Privacy policy

1. Who is responsible

The data controller is DIGITAL WEB GROUP LIMITED, 2nd Floor College House 17 King Edwards Road,, RUISLIP, London, HA4 7AE - UNITED KINGDOM. For anything about your data, write to [email protected].

2. What we collect

• Account: name, email address, password (stored only as a one-way hash), and optionally phone number, country and profile photo.
• Bookings: the lead guest's name, email and phone, the number of guests, children's ages for holidays, your expected arrival time, anything you write in the notes, and the record that you accepted the house rules, the cancellation policy and the payment plan, with the time and your IP address.
• Payments: amounts, dates, status and Stripe reference numbers. For a saved card we keep only its brand and last four digits. Card numbers go directly to Stripe and never reach our servers. For bank transfers we keep the receipt you upload.
• Messages you exchange with us, favourites you save, and reviews you write.
• Technical data: IP address and browser details in our security logs, and the cookie that keeps you signed in.

3. Why we use it, and the legal basis

• To create and manage your bookings, take payment and contact you about your trip: performance of our contract with you.
• To keep invoices and payment records: a legal obligation under tax and accounting law.
• To prevent fraud and abuse, keep the site secure and evidence what was agreed in case of a payment dispute: our legitimate interest.

4. Who receives your data

• Stripe (payment processing, card storage and fraud prevention).
• Our hosting, file storage and email delivery providers, who process data on our instructions.
• Our AI provider receives the text you type into the Concierge, and nothing else: not your name, contact details or bookings. Please do not put personal details in that text. The provider may process it outside the European Economic Area.
• The owner or manager of the property, or the hotel, receives the lead guest's name, the number of guests, the dates and your arrival time, so they can welcome you.
• Authorities, when the law requires it, for example guest registration rules in some countries.

We do not sell your data. Where a provider processes data outside the European Economic Area, this happens under the European Commission's standard contractual clauses or an adequacy decision.

5. How long we keep it

• Booking and payment records: for as long as tax and accounting law requires, typically up to 10 years.
• Your account: until you ask us to delete it. Bookings already made are then kept in the form the law requires, without your profile.
• Messages: for 3 years after the related trip.
• Security logs: up to 12 months.

6. Cookies

We use only the cookies needed to run the site, above all the one that keeps you signed in. We do not use advertising or cross-site tracking cookies. Stripe sets its own cookies on its payment pages to prevent fraud.

7. Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. You can change most of it yourself in your account. Write to [email protected] and we will answer within one month. You also have the right to complain to the data protection authority of the country where you live.

8. Changes

When we change this policy we update the date at the top. For significant changes we tell account holders by email.