Privacy

visit-saipan.com is a trip planner for Saipan, in the Commonwealth of the Northern Mariana Islands. It is operated by Justin Tan, at JP Center, 2nd Floor, Garapan, Saipan 96950, Northern Mariana Islands — ATTN: Judy Mendieta.

For anything about your personal data, write to justin@visit-saipan.com. Our privacy officer is Justin Tan — justin@visit-saipan.com. We have not appointed a Korean domestic representative or a representative in the European Union, so write to us directly.

We sell nothing and take no bookings. There is no account to create, no password to remember, and nothing to pay for. That is why this policy is shorter than you might expect.

This site has no accounts, so a trip has to live somewhere. It lives in the web address. Every answer you give — how many adults, how many children and how old they are, how many nights, how you want to spend, which hotel and which restaurants you picked, which month you are going — is spelled out in the address bar.

A link reading /plan/family_a2_k7-9_island_n4 means two adults, children aged seven and nine, an island trip, four nights. That design is why the plan survives being forwarded on KakaoTalk, opened on a different phone, or escaped from Instagram’s in-app browser into Safari. It is also a real disclosure, and you should know exactly how far it reaches.

• Anyone holding the link can read the whole party from it. There is no password on a trip.
• It is in your browser history, and in the history of everyone you send it to.
• It is in our hosting provider’s access logs, like every web address ever requested from any site.
• When you paste it into KakaoTalk, Instagram or a message, that service fetches the page to build a preview — so it sees the address too.
• If you allow advertising pixels, the address of the page you are on is part of what those pixels report. This is the strongest reason the pixels are off until you say otherwise.

We never ask for a child’s name or date of birth. There is no field for either, anywhere in this product. An age is the least we can ask and still refuse to put a fourteen-year-old on a scuba dive or send a toddler to a beach with a current.

If that is more than you want in a link, plan with adults only. The itinerary still works; the prices will not carry child fares, and some age warnings will not appear.

We do not publish trip links anywhere, and nothing on this site links to yours. A search engine can only reach one if somebody posts it in public.

Nothing at all, until you do one of three things: save a trip, ask us to email it to you, or agree to advertising. Browsing the site, answering the four questions and reading a whole itinerary collect nothing.

Your trip answers

Party size, children’s ages, seniors, certified divers, trip length, budget, chosen hotel and restaurants, travel month or date. Held in the link; stored on our database only if you save or share.

Your email address

Only if you type one in, and only to send you the trip you asked for — or, separately and only if you tick the box, occasional offers.

Whether you agreed to marketing, and when

Stored as its own record, with a timestamp, so the answer to “did they agree” is evidence rather than someone’s memory.

Your language and currency preference

A cookie, so prices are in the unit you asked for on the first byte of the page rather than after a flash of the wrong one.

A token that finds your saved trip again

Kept in your browser’s local storage, not sent to advertisers. It identifies the trip, not you.

Ordinary server logs

Our hosting provider records the address requested, the time, the browser type and the IP address, as every web server does. We do not use them to build a profile.

We never ask for your name, your phone number, your passport, your flight booking or a payment card. Nothing in this product can take a payment.

To build and price your trip

Your answers are what the itinerary is made from. This happens in your browser and on our server as you use the site.

To keep a trip and hand it back

You asked us to save it or to email it. That is the whole purpose, and we treat it as the thing you asked for rather than as permission for anything else.

To send you offers

Only with a separate, explicit tick that is never pre-ticked, and only until you tell us to stop.

To measure and advertise

Only with your consent, and nothing loads before you give it. See the next section.

Where the law of your country asks us to name a basis for each of those: the first two are us doing the thing you asked us to do, and the last two happen only because you said yes and stop when you say no. We do not claim a “legitimate interest” in advertising to you; that is what the switches are for.

Advertising and measurement do not start when you arrive. Until you agree, the code for them is not in the page at all — it is not loaded and paused, it was never sent to your browser. Refusing costs you nothing: every part of this planner works the same either way.

These two switches are the whole of it, and you can change them here at any time. There is a link back to this section at the foot of the site.

Cookies that are always on

Your currency preference, and the record of the choice you just made on this page. Both last twelve months, neither is shared with anyone, and the site cannot work as promised without them.

Measuring this site

Which pages are read and where a plan gets abandoned. Counts about pages, not a profile of you, and it stays with us.

Advertising pixels

Meta (Facebook and Instagram), Google and TikTok. Each learns that this browser looked at Saipan trips, including the address of the page — which, as above, spells out your party. They can then show you advertising elsewhere, and they use what they learn for their own purposes as well as ours. What each of them stores, and for how long, is set by that company and stated in its own privacy policy, not by us.

Your answer to this question is itself remembered for twelve months, after which we ask again. If we add an advertising partner, or start using one for something new, we ask again then instead of assuming the old answer covers it.

If you switch advertising off after having switched it on, we stop loading those pixels immediately. What a vendor already holds is between you and that vendor, and each of them has its own privacy policy and its own controls — we cannot reach into them on your behalf.

