Privacy Policy

1. Introduction and scope

Rewild Tech LLC, doing business as Outpost OS (“Outpost OS,” “we,” “us”), provides booking and operations software for outfitters, guide services, and tour operators. This Privacy Policy explains how we collect, use, and share personal information through our website at outpost-os.com, the Outpost OS app and booking pages at outpostos.app, and related services (the “Services”).

Three groups of people interact with Outpost OS:

Guests: when you book with an Operator, that Operator is responsible for your data and its own privacy practices. We process your information to run the booking, waiver, check-in, messaging, and payment tools the Operator uses. Questions or requests about your guest data should go to the Operator first; we will help them respond.

2. Information we collect

From Operators and their staff

• Business details: company name, address, tax ID, and contact information
• Account details: names, emails, phone numbers, roles, and sign-in credentials for owners, managers, and guides (passwords are stored hashed, never in readable form)
• Staff records entered into the Services, such as guide certifications, expiration dates, schedules, and hours (Operators confirm they have notified staff and have any required consent)
• Payout and billing details, which are handled through Stripe
• Catalog content: trip descriptions, pricing, photos, waiver templates, and message templates
• Text message registration details (see Section 4)

From Guests (on behalf of Operators)

• Booking details: name, email, phone, trip, date, time, party size, and participant names
• Waiver information: signatures, the time and IP address of signing, and any details the Operator’s waiver requests (for example, date of birth, emergency contact, guardian details, swim ability, or health or fitness disclosures)
• Payment information: card details are collected and processed by Stripe; we receive only limited data such as card brand, last four digits, and transaction status
• Text message consent records (see Section 4)
• Quote, gift card, check-in, and no-show activity
• Notes the Operator adds to a booking or manifest

Automatically

• IP address, device and browser type, operating system, and language settings
• Pages viewed, timestamps, and actions taken in the Services
• Error and diagnostic data when something goes wrong
• Cookie and local storage data (see Section 6)

From other sources

• Stripe, about the status of an Operator’s payment account and verification
• Google, if you choose to sign in with Google
• Public business information and referrals from partners

3. How we use information

• Run the Services: process bookings, quotes, and gift cards; build calendars, manifests, and guide assignments; collect waivers; support check-in; and produce dashboards and reports for Operators
• Send service messages: booking confirmations, trip and waiver reminders, schedule changes, and cancellations, by email and text message, sent on the Operator’s behalf and branded as the Operator
• Process payments and fees: facilitate guest payments, refunds, and payouts, and calculate our fees under each Operator’s agreement with us
• Power AI features: help Operators set up their account from their website, import waiver templates, and prepare similar setup and reporting tools
• Keep things safe: authenticate users, detect fraud and abuse, and secure our systems
• Support and improve: answer questions, fix bugs, and understand how features are used
• Market to Operators and Visitors: send product updates and demo follow-ups (you can opt out at any time); we do not market to Guests using Operator data
• Meet legal obligations: tax, accounting, and responding to lawful requests

We may create de-identified or aggregated data (for example, industry booking trends) that does not identify any Operator or Guest, and use it to improve the Services.

We do not sell personal information, and we do not use Guest data or Operator data to train AI models.

Legal bases (EEA/UK visitors): contract performance, legitimate interests (security, product improvement, B2B marketing), legal obligation, and consent where required.

4. Text messages

Operators can send guests text messages about their bookings, such as booking confirmations, trip and waiver reminders, schedule changes and cancellations, and messages from staff about a trip. Guests receive texts only after agreeing to them when they book or by telling the Operator’s staff. Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for help at any time.

Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. Text message opt-in data and consent will not be shared with any third parties, excluding aggregators and providers of the text message service.

To turn on text messages, Operators give us business details (legal name, business type, tax ID, address, and a contact). We share them with Twilio and the mobile carriers only to register the Operator as a text message sender. The tax ID is stored encrypted.

Sign-in codes and account alerts. If you turn on text sign-in, we text the mobile number you give us a one-time code when you sign in or confirm that number, and security alerts about your Outpost OS account, such as a change to your sign-in settings or account details. You agree to these texts by ticking the consent box when you add your number. Message frequency varies. Message and data rates may apply. Reply HELP for help or STOP to opt out at any time; after opting out you can still get sign-in codes by email or an authenticator app. We do not sell or share your mobile number or SMS opt-in data with third parties for marketing purposes, and we use that number for nothing else.

