Who we are

Richard D. Ortiz, trading as Coastal Luxury AI ("we", "us"), of Galveston, Texas, USA, operates an AI hospitality concierge for Galveston Island at coastalluxuryai.com. We are the data controller for the personal information described here: we decide what is collected and why, and we are responsible for how it is handled. This policy explains what we collect and what we do with it. Questions or requests? Email privacy@coastalluxuryai.com.

What we collect

Contact and trip details you give us. Your name, email address, optional phone number, trip interest, and anything you type into the concierge chat or a request form — dates, party size, budget level, preferences, occasions, and accessibility needs.
Concierge conversations. Messages you send are processed by an AI model to produce your itinerary. Your chat history is stored in your own browser so you can pick up where you left off. When you ask us to help arrange a trip, we save the itinerary and a summary of your request to our records so a specialist can act on it.
Marketing attribution. UTM parameters, referral codes, the page you landed on, and the referring website, so we know which campaigns work.
Basic technical data. Your IP address and request metadata, used for security and abuse prevention (rate limiting).
Account data, if you sign in. Google sign-in gives us your email address and basic profile from your identity provider.

We do not knowingly collect information from children, and we do not ask for payment card details on this site.

Why we use it

To build and refine your itinerary and answer your questions.
To respond to a request, contact independent providers on your behalf, and follow up about your trip.
To send transactional email (confirmations and replies).
To measure which campaigns and pages generate interest.
To protect the service from abuse and keep costs sustainable.
To take, manage, and support Founding Partner memberships, and to meet our tax, accounting, and record-keeping obligations.

Our legal basis

Performance of a contract — providing the concierge, acting on your requests, and running a Founding Partner membership.
Legitimate interests — security and fraud prevention, rate limiting, campaign measurement, and improving the service.
Consent — optional marketing email, which you can withdraw at any time.
Legal obligation — tax, accounting, and responding to lawful requests.

Who we share it with

We do not sell your personal information. We share only what is necessary with:

Service providers that run our infrastructure — hosting, database, AI model processing, and email delivery — acting on our instructions.
Independent hospitality providers (restaurants, charter captains, rental managers, drivers) when you ask us to arrange something, limited to what they need to hold or confirm it.
Paddle.com, our Merchant of Record, for the sale of Founding Partner membership — subscription management, payments, tax compliance, invoicing, and refunds. Paddle collects and handles payment details directly under its own privacy notice.
Professional advisers (legal and accounting) where needed.
Authorities where we are legally required to.

Some of these providers operate outside your country, including in the United States. Where personal data is transferred internationally, we rely on appropriate safeguards such as standard contractual clauses.

Email

Requesting early access or a concierge arrangement means we may email you about that request. Every non-essential email includes an unsubscribe link, and you can reply to any message asking us to stop.

How long we keep it

Lead and trip-request records are kept while your request is active and for up to 24 months afterwards so we can pick up a returning guest's history. Security and rate-limit records are kept for hours, not months. Chat history in your browser stays until you clear it — use "Start over" in the concierge to clear the current conversation. Membership and billing records are kept for as long as tax and accounting law requires. When information is no longer needed we delete or anonymise it.

Your rights

Email privacy@coastalluxuryai.com to access, correct, export, restrict, object to, or delete the information we hold about you, to withdraw consent, or to opt out of marketing. We will confirm your request by email before acting on it and respond within one month. Depending on where you live you may also have the right to complain to your data protection authority, and Texas and other US residents may exercise equivalent state privacy rights at no charge.

Security

We use appropriate technical and organisational measures to protect your information, including encryption in transit, access controls on our database, and rate limiting. No system is perfectly secure, so please do not send us information you would not want held.

Cookies

We use only essential storage — a sign-in session cookie and browser storage that keeps your concierge conversation on your device — plus campaign parameters carried in the link you arrived from. We do not run advertising or cross-site tracking cookies. You can clear this at any time in your browser settings; clearing it signs you out and removes your saved chat.

Changes

We will update this page when our practices change and revise the date above. Material changes will be highlighted on the homepage.

See also our Terms of Service and our AI & service disclaimer.