The short version. Signing in is optional, there are no ads, and we never sell data. Google Analytics runs only if you say yes, and you can turn it off at any time. A screenshot you give us is used only to read the hotel, dates and price for your check, and is not kept. The prices we collect are stored anonymously, without anything that identifies you. When a check compares a hotel’s own price with Booking.com, we publish the comparison as a public page, anonymously: it never says who checked.
Who we are
BookHotels.direct (website and app) is responsible for the processing described here. Contact: [email protected].
What we process and why
Using the website or the app. Our hosting provider, Cloudflare, receives technical data with every request (IP address, browser or device type, the page requested and the time). It is used to deliver the service and protect it against abuse, and kept only in short-lived security logs. Legal basis: our legitimate interest in running a secure service (Art. 6(1)(f) GDPR). Our fonts are served from our own domain, not from a third party. On the website, Cloudflare Web Analytics also counts visits (the page, the site you came from, browser type and country) without cookies, without storing anything on your device and without identifying you; we see only totals. Legal basis: Art. 6(1)(f) GDPR. Each time the Android app starts, it asks Expo’s update service whether a newer version of its code is available, and downloads it if there is one. That request carries the phone’s operating system, the app’s version and a random token for that installation, which is not linked to you or your account. Legal basis: our legitimate interest in keeping the app working and secure (Art. 6(1)(f) GDPR).
Google Analytics, only if you say yes. The website and the app ask whether we may use Google Analytics to learn how BookHotels.direct is used: which pages and screens are opened, how you arrived (for example from one of our posts or another website), and steps such as starting a check, the kind of result (a saving only as a range, never the exact prices), opening the hotel’s website, signing in, sharing, and your answer to “Did you book it?”. Google also sees your browser or device type, language and approximate location. It never gets your name, email, account, screenshots, dates, Booking.com links or the prices you type. On the website, Google Analytics sets two cookies, _ga and _ga_TMD5EG2NVJ (up to two years); in the app, it uses a Firebase app instance ID. We do not use the advertising ID, Google signals or ad personalisation. Until you answer, nothing is loaded from Google and nothing is stored on your device: the pages of that visit wait only in the app’s memory and are sent only if you say yes, so the visit still counts for the post that brought you. Legal basis: your consent (Art. 6(1)(a) GDPR; art. 22.2 LSSI). You can withdraw it at any time, as easily as you gave it: in the app under Me → Usage statistics, or with the button below for this browser. We remember your answer on your device (a no for three months, after which we may ask again). We also count, per day, how often the question is shown and answered yes or no, without anything that identifies you.
Price checks. When you ask for a check, the stay details (hotel, dates, number of guests) are used to ask the hotel’s own booking website for its price, and we show you the result. In the app, your phone asks the hotel’s booking website itself, as if you opened it: for some hotels it opens the hotel’s booking page out of sight and keeps only the prices that page shows and any promo codes the hotel advertises on it. Like any website you visit, the hotel’s booking website then sees your phone’s internet address and browser type, and may set its usual cookies, which stay on your phone. Your phone sends us only the prices and advertised codes it read. We keep the hotel’s deals we learn this way (its free club, its offers, and whether an advertised code lowers the price) so that every check of that hotel can use them. On our website, our servers ask instead. We store the prices as anonymous records (hotel, dates, guests, room, price, time) to keep our price information up to date. These records contain no personal data. Legal basis: providing the service you ask for (Art. 6(1)(b) GDPR).
Screenshots and photos. If you share a screenshot with the app, choose one, or take a photo, we use it only to read the hotel, dates, guests and price for your check. Where this reading happens on our servers, the image is processed by Cloudflare (including Cloudflare Workers AI) and deleted once the check is done. We do not store it and do not use it to train models. The camera is used only when you tap “Take a photo”. Legal basis: Art. 6(1)(b) GDPR.
Links and details you type. If you share a Booking.com link with the app, we read the hotel, dates and guests from the link’s address. For Booking.com’s short share links, the app first follows the link on your phone, as your browser would, to find that address; it does not read Booking.com’s page, and it removes Booking.com’s tracking codes before anything reaches us. The hotel, dates, guests and any price you type are used for your check and stored anonymously, without anything that identifies you, to build our price comparison. Legal basis: Art. 6(1)(b) and 6(1)(f) GDPR.
Your clipboard. When you open the Android app or come back to it, it looks at your clipboard on your phone, only to offer a check when it holds a Booking.com hotel link. The clipboard is not sent to us or stored; the app keeps only a short fingerprint of the links it offered, so it does not ask twice. The link reaches us only if you tap “Check it”, and then as described above.
Fair use. To protect hotels’ websites and our data against automated copying, we count how many different hotels and stays each visitor checks per hour and per day. Visitors are counted by a salted hash of their IP address that changes every day; the address itself is not stored, and the counts are deleted after two days. Legal basis: Art. 6(1)(f) GDPR.
