Jet.Guide · Search experiences

Privacy Notice

Last updated: 2026-10-28 (counsel approved the notice; the notes that a paragraph waits for counsel now say it applies only while the feature is switched on)

Who is responsible

Jet.Guide (details in the Imprint) is the controller for the data described here. When you book, the operator of your experience receives the details they need to run it and is a separate controller for what they do with them.

Contact for anything about your data: legal@jet.guide. You can also complain to the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни, www.cpdp.bg) or the authority in your own EU country.

What we collect and why

| Data | Why | Legal basis (GDPR Art. 6) | |---|---|---| | Name, email, phone on a booking; answers to the operator's questions (e.g. hotel, dietary needs); special requests; pickup address | To make and run the booking, send your voucher and reminders | Contract (6(1)(b)) | | Identity details an operator needs for each participant: ID card or passport number, nationality, date of birth, passport expiry (only on listings whose operator asks for them, e.g. a venue that sells named tickets or a boat that keeps a passenger list) | So the operator can check tickets against ID and meet its legal or venue rules; a date of birth also checks that the ticket type fits the age on the day. The operator's owner and managers see the numbers in full; its guides and its daily email see only the last four characters. Never sent to AI assistants | Contract (6(1)(b)); the operator's legal obligation where a law requires the list (6(1)(c)) | | Account: email, name, password (stored only as a hash), language and currency, two-factor settings | To give you an account | Contract | | Payment | Processed by Stripe or, for some bookings in Bulgaria, by ePay.bg (a card, the ePay micro-account or cash at an EasyPay office); we never see your full card number | Contract; legal obligation | | Reviews, questions, reports you send | To publish them / to handle the report | Contract; legal obligation (DSA) | | Saved experiences (wishlist) and shared lists | So you can plan | Contract | | Sign-in security: failed sign-in counts (with the email stored only as a keyed hash), a tamper-evident log of security events | To protect accounts and the platform | Legitimate interest (6(1)(f)) | | Signed-in sessions: when each session started and was last used, the browser and operating system, and the network it came from (the first three parts of the IP address, never the full address) | To let you see where you are signed in and sign a device out, and to end sessions unused for 90 days | Legitimate interest (6(1)(f)) | | IP addresses | Stored only as keyed hashes, for fraud prevention and rate limiting — except as chargeback evidence (next row) | Legitimate interest | | Chargeback evidence (only when we switch it on): the network address (IP address) and the browser a booking was paid from | To answer a card dispute (chargeback) on that booking: sent to Stripe with the rest of the evidence | Legitimate interest (6(1)(f)): defending a legal claim; kept 180 days | | Emails we send you | Kept as a delivery record | Contract; legitimate interest | | Text messages (SMS, WhatsApp) about a booking: your phone number, the text, delivery status, and a "STOP" you send | Only if you tick "text me about this booking" (or, for an operator, turn texts on): pickup times, driver details, changes. Never marketing from us; an operator's marketing texts only with the separate confirmed consent described in "Operators' texts, guest lists and loyalty" below | Consent (6(1)(a)) for sending; legitimate interest for honouring STOP | | Flight number and arrival date you give for an airport pickup | To follow the flight and move the pickup if it lands early or late, and to tell the driver and the operator | Contract | | Health answers on an operator's waiver (only if the operator asks, and only if you tick the separate consent) | So the operator can run a risky activity safely. Without the consent the waiver is still signed, with no health answers | Explicit consent (Art. 9(2)(a)) | | Dietary needs per participant (vegetarian, vegan, halal, kosher, gluten-free, lactose-free, nut allergy, other) and an optional allergy note, at checkout or later on the booking — only for listings that serve food, and only if you tick the separate dietary consent (not part of accepting the terms). Allergies and intolerances are health data; halal or kosher can reveal religious belief | So the operator can prepare suitable food. The operator of that booking sees the needs and the note in its manifest; its daily email shows only counts ("3 vegetarian"). Never shown to other travellers, on share links or to AI assistants. You can remove them on the booking page at any time (withdrawing consent) | Explicit consent (Art. 9(2)(a)) | | The driver's live position during a transfer (drivers only, with their consent) | So the traveller waiting for a pickup can see where the car is and when it will arrive. See "Live driver location" below | Consent of the driver (6(1)(a)) | | "Who's going" (only if you turn it on for a booking, on listings whose operator offers it): the first name and, if you choose, the country you decide to show | To show it to the other travellers on the same departure who also chose to show theirs. Off unless you turn it on; turning it off deletes it at once. See "Who's going" below | Consent (6(1)(a)) | | "Recommended