Privacy policy
Last updated: 29 October 2026
1. Controller and contact
The controller responsible for data processing on this website is:
b.web.de Internet Solutions UG (haftungsbeschränkt)
Stuntzstr. 2, 81677 München, Germany
Email: support@bookhotelstay.com
2. Overview of processing
We process personal data only to the extent needed to operate this hotel booking service: to display hotel offers, to complete and administer your bookings, to maintain your account if you create one, to send emails you have asked for, and to keep the website secure. The sections below describe each processing purpose, the data involved, the recipients and how long the data is kept.
3. Legal bases (Art. 6 GDPR)
- Art. 6 (1) lit. b — processing necessary to perform a contract with you or to take steps at your request before entering a contract (for example making a booking or maintaining your account).
- Art. 6 (1) lit. a — your consent (for example optional cookies, marketing widgets, newsletter). You can withdraw consent at any time with effect for the future.
- Art. 6 (1) lit. f — our legitimate interests, such as the secure and stable operation of the website (server logs).
- Art. 6 (1) lit. c — compliance with legal obligations, in particular statutory retention duties.
4. Hosting and server logs
This website is hosted by Lovable. When you visit the site, the hosting infrastructure automatically processes technical access data (such as IP address, time of access, requested page and browser information) in server logs. This is necessary to deliver and secure the website and is based on our legitimate interest in its stable operation (Art. 6 (1) lit. f GDPR). Logs are retained by the hosting provider according to its own retention schedule.
To protect our hotel search and travel concierge from automated abuse, we count requests per visitor. For this we store only a salted, one-way hash of your IP address together with a request counter, never the IP address itself, and delete these entries after at most 24 hours. The legal basis is our legitimate interest in secure operation and preventing misuse (Art. 6 (1) lit. f GDPR).
Our backend and database (Lovable Cloud, operated on Supabase infrastructure) are located in the European Union, in the AWS region eu-west-1 (Ireland). Account, booking, review and newsletter data are stored there. The website itself is delivered through a global edge network, so pages may be served from a location close to you. This edge network is operated by Cloudflare, Inc. (USA) for our hosting provider. Page requests and the related server logs may be processed in Cloudflare data centres worldwide, including in the United States (see transfers outside the EU/EEA).
5. Hotel search and booking
When you search for hotels, your search criteria (destination, dates, number of guests) are passed to our booking partner LiteAPI to retrieve available offers. When you book, the guest details required for the reservation — name, email address and, where needed, phone number — are passed to LiteAPI to prebook and complete the booking with the accommodation provider.
When you continue to payment, we also keep your name, email address, the stay details and the payment reference for this checkout on our own server. This lets us complete your booking exactly once and show its confirmation even if you return from the payment step in another tab or browser. Once the booking is confirmed, your last name and full email address are removed from this record (only your first name and a masked email remain for the confirmation page); unbooked checkouts are deleted after 2 days and confirmed ones after 30 days.
This processing is necessary to fulfil the contract with you (Art. 6 (1) lit. b GDPR). Booking records are kept in our system so you can view your stays in your account and so we can meet statutory retention duties.
6. Payment
Payment card details are entered directly into the Stripe payment widget provided via LiteAPI. Card data does not pass through our own servers at any point; we only receive the booking and payment status needed to confirm your reservation. The processing of your payment data by the payment provider is governed by its own privacy terms.
7. Account and sign-in
Accounts and sign-in are provided through Lovable Cloud, the backend service of our hosting platform Lovable, which is built on the authentication and database service of Supabase. You can sign in with email and password (including password reset by email), with Google or with Apple.
For each account we store: your email address, a hashed version of your password (if you use email sign-in — we never store the password itself), a user ID, and technical timestamps such as when the account was created, confirmed and last signed in. If you add them, we also store your profile details: full name, phone number and travel preferences. These are used so your bookings appear in your dashboard and your checkout form can be pre-filled.
If you sign in with Google or Apple, you are redirected to that provider. The provider confirms your identity and shares your email address and basic account information with us (for Google, this may include your name); in turn, the provider learns that you are signing in to BookHotelStay. The privacy policy of Google or Apple applies to the processing on their side.
The legal basis is the performance of the account contract (Art. 6 (1) lit. b GDPR). Your account data is deleted when your account is deleted. You can request deletion of your account at any time; booking records subject to statutory retention duties are kept for the required period.
9. Post-booking emails
After a booking we send you a confirmation email with your hotel details and stay dates.
- Transactional emails (booking confirmation and booking-related information) are sent to perform our contract with you (Art. 6 (1) lit. b GDPR).
- Marketing emails (travel tips, offers and partner offers) are only sent with your explicit consent (Art. 6 (1) lit. a GDPR), collected via double opt-in. You can withdraw your consent at any time via the unsubscribe link in every email. Our provider for marketing emails is Brevo.
11. Analytics
Google Analytics. If you consent to the "Analytics" category, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). It helps us understand how many people visit the site, where they come from (for example a search engine, another website or a campaign link), which pages they view and how many start and complete a booking.
Google Analytics sets cookies (_ga, _ga_…) and processes usage data such as the pages viewed, the referring website, device and browser information, an approximate location derived from your IP address (GA4 does not store full IP addresses) and, for completed bookings, the booking reference, hotel, amount and currency. We do not send your name, email address or payment data to Google. Page addresses are shortened before they are sent so that booking references or other values in the address are not transmitted. Google signals and ad personalisation are switched off.
