1. Scope
This Policy applies to Creations, a California corporation, and its operation of Creations Prism Private, the public Site, Prism Private Member Access, membership inquiries, and related travel and concierge services. It covers website visitors, applicants, members, authorized representatives, household members, travelers, travel companions, business contacts, and people whose information is provided to support a journey. A supplier or linked service may provide a separate notice for its own processing.
2. Information collected
Depending on the relationship and requested service, Creations may collect names, email addresses, telephone numbers, addresses, cities and countries; account, authentication, membership, household, and representative-authority information; traveler profiles; passport, visa, and other government-identifier information; loyalty details; itineraries and booking records; billing records or payment tokens; travel, seating, room, dining, allergy, dietary, accessibility, and health-related preferences; emergency contacts; communications, documents, photographs, location or travel-status information; device, browser, IP, cookie, security-log, inquiry-response, and inferred preference information. Public forms request only the fields displayed and instruct users not to submit sensitive travel documents.
3. Sources of information
Information may come directly from the individual or from an authorized household representative, executive assistant, family office, travel companion, supplier, authentication provider, payment processor, or service provider. Device and browser information may be generated when the Site is used. Creations may also use information from a prior Creations relationship or a public source when appropriate for a requested service, verification, security, or legal purpose.
4. Purposes for collection and processing
Creations uses personal information to respond to inquiries; evaluate private membership introductions; administer membership and accounts; plan travel; request and manage reservations; coordinate with suppliers; maintain traveler profiles; administer payments and billing records; provide customer service; prevent fraud and protect accounts; satisfy legal duties; assist during disruption; send operational communications; understand Site performance; improve services; and provide marketing only where separately permitted. Information is not used for a materially different purpose without an appropriate notice or consent when required.
5. Sensitive information
Sensitive information may include passport details, government identifiers, credentials, financial information, precise travel location, health and allergy information, dietary and accessibility needs, private communications, security arrangements, and minor-traveler information. Creations limits its use to appropriate travel, safety, accessibility, security, account, legal, and service purposes. Sensitive information is not used for unrelated advertising, and public forms should not be used to transmit passports, raw payment details, medical documents, or security plans.
6. Consumer health and accessibility information
Creations may collect limited health, dietary, allergy, mobility, and accessibility information when an individual or authorized representative asks it to arrange travel, accommodations, dining, support, or safety measures. Collection is limited to information reasonably related to the request. Creations discloses it only as reasonably required to appropriate personnel, suppliers, and service providers, applies restricted access, and honors applicable access, deletion, correction, and consent-withdrawal rights. Additional information is available in the Consumer Health Data Notice.
7. How information is used
Contact and inquiry information supports responses and private introductions. Account and membership information supports identity, authorization, and service administration. Traveler and itinerary information supports planning, confirmations, updates, and disruption assistance. Billing records support payment administration and accounting. Communications and documents support requested service and recordkeeping. Device and security information protects forms and accounts and diagnoses errors. Preference information personalizes service. Consent and suppression records honor communication and privacy choices.
8. How information is disclosed
Information may be disclosed as reasonably necessary to hotels and resorts; villa and residence providers; airlines; private aviation and yacht operators; transportation providers; restaurants; guides; event providers; insurers; payment processors; authentication, cloud-hosting, document, communications, security, and analytics providers; professional advisers; regulators and law enforcement; and a lawful successor in a transaction. Travel suppliers receive information needed to provide the requested journey, which is distinct from disclosure for advertising.
9. Sale, sharing, targeted advertising, and profiling
The current public Site and Prism Private Member Access do not sell personal information, share it for cross-context behavioral advertising, use advertising pixels, or use session replay. Creations does not use personal information for targeted advertising or qualifying profiling. A recognized Global Privacy Control signal is treated as an opt-out request where applicable. Before any materially different advertising practice is introduced, Creations will update this Policy and provide legally required notice and choices through Privacy Choices.
11. Retention
Unsuccessful membership inquiries are retained for the period reasonably needed to respond and maintain suppression, security, and dispute records, ordinarily no longer than 24 months unless law or a legal hold requires more. Current-member and travel records are retained during the relationship and for applicable tax, accounting, contractual, safety, and claims periods after it ends. Financial records are generally retained for seven years. Passport, visa, health, accessibility, and precise travel-status information is removed or de-identified when no longer needed for the journey or continuing profile purpose. Messages and security logs use risk-based schedules; consent and marketing-suppression records are retained as needed to honor the choice. A legal hold suspends ordinary deletion.
