Privacy Policy

This policy explains what personal information Halum collects, why we collect it, who we share it with, and the choices you have. It covers https://www.halum.world and every account type on it.

Last updated 11 August 2026

1. Who we are

Halum is an online marketplace where independent tour operators list experiences and travellers book them. The service is operated by ou2there, of 5830 E 2nd St, Ste 7000 #22058, Casper, WY 82609, United States.

We are the data controller for the information described below. If you have a question about this policy or want to exercise any of the rights in section 9, write to service@ou2there.com.

2. Information we collect

We collect only what the service needs to work. In practice that falls into six groups.

Category	What it includes	When we get it
Account details	What it includesEmail address, full name, phone number and profile picture, plus your account type (traveller, vendor or administrator).	When we get itWhen you sign up or edit your profile.
Booking details	What it includesGuest name, email address and phone number, number of people, the tour and time slot, and any special requirements you choose to tell us (which may include accessibility or dietary needs).	When we get itWhen you make a booking. You can book as a guest without an account.
Vendor details	What it includesBusiness name and description, payout email address, and any verification documents you upload to prove you are entitled to operate.	When we get itWhen you apply to list experiences.
Payment records	What it includesAmount, currency, payment status and the reference our payment processor gives the transaction. We never receive or store your card number, expiry date or security code.	When we get itWhen you pay for a booking.
Reviews and ratings	What it includesThe rating, written comment and the name shown on your profile. These are published on the tour page and are visible to anyone.	When we get itWhen you review a tour you booked.
Partner link analytics	What it includesFor each click on a partner link or QR code: the time, a broad device type (mobile, tablet or desktop), the browser family, the country, and whether it came from a link or a QR code.	When we get itWhen you follow a /r/ tracking link.

We do not store your IP address. When you follow a partner link we combine your IP address and browser string with a secret value to produce a one-way hash, use that hash to avoid counting the same visitor twice within a short window, and store only the hash. It cannot be reversed to recover your IP address, and it is not linked to your account.

Our hosting provider keeps standard server logs, which include IP addresses, for operational and security purposes. Those logs are held by the provider on our behalf and are not used to build any profile of you.

3. Cookies

Halum sets two kinds of cookie, and no others. We run no advertising, analytics or social-media tracking on this site: there is no Google Analytics, no advertising pixel and no third-party tracker of any kind.

Cookie	Purpose	Lifetime
`sb-*`	PurposeKeeps you signed in and protects your session. Strictly necessary; without it you cannot log in.	LifetimeSession, refreshed while you stay active.
`halum_ref`	PurposeRemembers which partner link brought you to the site so the correct partner is credited if you go on to book. It stores a link reference only, not anything about you.	Lifetime30 days.

Because neither cookie is used for advertising or profiling, we do not show a consent banner. You can clear cookies at any time in your browser settings; clearing the session cookie signs you out, and clearing the referral cookie means no partner is credited for your booking.

4. How we use your information

To provide the service — creating your account, taking bookings, passing your booking details to the operator running the tour, sending confirmations and reminders, and issuing your booking QR code.
To take payment — processing your card payment through our payment provider and keeping a record of the transaction for accounting and tax purposes.
To operate the marketplace — verifying vendors, calculating commission and payouts, publishing reviews, and dealing with disputes.
To credit partners — attributing clicks, sign-ups and bookings to the partner link that produced them so commission can be paid correctly.
To keep the service safe — detecting fraudulent bookings, filtering automated traffic out of partner statistics, and preventing abuse.
To meet our legal obligations — keeping financial records and responding to lawful requests.

Where data-protection law requires a legal basis, ours is: performance of our contract with you (bookings, accounts and payments); our legitimate interests in running, securing and improving a marketplace (partner attribution, fraud prevention); your consent (where you volunteer optional information such as special requirements); and compliance with a legal obligation (financial records).

5. Who we share it with

We do not sell your personal information, and we never have. We share it only in the following circumstances.

With the tour operator you book. When you complete a booking we pass your name, email address, phone number, party size and any special requirements to the operator running that tour, because they need it to deliver the experience and to contact you if plans change. The operator is an independent business and handles that information under its own responsibility.

With our service providers. These companies process data on our instructions, under contract, and only for the purpose listed.

Provider	What they do	What they receive
Stripe	What they doCard payment processing	What they receiveYour card details (directly, never through us), name, email address and the amount.
Supabase	What they doDatabase and account authentication	What they receiveYour account, booking and review records.
Microsoft Azure	What they doHosting and transactional email	What they receiveEverything the site processes, plus server logs and the email we send you.
OpenStreetMap / Nominatim	What they doMaps and place lookup on tour pages	What they receiveThe map tiles your browser requests. No account or booking data is sent.

With affiliate partners. Hotels and other partners who distribute our links see counts only — how many clicks, sign-ups and bookings their link produced, broken down by day, device type, browser and country. They never see your name, email address, or which specific booking was yours.

Where the law requires it, or to establish or defend legal claims, or if the business is sold or reorganised (in which case this policy continues to apply to information transferred).

6. Where your information is held

Our servers and database are located in the United States, and our providers may process data in other countries where they operate. Where information is transferred out of the United Kingdom or European Economic Area, our providers rely on recognised safeguards such as the European Commission standard contractual clauses.

7. How long we keep it

Account information — while your account is open, and for a short period afterwards so that you can reopen it.
Bookings and payment records — for as long as tax and accounting law requires us to keep financial records, typically six to seven years, even if you close your account.
Reviews — until you or we remove them. If you close your account, published reviews may remain with your name removed.
Partner click records — while the partner link exists. Deleting a link deletes its click history with it.

8. How we protect it

All traffic to the site is encrypted with TLS. Access to the database is restricted at the row level, so one account cannot read another account records, and vendors can see only the bookings for their own tours. Card details never reach our servers. Verification documents are held in restricted storage.

No system is perfectly secure. If a breach affects your personal information and creates a risk to you, we will notify you and the relevant regulator as the law requires.

9. Your rights

Depending on where you live, you may have the right to:

ask for a copy of the personal information we hold about you;
have inaccurate information corrected;
have your information deleted, subject to records we must keep by law;
receive your information in a portable format;
object to, or ask us to restrict, certain processing; and
withdraw consent where our processing relies on it.

You can update your name, phone number and profile picture yourself at any time from your account. For anything else, email service@ou2there.com. We will respond within one month. You will never be charged or treated differently for making a request, and you may complain to your local data-protection authority if you are not satisfied with our response.

10. Children

Halum is not intended for children. You must be at least 18 to create an account or make a booking. We do not knowingly collect information from children under 16; if you believe a child has given us personal information, contact us and we will delete it. Where a booking includes children in the party, we collect only the number of people, not their details.

11. Changes to this policy

We may update this policy as the service changes. The date at the top always reflects the current version. If a change materially affects your rights, we will tell you by email or by a notice on the site before it takes effect.

12. Contact us

For any privacy question or request, contact ou2there at service@ou2there.com, or write to us at 5830 E 2nd St, Ste 7000 #22058, Casper, WY 82609, United States.

Our Terms of Service explain the rules that apply to bookings, cancellations and vendor listings.