5. How we share information

• With the Operator you book with: all Guest booking, waiver, and payment-status data is available to that Operator. Operators use it under their own privacy policies.
• Service providers: we use these providers to run the Services, under contract and on our instructions:
  • Stripe (payments, refunds, and payouts; we do not store full card numbers)
  • Twilio (text messages, sign-in codes, and email delivery)
  • DigitalOcean (hosting)
  • Cloudflare (file storage)
  • Sentry (error monitoring)
  • Google (sign-in)
  • GoHighLevel (demo scheduling and follow-up)
  • Anthropic (AI features that help Operators set up their accounts and import waiver templates)
• Support access: our authorized staff may access Operator and Guest data to provide support, fix problems, and keep the Services secure.
• Legal and safety: to comply with law, respond to lawful requests, enforce our terms, or protect the rights and safety of Guests, Operators, or the public.
• Business transfers: in a merger, acquisition, financing, or sale of assets, subject to this Policy.
• With consent: anywhere else, only with your permission.

We do not share Guest data from one Operator with any other Operator.

6. Cookies, retention, and security

Cookies and local storage. The Outpost OS app and booking pages use only essential cookies to run checkout and keep you signed in, and to remember a device you have chosen to trust for sign-in. Booking pages may save details you enter on your device so you don’t have to retype them; if you use a shared device, such as a check-in tablet, clear them when you’re done.

Tracking tools added by Operators. An Operator may add its own analytics, advertising, or tag manager tools (for example, Google Analytics, Google Tag Manager, or Meta Pixel) to its booking pages. These tools may set cookies or similar technologies and collect information about your visit, such as your device, the pages you view, and the actions you take, including the trip you book, and send it to the tool’s provider. The Operator chooses and controls these tools and is responsible for any notices and consent the law requires. Information they collect is governed by the Operator’s privacy policy and the provider’s, not this Policy. We do not receive, sell, or use that information. You can block or delete these cookies in your browser settings, and many providers offer their own opt-out tools.

Our website. outpost-os.com may use analytics and advertising cookies to understand how the site is used and to measure our own marketing. Where the law requires, we ask for your consent first, and you can change your choices at any time through the site’s cookie settings. Our Book a demo page embeds a scheduling calendar from GoHighLevel, which may set its own cookies to run the calendar.

Retention. We keep Operator and Guest data while the Operator’s account is active, and afterward as needed for legal, tax, and dispute purposes. Signed waivers may be kept for up to 6 years, or longer if the Operator requires, because they may be needed if a claim arises. To request deletion, email team@outpost-os.com.

Security. We protect data with hashed passwords, role-based access controls, optional two-factor sign-in, and secure connections. Card data is handled by Stripe; we never store full card numbers. No system is perfectly secure. If a breach affects your information, we will notify affected Operators and, where the law requires, affected individuals and regulators.

7. Your rights and choices

Everyone. You can unsubscribe from our marketing emails using the link in any email. Transactional messages about a booking or account will still be sent. You can stop text messages at any time by replying STOP.

Privacy rights. Depending on where you live (including California, other U.S. states with privacy laws, the EEA, and the UK), you may have the right to access, correct, delete, or receive a copy of your personal information, and to opt out of targeted advertising or profiling. To make a request, email team@outpost-os.com. We will verify your identity by matching information we already hold and respond within the time the law requires (generally 30 to 45 days). You may use an authorized agent with written permission, and we will not discriminate against you for exercising your rights. EEA and UK residents may also complain to their local data protection authority.

Guest requests. If your request concerns a booking or waiver with an Operator, we will forward it to that Operator, who decides how to respond. Some data, such as signed waivers, may be kept for legal reasons.

8. Children

Outpost OS accounts are not for anyone under 18. Trips often include minors, so an Operator’s booking or waiver flow may collect a minor’s name, age, or similar details. That information must be provided by a parent or legal guardian, and we process it only on the Operator’s behalf. We do not knowingly collect personal information directly from children under 13. If you believe a child has given us information directly, contact us and we will delete it.

9. International transfers

Outpost OS is based in the United States, and data is stored and processed in the U.S. If you access the Services from outside the U.S., your information will be transferred to the U.S., where we use appropriate safeguards such as Standard Contractual Clauses where required.

10. Changes to this policy

We may update this Policy. We will post the new version with a new effective date and, for material changes, notify Operators by email or in the app at least 30 days before they take effect.

11. Contact us

Rewild Tech LLC
133 Church Street, Asheville, NC 28801
Email: team@outpost-os.com