for you": the experiences you viewed (sent from this browser), saved and booked | To suggest similar experiences. Worked out each time the page loads; no profile is stored. You can turn it off — see "Recommendations" below | Legitimate interest (6(1)(f)) | | Price alerts: the listing, dates and target price you set, the price you saw | To email you once when the price really drops | Contract (you asked for it) | | Push notifications: the subscription your browser gives us (an address at your browser's push service and its keys), which kinds of message you chose, your language | To send the notices you switched on (booking confirmed, reminders, time to leave, your driver, changes) | Consent (6(1)(a)) | | Newsletter and marketing email (only if you subscribe and confirm the link we email you): your email, language, the topics you chose, the words you agreed to and when; if you also agreed to emails about experiences you viewed, the listings you looked at for up to 30 days. Shared with our email service provider (Brevo, Mailchimp or Klaviyo, whichever we use) only once confirmed | To send the emails you asked for, before and after a trip you booked included. Unsubscribe from any email or the preferences page | Consent (6(1)(a)) | | Where a visit came from: campaign tags in the link (utm_*), the referring site, and — only with your consent to advertising — an ad or affiliate-network click id; with a booking, the channel it is counted under | To know which channels bring bookings and to pay affiliates and networks. Without consent to analytics nothing about the visit is stored, only the channel with the booking | Consent (6(1)(a)) for click ids and the visit id; legitimate interest for the booking's channel | | Server-side conversions to Google and Meta (only for a booking made with your consent to advertising): the booking reference, value and currency, the ad click id, and a one-way hash of your email | To measure our ads. Never without that consent, never with Global Privacy Control on | Consent (6(1)(a)) | | Sign in with Google or Apple: the provider's account id, your email, whether the provider verified it, your name | To sign you in. We never receive your Google or Apple password | Contract | | Rewards and invites (only when switched on): cashback earned, invite code, invite claims; salted hashes of the network and of a random id of your browser (tg_device) — never the IP address or the id itself | To pay cashback and invite rewards and to stop one person claiming many times | Contract; legitimate interest (fraud prevention) | | Fraud checks on bookings: salted hashes of your email, of the network address you booked from and of your card's fingerprint (never the address, the card number or anything else from the card but the country that issued it), the country you booked from, Stripe's own risk assessment, and the score and signals we worked out | To protect travellers, operators and us from stolen cards and fake bookings. See "Fraud checks on bookings" below | Legitimate interest (6(1)(f); recital 47 GDPR: preventing fraud) | | Reviews after a free creator visit (creators only) | A creator Jet.Guide invited to a free visit writes a review like any traveller; it is shown with the label "Tested by a travel partner (free visit)" | Contract | | Guides working for an operator (guides only): name, email, languages, skills, licences, working hours, time off and the departures assigned to you | So the operator can plan who guides which departure and email you an assignment to confirm or decline. The operator decides on assignments; suggestions never decide on their own | Legitimate interest of the operator and us (6(1)(f)); the operator is the controller for its staff data | | Passes and annual memberships: the holder's name and, when the operator's pass requires one, a photo of the holder; the buyer's email; the pass code, its terms and payments, the automatic-renewal consent if given, and each time the pass is scanned at the gate | To sell and renew the pass and let its holder in: the operator's staff see the name and photo when they scan it, also without signal from an offline gate list on their device in which the photo is stored only encrypted and is deleted with that list. The photo is never shown publicly or to other travellers | Contract (6(1)(b)) | | Guide pay (guides only): the departures you led, their hours and guests, the operator's pay rules, extras and tips the operator adds, and your monthly pay statements | So the operator can work out and approve your pay and you can read an approved statement through your link or "My pay". The operator is the controller for its staff's pay; we keep it for the operator | Legitimate interest of the operator (6(1)(f)) and its contract with you | | Operator owners and team members: new-device sign-ins and changes of password or two-step settings, with a device and network label | Shown to the business's owner as a security feed, to spot a sign-in that was not theirs. Kept 180 days | Legitimate interest (6(1)(f)) | | Driver pay (drivers only): the rides you drove, their hours and distance, the carrier's pay rules, tips credited to you, and your monthly pay statements | So the carrier can work out and approve your pay and, if it chooses, show you your pay per ride and month on the driver page. The carrier is the controller for its drivers' pay; we keep it for the carrier | Legitimate interest of the carrier (6(1)(f)) and its contract with you |