AI assistants. An AI assistant (such as Claude or ChatGPT) can check hotels for you through our assistant connection at https://bookhotels.direct/mcp. The assistant sends us only what a check needs: the hotel, the dates, the number of adults and each child’s age, the Booking.com total and terms it holds for you and, if it looked at the hotel’s own website for you, the prices it saw there. We never receive your conversation, your name or your contact details. We use these details to read the hotel’s own price and compare, and keep the prices as anonymous price records, like any check; prices an assistant reports from the hotel’s website can answer the next traveller who asks about the same stay, once they pass our checks (a real assistant connection, the conversation that ran the check, the hotel’s own price history). Each check gets its own page on bookhotels.direct with the result (not shown in search engines), kept until 30 days after check-out, where we count clicks through to the hotel’s website and whether you tell us you booked. We also keep the name the assistant gives itself (for example “claude-ai”) and count checks per assistant platform, as in Fair use above. Legal basis: Art. 6(1)(b) and (f) GDPR. Your conversation is handled by the assistant’s provider under its own privacy policy.
Public finds. When a check ends in a comparison we can state (the hotel’s own website cheaper, Booking.com cheaper, or the same price), we publish it as a public page on bookhotels.direct, shown in search engines and AI answers: the hotel and its town, the dates, the number of nights, adults and children (with their ages), the Booking.com total and the hotel’s own total, the hotel’s room and terms, what each price includes, any public code or members’ price, and the date checked. The page says it was found by a traveller, never who: it holds no name, contact details, account, device, IP address or anything else that links it to you, and nothing you typed in your own words. When you share a deal from the app, you share this page; shared from the Booked screen, it says a traveller booked direct. If you told the app what you paid, that price stays on your phone. We count how often a page is opened. To limit misuse, we count how many finds each visitor creates per day, with the same daily key as in Fair use, deleted after two days. To ask for a page to be taken down, write to [email protected] with its address. Legal basis: our legitimate interest in showing travellers what booking direct saves (Art. 6(1)(f) GDPR); the pages contain no personal data.
Your checks, on your device. The app keeps your last 24 checks (hotel, dates, guests, the prices and the result) on your phone, or in your browser on the website, so you can see them and run them again under Me. They are not sent to us. Delete them in Me (Clear my checks), or by uninstalling the app or clearing this site’s data in your browser.
Your account (optional). In the app you can sign in with Google to see the full details of a check and book. We then receive from Google your Google account ID, email address, first name, last name and the address of your Google profile photo, and keep these, plus when you signed up and last used the app. We use your name and photo only to greet you by name and show your photo in the app. We store the photo’s address, never the photo itself: the app shows it from Google’s servers. Your name and photo are updated each time you sign in, and kept until you delete your account; the app also keeps them on your phone with your sign-in until you sign out. We do not get your password, contacts or anything else from your Google account. You can delete your account at any time in the app (tap your profile, then Delete account) or by emailing [email protected]; this removes the account, including your name and photo address, and everything linked to it. Legal basis: Art. 6(1)(b) GDPR.
The hotel’s website inside the app. When you open a hotel’s own website from the app, it opens inside the app. If you allow it (we ask once), the app notices when the hotel shows a booking confirmation page, using only the page’s web address. We then store the hotel, the date and the booking site’s domain name, linked to your account if you are signed in. When you close the hotel’s website, the app may ask whether you booked, and whether it was at the price we showed. If you answer yes, we store that answer with the hotel and the date, linked to your account if you are signed in. We never read or store what you type on the hotel’s website, your booking details, the amount you paid or payment information. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw by reinstalling the app or emailing us.
Email. If you write to [email protected], the message is forwarded to us by Cloudflare Email Routing. We use your address and message only to reply, and keep the correspondence as long as needed to deal with your request. Legal basis: Art. 6(1)(b) and (f) GDPR.
Who else is involved
- Cloudflare, Inc. provides hosting, our database, email forwarding, AI processing and cookie-free website statistics, and acts as our processor. Our database is located in the EU. Cloudflare may process technical data outside the EU; such transfers are covered by the EU–US Data Privacy Framework and the European Commission’s Standard Contractual Clauses.
- Google distributes the Android app through Google Play, provides “Sign in with Google”, and processes data for that under its own privacy policy.
- 650 Industries, Inc. (Expo) delivers the Android app’s updates as our processor. Expo may process this data in the United States; such transfers are covered by the EU–US Data Privacy Framework.
- Google Ireland Limited provides Google Analytics (only if you say yes) as our processor. Google may process this data in the United States; such transfers are covered by the EU–US Data Privacy Framework and the European Commission’s Standard Contractual Clauses.
- When you open a hotel’s own website from our site or app, that hotel’s privacy policy applies to what you do there.
How long we keep data
Security logs: a short time (days to weeks) at Cloudflare. Google Analytics data: 14 months. Your analytics answer: on your device until you change it (a no for three months). Anonymous price records and public finds: kept, as they are not personal data. Account (including your name and photo address) and booking notes: until you delete your account. Assistant check pages: until 30 days after check-out. Visitor counts: two days. Emails: as long as needed for your request.
Your rights
You can ask for access to, correction or deletion of your personal data, restriction of or objection to its processing, and data portability, by writing to [email protected]. You can also complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (www.aepd.es).
Children
The service is meant for adults booking travel and is not directed at children.
Changes
If we change how we process data, we will update this page and the date above.