12. Security
Creations uses reasonable administrative, technical, and physical safeguards appropriate to the information and service. Measures represented in the service design include encryption in transit, restricted access, server-side authorization, multifactor authentication where offered, secure document links, vendor review, security logging, incident-response procedures, protected backups, deletion controls, and vulnerability management. Sensitive member data is not stored in browser storage. No security program can eliminate every risk, and individuals should promptly report suspected unauthorized access.
13. Rights for United States residents
Subject to applicable exceptions, United States residents may use the same nationwide process to request confirmation or access, correction, deletion, portability, opt-out of sale or sharing, opt-out of targeted advertising, limitation or withdrawal of sensitive-data consent, and an appeal of a denied request. Exact rights vary by state. Creations does not discriminate against a person for exercising an applicable privacy right and does not require creation of an account solely to submit a request.
14. California privacy notice
California residents may request access to categories and specific pieces of personal information, sources, purposes, recipient categories, correction, deletion, and portability, subject to applicable exceptions. They may opt out of sale or sharing and use Global Privacy Control; the current services do not sell or share personal information for cross-context behavioral advertising. Sensitive information is used only for permitted service purposes described above. An authorized agent may submit a request with appropriate authority, and Creations may verify identity proportionately. These rights are offered as a service baseline without representing that a particular statutory threshold necessarily applies.
15. Other state privacy rights
Residents of states that provide additional privacy rights may exercise them through Privacy Choices. Depending on applicable law, those rights can include access, correction, deletion, portability, opt-out rights, sensitive-data choices, and review of certain automated processing. If Creations denies a request, the response will explain available appeal steps. A person may submit an appeal through the same form by selecting the appeal option.
16. International visitors
Creations operates from California and the United States, and information may be processed in the United States. International travel can require disclosure to suppliers or authorities in destination or transit countries. People outside the United States may have non-waivable rights under local law, including applicable rights to access, correction, deletion, restriction, objection, portability, consent withdrawal, or a regulator complaint. Creations will evaluate requests under the law that applies to the person and processing and does not claim that every privacy law applies to every interaction.
17. International travel data transfers
To fulfill an international journey, Creations may need to send limited traveler information to hotels, airlines, border or other authorities, transportation providers, guides, event providers, medical-assistance providers, or other suppliers in the destination or transit country. The information shared depends on the reservation, legal requirement, safety need, and traveler instruction. Destination-country privacy protections may differ from those in the traveler’s home jurisdiction.
18. Children and minor travelers
The public Site is not directed to children under 13, and minors do not independently create Prism Private accounts or establish membership. A parent, guardian, or other authorized adult may provide information reasonably necessary for a minor traveler. Creations does not sell minor data or use it for targeted advertising. An authorized parent or guardian may submit an applicable access, correction, or deletion request through Privacy Choices.
19. Automated processing
The Site may use automated security assistance, such as bot detection, validation, rate limiting, and fraud signals, and Creations may use software to organize requests or travel information. No automated system makes the final decision regarding Prism Private Membership acceptance, membership termination, confirmed travel bookings, supplier confirmations, or emergency responses. Material decisions remain subject to authorized human review.
20. Privacy requests
Submit a request through /privacy/choices without creating an account. The form supports access, correction, deletion, portability, opt-out, sensitive-data, consent-withdrawal, authorized-agent, and appeal requests. Creations may ask for information reasonably necessary to verify identity, authority, and the records involved and will respond according to applicable law. Authorized agents should identify that role and may be asked for proof of authority. If the online form is inaccessible, use /contact and request an alternate method. Internal workflow status and risk signals are not publicly exposed.
21. Changes to this Policy
The version, effective date, and last-updated date identify the current Policy. Creations may revise it to reflect service, vendor, security, or legal changes. Material changes will be communicated through an appropriate Site, account, or direct notice before taking effect when required, and consent will be obtained for a materially different practice when the law requires it. Prior versions are maintained in Creations’ records and may be requested through Contact.
22. Contact
Questions about this Policy or Creations’ privacy practices may be submitted through /contact. Privacy-rights requests, appeals, and authorized-agent requests should use /privacy/choices so they can be routed and verified consistently. Do not include raw payment-card data, passport images, medical records, complete itineraries, or security arrangements in a public message.