Privacy Policy

Halcyon Hilltop is a private retreat at 147 McGregor Avenue, Lake Hopatcong, New Jersey, operated by Retreats by Halcyon LLC. When you enquire, book, or stay with us, Retreats by Halcyon LLC is the controller of your information. We decide what is collected and why, and we remain responsible for it even when someone else handles it on our behalf.

When you ask about a retreat or build one, we collect:

• your name, email address and, if you give it, your phone number;
• the dates you are considering and how many people are coming;
• the services you selected and the practitioners you chose;
• what you tell us you are looking for, in your own words, on the enquiry form;
• records of payments taken, and correspondence between us.

We do not buy personal information about you from anyone, and we do not run advertising trackers on this site.

The box asking what you are after is frequently where people write something personal: a bereavement, an injury, an illness, a recovery. We treat everything written there as sensitive health-related information, regardless of which state you live in and regardless of whether a particular statute would compel us to.

That means: it is never used for marketing, it is never sold, it is never shared for anyone else’s purposes, it is shown only to the people who need it to look after you, and it is the first thing removed when you ask us to erase your data.

It is also the information we learn from in order to get better at this work. That use is set out in full in the next section, and it is the one use of this material that we ask you to agree to separately rather than assume.

We use what you give us to answer your enquiry, to plan and run your retreat, to take payment, to keep the records the law requires us to keep, and to talk to you about your own stay.

We also learn from it. Halcyon uses artificial intelligence in the running of this business, and the information described in this policy is used to train and improve those systems. Concretely, that means we study what guests ask for, which combinations of services and practitioners people choose, and how those retreats turn out, so that the recommendations we make and the treatments we design get better over time. The material we hold is ours to learn from in this way.

Two limits on that, and they are real rather than decorative. We do not sell it, and we do not hand it to anyone else to train their own systems on. The learning is for Halcyon’s own service and stays inside it.

The sensitive part is treated differently. What you write about what you are looking for is frequently health-related, and we do not treat “you booked a retreat” as permission to learn from it. Before that material is used for improvement, we ask you plainly, at checkout, and we record your answer against the exact version of this policy you were shown. You can decline and still book; nothing about your retreat changes if you say no. You can change your mind afterwards by writing to admin@retreatsbyhalcyon.com.

Where an outside AI provider processes this information on our behalf, they are held to the same rule as every other supplier below: they act on our instructions, and they may not use it to train anything of their own.

Practitioners. If you select a practitioner, they are shown what they need to look after you: your first name, your dates, the party size, the service they are providing, and what you wrote about what you are looking for. They are not shown your email address, your phone number, what you paid, or anything about the other practitioners on your retreat.

Practitioners are processors, not joint owners of your information. Halcyon decides what is collected and why; practitioners act on our instructions and nothing more. Every practitioner accepts a written agreement before joining the roster that binds them to exactly that, and that agreement covers data protection, confidentiality, restrictions on competing use of what they learn here, and our right to end the arrangement. In practice they may not use your information for their own marketing, may not keep it once their work with you is finished, may not pass it on, and may not learn from it for their own purposes.

The practical consequence for you is that you have one place to go. Every question, correction and deletion request is answered by Halcyon, and we are the ones accountable for what a practitioner does with what we showed them.

Service providers. Payments are processed by Stripe. Card numbers go directly to Stripe and never reach our servers; we hold only a reference to the transaction. Email is delivered by Resend. Our site and database are hosted on Vercel and Neon. Errors and uptime are monitored by Sentry.

What Sentry receives, specifically. When something breaks, our software sends Sentry the address of the page it broke on, the technical description of the fault, and the network information that comes with any web request, which includes your IP address. It is configured not to send the contents of forms, cookies, headers or anything typed into a query. It never receives what you wrote about yourself or your health.

Sentry also holds a copy of our security log for the events that matter, so that a record of who changed what survives the loss of the database it normally lives in. Where an entry concerns a guest, only the domain of the email address is copied, never the address itself. Where it concerns a member of staff, their work address is kept, because the point of the record is to say who did it.

Backups. A copy of our database is taken daily and stored with GitHub, who host our source code. It is encrypted before it leaves us, with a key GitHub does not have, so they hold it without being able to read it.

Stripe, Resend, Vercel, Neon, Sentry and GitHub are all United States companies.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

Enquiries that never became a booking are kept while they are live and removed when they are plainly finished. Bookings that took a payment are kept for as long as tax and accounting rules require, because a record of money received is not ours to delete on request. When you ask us to erase your data, those records are stripped of your name, email, phone number and what you wrote about yourself, and only the dates and the amount remain.

We grant these to everyone who deals with us. We are not asking whether a particular law requires it of us:

• to be told what we hold about you;
• to have it corrected;
• to have it erased, subject to the accounting records above;
• to be given a copy;
• to be free of any penalty for asking. Exercising a right will never change what you are quoted or how you are treated.

We answer within 30 days. Before acting on a request we confirm it came from you, usually by sending a link to the address on the record, because otherwise anyone could erase someone else’s booking.

You can reach us about any of this at admin@retreatsbyhalcyon.com.

Passwords are stored as scrypt hashes and never in a readable form. Sensitive fields are encrypted at rest. Access to guest records is restricted to operators, and every consequential action is written to an audit log we cannot edit through the application.

No system is perfect, and we would rather say so here than imply otherwise. If something goes wrong that affects you, we will tell you.

Halcyon is not intended for children, and we do not knowingly collect information about anyone under 16. If you believe we have, write to us and we will remove it.

This policy carries a version number and an effective date at the top. When the substance changes, the version changes with it. We keep the previous versions, so what you agreed to on a given day can always be produced.