. Before and after every trip the captain photographs the boat — the deck, any damage, and a shot of it back on the slip as proof of return. These are operational records, not pictures of you, but guests can appear in the background of them. They are stored in our file storage and viewed by the owner and the crew. The files are served by direct link: the links aren’t published anywhere and only staff have them, but anyone given a link could open that file. We’re telling you that rather than calling it private.

Marketing photos. We may photograph or record your trip and use it in our marketing. If you’d rather not appear, tell your captain before departure and we’ll honor it — the full term is section 07 of our Terms of Service, and there’s a media release in the waiver you sign. You can also change your mind later: email us and we’ll take a photo down.

Email you’ll get from us. A booking confirmation, a link to sign your waiver, a receipt, and a follow-up about a day after your trip asking how it went. Those are part of running your booking. Camp registrations get a receipt and camp details at the parent’s email address. Email is delivered by Resend on our behalf.

Occasional emails about the business. If you’ve booked with us before, we may email you now and then — a new service, a seasonal note. Every one of those carries an unsubscribe link at the bottom: one click, no login, no confirmation screen — you land on a page that tells you you’re off the list, and you are. You can also reply to any of them or email info@traviswakecharters.com and we’ll take you off by hand. We’ll keep sending the emails about your actual booking — you can’t opt out of your own confirmation, and unsubscribing from the newsletter never stops a confirmation, a receipt or a waiver link.

Text messages. Today the only text this system sends is an alert to our own business line when a booking comes in, so the phone dings. It contains your name, the trip and the confirmation code. We are not running marketing texts. If that ever changes we’ll ask before we text you and we’ll update this page.

Our own staff can also turn on push notifications for new bookings on their phones. That’s a crew feature; nothing about it touches a guest’s device.

If you work for us, we hold your name, email, phone number, your roles, and your pay rate. The time clock records when you clocked in and out, which trip it was against, and any note you left. Payout records are kept as payroll records. If you turn on push notifications, we store the subscription your browser gives us and the type of device it came from, so we can send the alert and clean up the subscription when it stops working. You sign in with your own account, and what you can see is limited by your role — a captain sees their own trips, not the books.

This site does not run any analytics or advertising tool. No Google Analytics, no advertising pixel, no session recorder, no heatmaps, no third-party tracker of any kind. Nothing here follows you to another website, and there is no data to sell because nobody’s collecting it. We don’t track you across the web.

The cookies this site does set:

• A staff sign-in cookie. Only if you log in to the admin or crew area. It keeps you signed in. Guests browsing or booking never get one.
• A short-lived cookie during a QuickBooks connection. Only on an owner-only settings page, only while connecting the accounting integration, and it holds a random security value, not anything about you.

Your browser also caches this site’s pages so it loads faster and works with a weak signal at the dock. That cache lives on your device and holds page files, not information about you.

Like any website, ours runs on a host — Vercel — which keeps standard web-server logs of requests, including IP addresses. We use those to keep the site up and to investigate abuse, not to build a profile of you.

We don’t sell personal information and we don’t share it for advertising. We do use a small number of companies to run the business, and each one gets only what it needs:

Each of those companies has its own privacy policy and its own retention rules, which we don’t control.

The home postal code described in section 02 is not sent to any of them. It stays in our own database and is used only by us.

Beyond that, we may share information with our insurer and our lawyers if there’s an incident or a claim — that is specifically why signed waivers exist — and with anyone the law requires, such as in response to a valid subpoena or court order. If the business is ever sold, its records would go with it, and this policy would continue to apply to what was collected under it.

Honest answer first: some records we can’t delete on request, and we’d rather say so than promise otherwise.

• Signed waivers — kept for years. A waiver is the legal record that a person accepted the risks of a trip. A claim can be brought long after the day on the water, and for someone who was a minor when they signed, longer still. We keep waivers, including the signature, initials, date of birth, emergency contact and the signing IP address, for as long as a claim could realistically be made. We will not delete a waiver on request.
• Bookings and payment records — kept for years. These are the business’s tax and accounting records. We keep them for as long as tax and accounting rules require, which is a period of years, and our processors and our accounting software keep their own copies of the same transactions. We can’t remove a paid booking from our books because you’ve asked.
• Camp registrations are kept as the record of who attended, what the crew were told, and what was paid. After camp has run and the payment is settled, a parent can ask us to delete a camper’s medical notes and we will, keeping only what the payment record needs.
• Referrals are kept until the reward is redeemed or expires. Ask to be removed and we delete the record straight away.
• Custom inquiries are kept while we’re quoting and for a while afterwards. Ask and we’ll delete them.
• Trip photos are kept as the condition record for that trip. Ask us to remove one you’re in and we will.
• Crew records — time entries, pay rates and payouts — are kept as payroll records for as long as employment records must be kept.
• Home postal codes (section 02) sit on the customer record for as long as that record exists, but nothing requires us to keep one. Ask and we delete it straight away, without touching your bookings or your waiver.

One more piece of honesty: our database provider takes backups. A record we delete at your request can survive in a backup for a period we don’t set and can’t reach into. It won’t come back into use, but we’re not going to claim it’s gone from every copy the moment we press delete.

Email info@traviswakecharters.com or call 512-839-4573. Tell us what you want and enough for us to find you — the email address you booked with, or your confirmation code. We may need to check you are who you say you are before we hand over or delete anything, especially for a request about a child.

What we can do:

• Tell you what we hold about you, and send you a copy.
• Correct anything that’s wrong.
• Delete what isn’t a legal or tax record — a referral, an inquiry, a marketing contact, a photo you’re in, notes we no longer need.
• Stop sending you marketing email.
• For a parent: show you your child’s camp record, correct it, or delete the medical notes after camp.

What we can’t do: delete a signed waiver, or erase a paid booking from our accounts. Section 14 explains why. If that’s the answer you get, you’ll get it straight, not as a runaround.

We’ll come back to you within a reasonable time — days, not months — and we won’t charge you or treat you differently for asking.

In plain terms, and without overselling it:

• Traffic between your browser and this site is encrypted, which is what the padlock in your address bar means.
• Card details are handled by Stripe and Square, who specialize in exactly that, and not by us.
• Our database enforces who can read what at the database itself, not just in the app. Camp registrations and waivers are locked to specific staff roles and are not readable by the public or by other customers.
• Staff sign in with their own accounts, and what each person sees depends on their role.

What we won’t say is that your information is guaranteed safe. No system is, ours included, and an operator who promises otherwise is telling you something they can’t know. What we will commit to: if we find out that personal information has been exposed, we’ll tell the people affected and meet our obligations under Texas law about notifying you.

Texas has its own privacy law — the Texas Data Privacy and Security Act, in effect since July 2024 — and it gives Texans rights to know what a business holds about them, get a copy, correct it, delete it, and opt out of having it sold or used for targeted advertising. Parts of that law don’t apply to businesses small enough to meet a federal small-business definition, and where our business lands on that line is a question for our lawyer, not something to settle in a footnote here.

So we’ve written this page to give you those rights either way. Section 15 is how you use them. And two of them we can answer right now, from how this system is built rather than from a promise: we don’t sell personal information, and we don’t use it for targeted advertising or automated profiling — there is no advertising or tracking technology on this site at all (section 12).

If you live somewhere with a different privacy law and you think it gives you a right we haven’t listed, write to us and we’ll deal with it in good faith rather than argue about jurisdiction.

If we start collecting something new, or hand your information to a company that isn’t in section 13, this page gets updated and the date at the top changes. A privacy policy that describes a system the business no longer runs is worse than no page at all, so we’d rather keep this one true than keep it flattering. The version posted here is the current one.