Privacypolicy.

Nomad Live runs guided horseback journeys in Kyrgyzstan. This policy covers the website at nomadlive.kg: the account you can create on it, the booking requests you send through it, and the notes we keep against those requests afterwards.

The business behind it is the one named in the first line of the notice above. Its registered name and its country of registration are the first thing the operator owes this document and neither is guessed at here, so until they are written in, the contact details at the foot of this page are the only way to reach us.

It does not cover the WhatsApp conversation that follows. Once we are messaging each other, that history sits in your WhatsApp account and in ours, under WhatsApp’s own terms rather than this page’s.

There is no checkout here and no payment processor behind it. What the booking form sends is a request: we read it, we check the date is still free, and we come back to you on WhatsApp to agree the details and the money.

So no card number, no bank detail and no payment credential is ever typed into this site, and there is none stored in it. If a deposit is agreed and paid, the only trace of it here is a figure our own staff type in afterwards — the amount, in whole US dollars — as our record of what was received.

Only what a booking request needs. Each item below is a field that genuinely exists in our database, with the reason it exists.

Your email address

It is how you sign in, and the one address we can reach you at if WhatsApp fails.

Your password

Kept only as a bcrypt hash. We cannot read it, recover it or tell you what it is; if you lose it, a member of staff sets a new one with you on WhatsApp.

Your name, WhatsApp number and country

The name goes on the booking. The WhatsApp number is how we actually reach you — it is the channel this operator answers on. The country is optional and helps us plan arrival, altitude and the time we message you at.

The booking itself

Which journey, the departure and return dates, how many riders, the price per person agreed at the time, where the request has got to, the language you were reading the site in when you sent it — so that everything we write to you afterwards arrives in it — and a short reference code such as NL-4F7K2Q so that you and we can name the same booking out loud.

One row for each rider

A booking carries one row per person riding, and the form asks for a single name — yours. The others start as “Traveler 2”, “Traveler 3” and stay that way unless you tell us who they are and we write it in. The rows exist whether or not they carry real names, because attendance and the group discount are counted per head rather than estimated, and because the guides need to know how many are on the trail.

Your own message

Whatever you typed into “Message / special notes”. A bad knee or a first-ever ride has to reach the person leading the ride, so it is kept in your words and is never overwritten by ours.

Your agreement to this page

The moment you ticked the box on the booking form, as a date and a time. It is the only evidence that you agreed, which is why it is recorded rather than assumed: the box starts empty, and a request that arrives without it is refused rather than stored as a consent nobody gave.

What we wrote down after the call

Our staff’s own note of what was agreed, the deposit figure, whether anyone on our side has opened the request yet, and — if it was cancelled — when, by which of us, and the reason given.

The notifications about your booking

Each message we send about a booking is recorded with its text, who it was addressed to, the language it was written in and whether it actually went out, so that a request cannot quietly go unanswered.

The enquiry form on the contacts page is the exception worth knowing about: it stores nothing on this site at all. It writes the message on your device and hands it to WhatsApp or to your mail program, and it shows you the exact text before it leaves.

Two cookies. Both are ours and neither is for advertising.

nomadlive_session

Set when you sign in. It holds one random token and nothing else — not your email, not your role, nothing that can be decoded or forged. Who you are is read from our own database against that token, which means we can end a session by deleting a single row and it stops working on your very next request. It is httpOnly, so no script on the page can read it, and it expires after 30 days.

NEXT_LOCALE

Which of the three languages you chose to read, so the site opens in it next time. It lasts a year and contains nothing but “en”, “ru” or “kg”.

The booking form also keeps a draft of what you have typed in your browser’s own session storage, so that a trip through the sign-in screen does not lose it. That never leaves your device and goes when you close the tab. There are no advertising cookies, no tracking pixels and no analytics of any kind on this site — we do not count visitors and could not tell you how many there have been.