There are exactly two kinds of email from us, and they are not versions of each other.

Your itinerary

The trip you asked us to send you, with a link to it. It carries no advertising, because a message that carries advertising is an advertisement.

Offers

Only if you ticked the separate box. The subject line begins with (광고), the sender is named in the message, and every one carries a link that takes you off the list.

That link needs no password and no account. One tap and you are off, on every trip your address is attached to, not just the one the message was about. Nothing is asked of you beyond following it.

Every two years we send one message that sells nothing: it tells you the date you agreed, that you are still on the list, and how to come off. Korean law asks for that check and it is a fair one — a permission given two years ago and never mentioned since is not really a permission.

Saying no to offers costs you nothing at all. Every part of this site works identically, and we will never withhold a feature, a price or an itinerary because you left the box unticked.

You can also write to justin@visit-saipan.com and we will do it by hand.

We do not sell personal data and we do not hand your address to anyone to market their own things. What we do use is a small set of companies who run parts of this service for us.

Supabase

The database where a saved trip and an email address are stored. Our project is hosted in Supabase, Seoul (ap-northeast-2).

Vercel

The hosting that serves these pages and keeps the access logs described above.

Resend

Delivers the email. It sees the address it is delivering to and the message.

Meta, Google and TikTok

Only if you allowed advertising. Unlike the three above, these are not simply working on our behalf — they use what they learn for their own purposes, which is why they sit behind their own switch.

This site is operated from a United States territory, so if you are in Korea or in Europe your data is handled outside your own country. Because that matters more in Korean law than it does in most places, here is the whole of it in one table.

What crosses a border

Your email address; whether you agreed to marketing and when; and your saved trip code, which carries your party including children’s ages.

Where it goes, and when

To the United States for hosting and mail, and to Supabase, Seoul (ap-northeast-2) for the database. It is transferred at the moment you save or send, over an encrypted connection, and not in batches afterwards.

Who receives it

The companies named above. Each publishes its own contact details and privacy policy, and each is reachable independently of us.

What they do with it, and for how long

Only the purpose named beside each of them above, for the periods in the next section. The three that work for us are not permitted to use it for anything else.

How to refuse

Nothing crosses a border about somebody who only reads. Do not save a trip and do not give us an address, and there is nothing to transfer. If you already have, write to justin@visit-saipan.com and we will delete it — the plan you are looking at keeps working, because it was never in the database. For the advertising companies, the switch above is the refusal.

We will also disclose data where a law we are subject to requires it — and we would rather tell you that plainly than leave it out.

A saved trip

For as long as it is useful to you, and deleted on request. A trip nobody has opened for a long time is a candidate for deletion, not an asset.

An email address with no marketing consent

Kept while the trip it belongs to is kept, then deleted with it.

An email address with marketing consent

Kept until you unsubscribe, and the record of the unsubscribe is kept after that — because the only way to be sure we never mail you again is to remember that you said not to.

Server logs

For the period our hosting provider keeps them, which is short.

When a period ends, or when you ask, the record is deleted from the database rather than hidden, and it goes from our backups as those roll over. Nothing is printed, exported to a spreadsheet or kept on anybody’s laptop, so there is no second copy to go and find.

Depending on where you live, you may have the right to see what we hold about you, to have it corrected, to have it deleted, to have us stop or limit what we do with it, to take it elsewhere in a portable form, and to withdraw a consent you gave without that costing you anything.

Write to justin@visit-saipan.com and say what you want done. We do not have a form, we will not ask you to create an account, and we will not charge you.

One honest limit: we identify a saved trip by the link and the address it was sent to, and nothing else. If you ask us to delete a trip, tell us the link or the address — otherwise we genuinely cannot find it, and we would rather say so than guess and delete somebody else’s holiday.

If you are in Korea and are not satisfied with our answer, you can complain to the Personal Information Protection Commission. If you are in the European Union or the United Kingdom, you can complain to your national supervisory authority.

This site is built for the adult planning a family holiday, not for children. It has no account, no profile, no messaging and nothing to buy, and we do not knowingly collect personal data directly from a child.

The one thing we hold about a child is an age, given by the adult who is planning the trip, and used to decide what the itinerary may contain — a dive has a minimum age, a beach has a current, a resort has a kids’ club. It is in the link, as described above. If a child is old enough to be sending links themselves, they should know that.

If you believe a child has given us personal data, write to justin@visit-saipan.com and we will delete it.

The database refuses every request that does not come from our own server, and your browser holds no key to it. Saved trips are reachable only through an unguessable identifier, and the one that lets you edit a trip is separate from the one that lets somebody read it.

That is a real design and not a guarantee. A link is only as private as the people it has been sent to, and no system is unbreakable. If something goes wrong we will say so.

When this policy changes, the date at the top changes with it. If a change means we would be doing something new with data we already hold — a new advertising partner, a new purpose — we will ask again rather than assume the old answer covers it.