We do not sell your data and do not use it for advertising profiles.

Recommendations

"Recommended for you" on the home page is worked out each time from what you viewed (the list this browser keeps, tg_recent), saved and booked. Nothing about it is stored on our side. It is off when your browser sends Global Privacy Control, when you opted out of "sell or share" on Your privacy choices, or when you turn it off — with Turn off on the rail or the Recommendations switch on Your privacy choices. Turning it off is remembered in this browser (tg_personalise), so it works without an account; while it is off, nothing is sent to us for recommendations. How the suggestions are ranked is described on our transparency page.

Fraud checks on bookings

Every booking made on the website is given a risk score from a few signals: how many bookings were started from the same email or network in the last hours, checkouts left unpaid, a throwaway email domain, a card used under several emails, a card issued in another country than the one you booked from, a high-value booking starting within a day, and Stripe Radar's assessment of the payment.

our support team: a person looks at it and can complete the booking with you. The page also offers "Ask a person to review": one click opens a support case with what the check saw, adds your side if you write it, and a member of our team answers within our response time; they can let you book. This is how you obtain human intervention, express your point of view and contest the decision (GDPR Art. 22(3)).

held as for any booking, until a member of our team has looked at it — usually within a few hours — and either lets it go ahead or cancels it with a full refund. You are told by email either way and can ask for the decision to be looked at again by another person. This is our human review under GDPR Art. 22: no decision about your booking is made by the score alone.

address or network address themselves (those stay on the booking as for any booking). The hashes are deleted after 180 days; the score stays with the booking record. (One exception, only when we switch it on: the chargeback evidence in the table above.)

chargeback from the card's bank, an early fraud warning passed on by Stripe, or a member of our team confirming it — we put salted hashes of that booking's card fingerprint, email, network (the first three parts of the address only) and, if your browser has the random id described under tg_device, of that id on a deny list, kept for 3 years instead of the 180 days above. A later booking that matches gets a high score and is handled as described above: a person decides, nothing is cancelled by the list alone. An entry is taken off when the bank decides the fraud dispute in our favour or when our team finds it was a mistake. Legitimate interest (6(1)(f); recital 47 GDPR: preventing fraud).

account, we keep salted hashes of the phone number on the booking, of the random browser id described under tg_device (if your browser has one) and, once paid, of the card's fingerprint, for 3 years. Another account that matches one of them cannot use such a code; a person on our team looks at a match found only after payment, nothing is cancelled by it. Legitimate interest (6(1)(f): one welcome offer per person).

switch it on, the payment check also asks SEON (SEON Technologies, EU) or Sift (Sift Science, Inc., United States) for a risk rating, once, when the booking is paid. We send only what the check needs: to SEON your email address, a salted hash of it as an identifier, the booking number, the amount and currency, and a salted hash of the card; to Sift the same hash, the booking number, the amount and currency and that it was a card payment through Stripe — not even your email. Never your name, phone number, address, network address or card number. The provider acts as our processor under a data processing agreement. We keep only its score and risk band with the booking's fraud check; they count like the other signals above, and a person still decides anything after payment.

from fraud, we may continue where our legitimate interest overrides yours, and we will tell you why.

