Privacy Policy

1. Who we are

Sterling Point operates small-group heritage and film-location boat cruises on Lake Muskoka, Ontario, Canada. We are the organization accountable for the personal information described in this policy. Questions may be directed to our privacy contact listed in section 10.

2. What we collect

We only collect what we need to answer your tour request:

• Your name
• Your email address
• Your phone number (optional)
• Your preferred starting point, number of guests and up to three preferred date/time options
• Any notes you choose to add (please do not include health, payment or other sensitive details)
• The date you submitted the request and the consent you gave

We do not ask for payment card numbers on this website, we do not require an account, and we do not knowingly collect information from children.

3. Why we collect it

We use your information for these purposes only:

• To contact you and confirm or decline a requested cruise
• To plan capacity, departure points and passenger safety for a sailing
• To keep a record of the request and your consent, as required for accountability
• To send you occasional news about sailings and availability — only if you separately opted in, and every message includes a one-click unsubscribe (CASL)

We do not sell, rent or trade your personal information. We do not use it for advertising profiling.

4. Consent

We ask for your express consent before you submit the tour request form, and separately before sending any commercial email. You may withdraw either consent at any time by contacting us or using the unsubscribe link. Withdrawing consent for marketing does not affect a booking already in progress; withdrawing consent to be contacted about a request means we can no longer process that request.

5. Cookies and tracking

This site does not use advertising or cross-site tracking cookies and does not sell behavioural data. Only strictly necessary technical storage required to serve and secure the pages is used. If we ever add analytics or marketing cookies, we will ask for your consent first and update this policy.

6. Where your information is stored, and who can see it

Tour requests are transmitted over an encrypted TLS connection and stored in our booking records system, Airtable, which we use as a service provider under contract. Access is limited to Sterling Point crew members who need it to schedule and confirm sailings, and is protected by individual accounts and strong authentication. Credentials for that system are held as server-side secrets and are never exposed in this website's code or in your browser.

Because our service provider may process or back up data on servers located outside Canada, including in the United States, your information may be subject to the laws of those jurisdictions, including lawful access requests by foreign authorities. We use providers who commit to comparable safeguards.

7. How long we keep it

We keep tour request records for up to 24 months after the requested sailing date, so we can handle follow-ups, rebookings and safety or insurance questions, then delete or anonymize them. Marketing consent records are kept for as long as you remain subscribed plus three years, as CASL requires proof of consent.

8. Safeguards

We protect personal information with safeguards appropriate to its sensitivity: encryption in transit (HTTPS/TLS), encryption at rest by our storage provider, server-side handling of all secret keys, least-privilege access for crew, input validation and length limits on every form field, and prompt deletion of records that are no longer needed. No method of transmission or storage is perfectly secure, but we review these measures regularly.

9. Your rights

Under PIPEDA you may:

• Ask what personal information we hold about you and request a copy
• Ask us to correct information that is inaccurate or incomplete
• Ask us to delete your information, subject to our legal obligations
• Withdraw consent, subject to reasonable notice
• Make a complaint to us, and then to the Office of the Privacy Commissioner of Canada

We respond to requests within 30 days and may ask you to verify your identity first.

10. Breach response

If a breach of security safeguards creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify affected individuals as soon as feasible, and keep records of the incident as PIPEDA requires.

11. Contact us

Privacy questions, access requests and complaints: (289) 928-1853, Bala, Port Carling, Gravenhurst, Ontario, Canada.