Privacy Policy

Effective date: 7 July 2026 · Version 2

In this privacy statement, we explain which personal data Overlap processes, for what purpose, on what legal basis, how long we keep it, and which rights you have. The summary is short: your quiz answers stay on your device unless you choose to send us your quiz codes for a custom build, and the little that does reach us is processed for one purpose and then deleted. We never sell personal data.

Article 1 — Who we are

Overlap is a sole proprietorship (eenmanszaak) established at Oude Delft 60a, 2611 CD Delft, the Netherlands, and registered in the trade register of the Chamber of Commerce (KVK) under number 42107390. Overlap is the controller of the personal data described in this statement. You can reach us at hello@overlaptrips.com.

Article 2 — Data that never reaches us

This website is a set of static files: there is no application server and no database behind it. Your quiz answers are converted into a short code by JavaScript running on your own device and saved only in your browser's local storage. The overlap report is computed from two codes, in the browser, at view time. In normal use, Overlap does not receive, store, or have access to your quiz answers, codes, or reports; you can verify this in the page source. The one exception is a custom build order, for which you send us your two quiz codes yourself (see Article 3).

Article 3 — Which data we process, why, and for how long

Free mini packs. When you request a free mini pack, we process your email address and the city name. We use this data to send you the mini pack and, if the full pack for that city is released later, to send at most one further email. The legal basis is your consent, which you give by ticking the box on the form and can withdraw at any time. We delete this data from our mailbox once that email has been sent, or earlier on your request; the relay that delivers it to our mailbox runs on our own Cloudflare account and keeps no copy (see Article 4). We do not operate a newsletter or mailing list.

Contact and withdrawal forms. When you use the contact form or the withdrawal form, we process your name, email address, and the content of your message in order to answer your question or handle the withdrawal and refund. The legal basis is the performance of our contract and our legitimate interest in handling correspondence. We delete correspondence once the matter is closed. Records of withdrawals and refunds are kept for 7 years as part of the administration required by Dutch tax law.

Purchases. Checkout is handled by Lemon Squeezy, our merchant of record, which processes your payment under its own privacy policy. Card and payment details never reach Overlap. From Lemon Squeezy we receive the data needed to deliver your order: your email address and the order details. The legal basis is the performance of the contract. We keep this data for two years after purchase, so that we can re-send links on request and honor the guarantee and the statutory conformity rights described in our terms. Records that form part of our administration are kept for 7 years under Dutch tax law.

Custom builds. For a custom build we process the destination, travel dates, the first names provided, the two quiz codes you send us, and your email address, solely to build and deliver your kit. The legal basis is the performance of the contract. We delete this data 30 days after delivery. We send at most one follow-up email after your trip, based on our legitimate interest in hearing how the kit worked. We point this out when you order, and every such email contains a direct way to opt out.

Website analytics. We use Simple Analytics, a Dutch service, to count page views. This measurement is aggregate and cookieless: no identifiers are stored and individual visitors cannot be recognized or followed. The legal basis is our legitimate interest in understanding overall site usage.

We do not use automated decision-making or profiling that produces legal or similarly significant effects for you.

Article 4 — Who receives your data

We do not sell personal data and do not share it with third parties for advertising. We use a small number of service providers, each limited to a single function:

• Lemon Squeezy — merchant of record; handles checkout, payment, invoicing, and VAT under its own buyer terms and privacy policy.
• Cloudflare — hosts this website and routes form submissions (contact, mini pack, withdrawal) and our incoming email through our own Cloudflare account to our mailbox; no copy of a submission is retained by a third-party form service. As with any web host, its infrastructure processes connection data, such as your IP address, in order to serve pages.
• Simple Analytics — aggregate, cookieless page-view statistics, processed in the Netherlands.
• Our email provider — form submissions and correspondence arrive in, and are answered from, the hello@overlaptrips.com mailbox, which is hosted by our email provider.

Article 5 — International transfers

Simple Analytics processes data within the Netherlands. Cloudflare, which hosts this website and routes our forms and email, is certified under the EU–US Data Privacy Framework, which the European Commission has recognized as providing an adequate level of protection; form submissions pass through its infrastructure to our mailbox but are not stored by it. The site's fonts, icons, and scripts are served from our own domain, so viewing this website sends no data to font or script networks.

Article 6 — Cookies

This website does not use cookies or similar trackers that require consent, which is why no cookie banner is shown. The quiz writes your answers to your browser's local storage so you don't lose them between visits; that data stays on your device and is never transmitted.

Article 7 — Your rights

Under the General Data Protection Regulation you have the right to:

1. Access — request a copy of the personal data we hold about you.
2. Rectification — have inaccurate or incomplete data corrected.
3. Erasure — have your data deleted.
4. Restriction — restrict how and why your data is processed.
5. Data portability — receive your data in a structured, commonly used format.
6. Objection — object to processing based on legitimate interest.
7. Withdrawal of consent — withdraw consent at any time, without affecting processing that took place before withdrawal.

To exercise any of these rights, email hello@overlaptrips.com. We respond within one month at the latest, and usually much sooner. If you believe we handle your data improperly, you also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens.

Article 8 — Security

All pages are served over an encrypted connection (HTTPS). We minimize what we collect in the first place; the data that does reach us is held in access-protected systems and is not stored longer than the periods stated in Article 3.

Article 9 — Changes

We may amend this privacy statement, for example when our services or the law change. The current version, with its effective date, is always published on this page. Amendments will not be applied retroactively to data already collected without a valid legal basis.