Live driver location

When a driver has agreed to share their position, the driver's phone sends it while the driver is on the way to, or waiting at, a pickup — never at other times. We keep only the latest position (rounded to about a metre, with its accuracy and time) on each of that driver's jobs in that state, at most one every 10 seconds. The traveller of that booking and the operator's dispatcher see it while it is less than 10 minutes old. It is deleted when the ride moves on (picked up, no-show, finished) or once it is 30 minutes old (a job checks every 10 minutes), and at once for every job when the driver withdraws consent. We keep no route history.

Share my ride or trip

From your voucher you can make a link for one paid booking and send it to someone you trust. Whoever opens it sees the activity, when it starts and ends, where it meets (for a transfer, the two areas, not your address) and whether it is on — for a transfer, the driver's reported status. It never shows your name, phone number, price or booking reference. The link expires six hours after the booking ends, and you can turn it off at any time; at most three are live per booking. We count how often it was opened. The link is deleted with your account or booking data.

Who's going

On some multi-day tours, cruises and small-group departures the operator may offer "Who's going". It is off unless you turn it on for your booking. If you do, the first name you type and, if you choose one, a country are shown to the other travellers on the same departure — and only to those who chose to show theirs too. No surname, photo, contact details or booking details are shown, and nothing is used to rank or recommend anything. Turn it off at any time on your booking page: what you shared is deleted at once. It is also deleted when the booking is cancelled, when the operator stops offering it, and 30 days after the departure.

AI assistants, the concierge and AI answers from operators

These are switched off until we turn them on; each says it is an AI before you use it.

if you allow it on our consent page. The assistant then gets a token (never your password) that lets it do what you allowed: prepare bookings in your name and email, see your bookings, and cancel or change one — a cancellation or a change only after it has shown you the details and you said yes. It pays only where we have switched on payment by AI assistants (see the next paragraph); otherwise you pay on our site. We record what it did (the action, the booking reference and the result, not the conversation you had with the assistant) and show it to you in Security settings, where you can remove the access at once. The assistant's provider handles your conversation under its own privacy terms. Legal basis: the contract with you, at your request.

with us without leaving them: Google (the Universal Commerce Protocol, UCP) and OpenAI's ChatGPT (the Agentic Commerce Protocol, ACP). The platform then sends us what you gave it for the booking: your name, email and phone number, the experience, the date and the tickets. The platform is a separate controller of what you tell it, under its own privacy terms; we send it the booking's status (confirmed, changed, cancelled, refunded) so that it can show it to you. You pay with a payment token that your wallet on the platform gives Stripe for this one booking, up to its amount: we never see your card number. A linked assistant (above) may pay a booking it prepared in the same way. Until this payment is switched on, the platform sends you to our own checkout to pay. We keep the checkout, with your details, for 30 days after its expiry time if it was not completed and for 180 days after it was completed (the booking itself as described in this notice); our answer to each request, which can contain your details, for 24 hours, so that a repeated request never books twice; and the status messages we sent the platform for 30 days. Legal basis: the contract with you, at your request.

and its answers are kept so the conversation can continue, for 30 days after your last message, then deleted; you can delete it sooner in the chat. The text is sent to our AI provider to write the answer (see Who receives your data); our usage records keep only the number of words processed and the cost, never the text. Changes to a booking need your click on "Yes", signed in.

from its listing's facts and its own FAQ. An answer sent this way starts with a label saying it was written by AI for the operator. The model receives your message without your name, email, phone or booking reference. Questions about money, refunds, changes, safety or health and complaints always go to a person.

the request (the Signature-Agent, UCP-Agent and signature key id headers, the client's name and its user agent). We record these per agent, with how many requests it made and which bookings it created, for security, to recognise partners we have verified, and for statistics. When an agent signs its requests, we check the signature against the keys the agent publishes on its own site. This is about the agent, not about you: it is not used to profile travellers. Legal basis: legitimate interest (6(1)(f)).

questions like these are answered on our own site.

