Core Tulum
PrivacyEffective April 2026

Privacy
notice.

A plain-language summary of what we collect, why we collect it, and the rights you keep over your data. No legalese, no dark patterns.

What we collect

The information we keep on file.

We collect only the information needed to run a membership and process redemptions at partner venues. That includes your name, email, phone number (optional), payment details handled entirely by Stripe, and the date and venue of each redemption you make through your QR.

  • Account info — name, email, optional phone
  • Payment info — handled and stored by Stripe; we never see card numbers
  • Redemption history — venue, date, and discount applied
  • Device + analytics — anonymized via PostHog (page views, feature usage)
Why we collect it

How we use your data.

We use your information to deliver your membership, process payments, prevent abuse of partner offers, and send service emails about your account. We will never sell your data to advertisers, brokers, or third parties.

Aggregate, anonymized usage data may be shared with partner venues so they can understand which offers perform best — never individual member data.

Your rights

You stay in control.

You can request a copy of your data, ask us to correct it, or delete your account at any time by writing to hello@coretulum.com. Account deletion removes all personal information within 30 days, though some records may be retained where required by Mexican tax or accounting law.

Service providers

Who we share with.

We use a small number of carefully chosen vendors to run the service. Each one only receives the data they strictly need.

  • Stripe — payment processing
  • WorkOS — authentication and session management
  • Convex — encrypted application database
  • Resend — transactional email delivery
  • PostHog — product analytics, anonymized
Security

How we protect it.

Data is encrypted in transit and at rest. Access to member records inside Core Tulum is restricted to a small number of staff who need it to support the service. We will notify affected members within 72 hours of discovering any security incident that exposes personal information.

Updates

Changes to this notice.

When we make material changes to this notice, we will email all active members and post a banner on the site. The effective date at the top of this page always reflects the latest version.

Questions? Reply to any email from us or write us directly — we read every note ourselves.

hello@coretulum.com