Fonts

The two typefaces are Google’s, but they are downloaded once while the site is being built and are then served from this domain. Your browser does not contact Google to read these pages, so Google is not told that you were here.

Analytics

There are none. No Google Analytics, no advertising pixel, no session recording, no third-party script of any kind on any page.

Email, and the automation hook

A booking request has to reach a person rather than wait in a screen nobody has opened, so the site announces it the moment it arrives. If the operator has configured an automation hook — a Zapier, Make or n8n address that turns the alert into a WhatsApp message — that is the road it takes every time, in preference to email; email is the fallback for when no hook is set. The alert carries your name, your WhatsApp number, your email address, the journey and the dates, and whatever you typed into “Message / special notes”, so that field is posted to that automation service as well as read by us. An alert about a cancellation carries the reason you gave and any deposit we have recorded. Your own acknowledgement travels the same way: by email where a mail provider is configured, and otherwise through the same hook, addressed to your WhatsApp number. Which services these are is named in the notice at the top of this page — until that line is filled in, the operator has not yet told you. Nothing is sent anywhere else.

Advertising and sale of data

We do not sell, rent or trade any of this, and none of it goes to advertising networks or data brokers. There is nothing here to opt out of, because it does not happen.

You can, in your account: your profile, your bookings, the riders on them, the reference code and the total.

Nomad Live’s own staff can, through the staff area of this site. It is behind the same sign-in and opens only for an account marked as an administrator; a customer who reaches one of those URLs is sent back to their own account. That area is where your message, your dates and who is riding are read in order to run the trip.

Nobody else. When a member of staff resets a password at your request, the server log records only the two email addresses involved — never the password, which we do not have in the first place.

A sign-in session is the one thing that expires by itself. After 30 days it is dead, and the row is deleted the next time it is looked at or the next time you sign in. Signing out deletes it there and then, on our side and not only in your browser.

Everything else stays until a person deletes it. A booking is the record of a trip, so we hold it while the trip is ahead of us and afterwards as our own account of what happened.

How long a past booking is kept is one of the decisions listed in the notice at the top of this page, and it has not been made. There is no point printing a number here that nothing in this system enforces. Until it is decided and written in, ask us and we will tell you what we still hold.

Write to the address at the foot of this page and we will answer from it. There is no form and no ticket number: it reaches the people who run the journeys.

See it

Ask for a copy of everything we hold about you and we will send it.

Correct it

Your name, WhatsApp number and country you can change yourself, on your profile page, at any time. For anything else, tell us and we will put it right.

Delete it

Ask and we will delete your account. Your sessions, your bookings, the rider names on them and the queued messages about them go with it — they are removed along with the account rather than left behind, and it cannot be undone.

Withdraw your agreement

The box you ticked on the booking form is your agreement that we may hold these details and contact you about this trip. You can take it back at any time. If you do so before the journey we cancel the request, because a booking we are not allowed to read is a booking we cannot run.

Complain

If our answer does not satisfy you, you can take it further with a supervisory authority. Which data-protection law this policy is written under, and which authority goes with it, are in the notice at the top of this page as things still to be named — so until they are, write to us first, and we will not hide behind the gap.

The form asks for one name and it is yours. Everybody else on the booking starts as “Traveler 2”, “Traveler 3”, so a request for four people tells us nothing at all about the other three. Their names reach us only if you put them in your message or give them on the call for us to write in — and at that moment you are giving us somebody else’s name, so please tell them that you have, and that this page says what becomes of it.

We ask for names and nothing else about them. No dates of birth, no passport numbers, no medical records. If something about a rider matters on the trail it reaches us in your message or on the call, in your own words, and is kept as the note on that booking.

When this changes, the new version replaces this one here and the date at the top changes with it. That date is written by hand, so it is the day the words were actually changed and not the day the site was last published.

If a change affects what we do with something we already hold, we will tell you on WhatsApp as well. Leaving it on a page you have no reason to visit again would not be telling you.