Planning and booking tools

These are switched off until we turn them on, and each is used only if you choose to.

you give it), the usual ticket type and a note. They fill a booking, waiver or transfer form only when you pick them there. Dietary notes (allergies, needs) are health information: we keep them only with your explicit consent given with them (GDPR Art. 9(2)(a)), encrypted, and you can withdraw the consent at any time, which deletes them. A child's details are kept only in the account of the parent who saved them. Everything is encrypted at rest, in your data export, and deleted with your account. Legal basis: your consent; the contract when you use them to book. An AI assistant you linked to your account (see above) can read your saved travellers only if you also allowed "saved travellers" on the consent page, and then only the names of adults, everyone's age and ticket type: never a child's name, a date of birth, a note or dietary notes.

payment provider, under a customer record of your account; we see only the brand, the last four digits and the expiry. Remove a card in Account → Saved cards; deleting your account deletes the customer record at Stripe with every saved card.

by email), the members see each other's first names only and what each wrote: notes, votes and messages. Messages between travellers are not changed or masked, but a message asking to pay or book outside Jet.Guide is refused, and any member can report a message; our moderators can remove it and tell its author why (Digital Services Act). Members get an email about new messages at most once an hour. Your messages, notes and votes are deleted when you delete them, when the organiser stops sharing, or with your account.

your note, the time window, our call attempts and our agent's note, and open a support case. If we call through Twilio (Voice), Twilio receives your number for the call; otherwise our agent dials by hand. We do not record calls. The request is deleted with your account; the support case is kept without your details.

listing (your public name, stars and words) with a preview picture we draw ourselves. No social network's script is loaded on our pages.

"Recommended for you" is on; nothing about them is sent to us. "Popular" suggestions are the same for everyone in a country.

your location only when you press "Near me", never when a page opens. The location is sent with that one request to find departures and experiences nearby and is not stored.

If you move a wishlist experience to another day or time, or take it out of the plan, we keep those choices (which experience, the day and time, removed or not) with your account, so the plan looks the same next time. Travel times between places are estimates from the distance and are shown as such. Basis: contract (6(1)(b)). Kept until you delete your account.

Approximate location from your IP address

(This paragraph applies only while it is switched on: GEOIP_ENABLED.)

country, we look up your IP address in a database file kept on our own server (DB-IP's "IP to City Lite"; no outside service is asked). We use only the country, the region and a point rounded to about 11 km — city level, never your street. Neither your IP address nor this place is stored or written to our logs: it is used for that one page and then forgotten, and a page that used it is marked private so that no shared cache keeps it. Legal basis: our legitimate interest in showing you relevant experiences (GDPR Art. 6(1)(f)). You can object at any time (see Your rights); the place is only a guess, and you can always choose another destination or press "Near me" instead. IP geolocation by DB-IP (CC BY 4.0).

Voice input

Where your browser offers speech recognition, a microphone button lets you speak a search or a question to the concierge. The audio is not sent to us: your browser records it and its maker's speech service turns it into text (for example Google for Chrome, Apple for Safari; some browsers recognise speech on the device). We receive only the text, as if you had typed it. The browser asks your permission for the microphone first, and you can withdraw it in its settings.

(The two paragraphs below apply only while they are switched on.)

button by an answer or a trip plan, your browser's own speech synthesis reads it out. Nothing is sent to us; some browsers use their maker's online voices, which then receive the text being read. The choice is kept in your browser only.

clip of at most 30 seconds and sends it to us; a speech-to-text provider acting as our processor (OpenAI, OpenAI L.L.C., United States, or another compatible provider we name here before switching) turns it into text, which we put in the box for you to read and send. The clip and the text are used only for that and are not stored by us, and the provider may not keep them or use them for training. Legal basis: performing what you asked (Art. 6(1)(b) GDPR).