Google Ads conversion measurement. If you consent to both the "Analytics" and the "Marketing" categories, we also tell Google Ads (Google Ireland Limited) when a booking is completed (booking reference, amount and currency), so we can see which of our ads led to bookings. For this, Google may set advertising cookies (_gcl_…) that store the ad click you came from. Ad personalisation stays switched off. The legal basis is your consent (Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG); if you withdraw marketing consent, these cookies are removed.
Matching bookings to ad clicks. If you consent to the "Marketing" category and arrive via one of our Google ads, we keep the ad's click ID (gclid), the time and the landing page in your browser's local storage for up to 30 days, and with your checkout record when you continue to payment. If you book within that period, we store this click ID with the booking reference, hotel, amount and currency – without your name, email address or payment data – and look it up in our own Google Ads account to see which ad campaign and keyword led to the booking. The click ID is deleted as soon as the lookup is done, and at the latest after 90 days; only the campaign and keyword remain. With the same consent, we also count – without the click ID or any other identifier – whether a visitor who came from one of our ads reached a hotel page and the payment step, stored only as the step, the landing page and the time, so we can see how many ad visitors get how far. The legal basis is your consent (Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG). If you withdraw marketing consent, the stored click is removed from your browser.
The Google Analytics script is only loaded after you have given consent. The legal basis is your consent (Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG). You can withdraw your consent at any time via Cookie settings in the footer; tracking stops and the Google Analytics cookies are removed. Google may process data in the United States (see section 13). Google Analytics deletes visitor-level data after the retention period set in our account (at most 14 months). More information: Google privacy policy.
Search terms. We also record the search terms entered on this site (destinations and phrases) in our own database to improve our offering; this log is not shared with third parties and is not linked to your name.
Google Hotel Ads. We share hotel information and room prices (no personal data) with Google so our offers can appear in Google Hotel search. If you arrive from such an offer, the link only carries your travel dates, number of guests and the selected offer.
12. Affiliate partners and widgets
With your marketing consent, activity widgets from our partner GetYourGuide are loaded on some pages; when you interact with them, data is processed by GetYourGuide under its own privacy terms, and partner analytics may attribute bookings to our referral. Some outbound links are affiliate links: if you book through them, we may earn a commission at no extra cost to you. Widgets and affiliate tracking are only loaded after you have given marketing consent.
13. Transfers to third countries
Some of our service providers may process personal data outside the EU/EEA. Where this is the case, the transfer is based on an adequacy decision of the European Commission (for example the EU-US Data Privacy Framework for certified US recipients) or on Standard Contractual Clauses, depending on the provider.
| Provider | Purpose | Transfer outside the EU/EEA | Legal basis for the transfer |
|---|---|---|---|
| Lovable | Website hosting, backend, database, sign-in and booking-confirmation emails | No — provider is based in the EU (backend and database in Ireland) | not applicable |
| Cloudflare | Edge network that delivers the website pages for our hosting provider (incl. server logs and bot protection) | Yes — United States possible | EU-US Data Privacy Framework (Art. 45 GDPR) |
| LiteAPI (Nuitée) | Hotel search, prebook and completion of bookings | No — provider is based in the EU (Ireland) | not applicable |
| Stripe | Payment (card data entered in the payment widget) | Yes — United States | EU-US Data Privacy Framework (Art. 45 GDPR) |
| Lovable AI | Processing of the stay description for the AI concierge | Yes — United States (model endpoints of the AI providers) | EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR) in the model provider's data processing terms |
| Google and Apple | Optional sign-in; email address and basic account data | Yes — United States | EU-US Data Privacy Framework (Art. 45 GDPR) |
| Google Analytics | Visitor statistics and booking conversions (only after analytics consent); Google Ads conversion measurement (only after analytics and marketing consent); matching bookings to ad clicks (only after marketing consent) | Yes — United States | EU-US Data Privacy Framework (Art. 45 GDPR) |
| Brevo | Newsletter, price alerts and marketing emails | No — provider is based in the EU (France) | not applicable |
| GetYourGuide | Activity widgets and partner analytics (only after marketing consent) | No — provider is based in the EU (Germany) | not applicable |
14. Your rights
You have the right at any time to:
- access the personal data we hold about you (Art. 15 GDPR),
- rectify inaccurate data (Art. 16 GDPR),
- request erasure of your data (Art. 17 GDPR),
- restrict processing (Art. 18 GDPR),
- receive your data in a portable format (Art. 20 GDPR),
- object to processing based on legitimate interests (Art. 21 GDPR),
- withdraw consent you have given, with effect for the future (Art. 7 (3) GDPR).
To exercise these rights, contact support@bookhotelstay.com. You also have the right to lodge a complaint with a supervisory authority, in particular the Bavarian State Office for Data Protection Supervision (BayLDA).
15. Storage periods and statutory retention duties
We keep personal data only for as long as the purpose requires. Booking and invoice data is subject to statutory retention duties under German commercial and tax law and is deleted once those periods expire. Data processed on the basis of consent is deleted when you withdraw consent, unless another legal basis requires longer storage.