Passkeys, reduced tickets, paying on our page and social links

(Each of these applies only while it is switched on.)

credential, a counter, how your device connects to it and the name you gave it, with the dates it was added and last used. The private key and your fingerprint, face or screen lock never leave your device. We email you when a passkey is added or removed. Basis: contract (6(1)(b)); deleted when you remove the passkey or close your account.

voucher says which document to bring and the operator's staff look at it at the entrance; we never collect or store the document. A disability ticket can reveal health information: it is kept with the booking, shown to that booking's operator only to check it at entry, and erased or anonymised with the booking. Basis: contract (6(1)(b)) and, for a disability ticket, your explicit choice of it (9(2)(a)).

Payments Europe Ltd): your card details go straight to Stripe and we never see the card number. Stripe's script sets its own cookies (for example __stripe_mid and __stripe_sid) to prevent fraud, on the payment page only. Apple Pay and Google Pay are offered by your device through Stripe.

saved list page, our server sends that link (without its tracking parameters) to the platform it comes from — TikTok, Meta (Instagram) or Google (YouTube) — through the platform's public oEmbed service, to read the post's public title and author name, and uses that text only to suggest experiences from our catalogue. We do not store the link or the answer beyond a short-lived cache of up to 10 minutes in server memory and do not attach it to your account. Basis: your request (6(1)(b)).

ticket, the staff at the gate may check it against an identity document, and a ticket you send to a friend takes the friend's name. It is kept with the booking and erased with it. Basis: contract (6(1)(b)).

Trips, paying together, chats and Google bookings

(Each of these except your own trip items applies only while it is switched on.)

a title, the times and time zone and, if you like, a place, an address, a booking reference and notes. They appear in your trip, in its calendar file and in the copy your browser keeps for offline use. Someone you share the trip link with sees only an item's title, kind and time — never the reference, the notes, the place or the address. Basis: contract (6(1)(b)). Kept until you delete the item or your account.

booking confirmations to it. We read such an email only if it comes from your account's own verified address, as confirmed by the sender checks (DMARC, DKIM, SPF) of our inbound email provider; anything else is dropped unread. We first read the structured booking data many confirmations carry (flights, stays, restaurant tables). If there is none, our AI model provider reads the subject and up to 8,000 characters of the text to find the bookings; items found this way say that they were read by AI. Everything found is saved as a draft that you check, then confirm or delete. The email itself is not stored: a confirmation may name the people you travel with, and only what goes into an item is kept. Creating a new address stops the old one at once. Basis: contract (6(1)(b)), at your request.

20 shares, each paid through its own link before a deadline. If you type your friends' email addresses, we email them their link. Each share is paid through Stripe; we see that it was paid, never the card. We keep the amounts, whether each share was paid and the addresses you typed, with the booking. If shares are unpaid at the deadline, every paid share is refunded and the booking is released — or, only if you agreed to it on your share's page, the card you paid your share with is kept at Stripe and charged for the unpaid rest; once the split has ended (paid, released or the rest charged), that card is deleted at Stripe. Stripe receives the address you typed for a share with its payment. We keep your friends' addresses for 30 days after the split ends, for the receipts and the outcome emails, then remove them. Basis: contract (6(1)(b)) with you, and with each friend for their share; sending a friend the link you asked us to send: our legitimate interest in carrying out your request (6(1)(f)).

each other and with the operator's team, from 48 hours before the start until 7 days after the end; it is then read-only. Others see the first name you chose for Who's going. Phone numbers, email addresses and other contact details are masked in messages, and a message asking to pay or book outside Jet.Guide is refused. You can report any message (Digital Services Act) and block a traveller, whose messages you then no longer see. You can delete your own messages, and turning Who's going off ends your part in the chat. The messages are deleted 30 days after the departure ends; a reported message is kept with the report. The chat is not offered in the United Kingdom. Basis: your consent to Who's going (6(1)(a)) and the contract (6(1)(b)); handling reports: legal obligation (6(1)(c)).

sessions on Google Maps or Google Search. Google then sends us your name, email address and phone number, the number of people, the time you chose and Google's pseudonymous identifier for you; we make the booking with the operator as a booking paid at the venue, and give Google its status, with the same details, when Google asks. Google is a separate controller for what you give it, under its own privacy policy. Basis: contract (6(1)(b)). The booking is kept like any other; Google's identifier is deleted with the booking's personal data.

loyalty programme runs, only to its Gold or Platinum level. When you are signed in, a price is worked out with your account: whether you are a member and, for a level, the bookings you completed. Nothing new is stored; the price you pay stays with the booking. When you are not signed in, a price may show what members pay. Basis: contract (6(1)(b)).

on Help, you chat with our support team. We keep your name and email address (as a guest you type them and pass the anti-bot check), your language, the booking it is about, what you and the concierge said so far, the messages and when they were read. Outside the chat's hours, when nobody is available, when no one takes the chat within a few minutes, and when the chat ends, the conversation goes into a support request so we can answer by email. The chat is deleted 90 days after it closes; the copy in the support request is kept as support requests are (see "How long we keep it"). Basis: contract and our legitimate interest in answering you (6(1)(b) and (f)).

Trip planner, travel preferences and the concierge

(Each of these applies only while it is switched on.)

name or date of birth), interests, things to avoid, the pace, a budget and mobility needs (step-free, pushchair, limited walking). We use it to build a plan from listings with seats and sights open on those days. When our AI model provider is used (see Who receives your data), it receives this description and the candidate listings, chooses among them and writes short reasons marked as AI; otherwise rules make the plan. Mobility needs can say something about health: give them only if you want them taken into account; they are used only for this plan. You can also start from a screenshot, photo, PDF or pasted text. A file is read once by the AI model provider to find place and activity names (a photo is re-encoded first, which removes its location and camera data) and is not stored; pasted text is matched without AI. A plan you do not save is not kept on our side. A saved plan holds your description and the plan: in your account until you delete it or your account; without an account, behind a private link of which we keep only a hash, and deleted 30 days after its last change. A share link shows the plan read-only and stops working when you unshare it. Nothing you type, upload or plan is written to our logs. Basis: your request (6(1)(b)); for mobility needs, your explicit choice to give them (9(2)(a)).

things to avoid and your children's ages: chosen from fixed lists, never free text, and never worked out from what you do. Access needs (wheelchair, step-free, hearing, sight and the like) can be health data: they are kept only with their own explicit consent given with them, and withdrawing it deletes them. The concierge uses your preferences to choose suggestions, and search may order results by the interests you saved. They are not used while your browser sends Global Privacy Control or you turned recommendations off, are never used for prices, never shown to operators and never given to assistants linked to your account. Turning the memory off deletes it at once. Basis: consent (6(1)(a); for access needs 9(2)(a)).

concierge read your confirmed bookings, your own trip items and day plan, your wishlist, your price and new-date alerts and, where that feature is on, your saved travellers, to answer about your trip. It can propose to save an experience or set an alert; only your click on the confirm button makes the change. Each read and change is recorded as for linked assistants. Switching trip access off ends it at once.

you also allowed "wishlist" on the consent page, read your wishlist and alerts and change them after you said yes in the assistant, and save a cart for you: a signed link that works 7 days unless we set another period (at most

  1. and is deleted a day after it expires. Opening it prices everything again; nothing is held or charged.

chose, your note (contact details removed), the language and, if you are signed in, your account; never your network address or name. Our team uses it to correct AI answers. A report is kept 180 days after our team closes it (a year at most while it is open); erasing your account removes your account and note from it. Basis: legitimate interest in correct and safe AI answers (6(1)(f)).

Planning in a group, guest connections and group bookings

(Each of these applies only while it is switched on. Planning in a group and guest connections are not offered in the United Kingdom.)

experiences on a shortlist, vote on them, propose dates and answer a date poll; the members see each other's first names, votes and answers. A member may ask the AI assistant a question for the group: it receives the question and the group's dates, party size, shortlist and poll, never a member's name or address and never anyone's bookings, and its answer, labelled as AI, stays in the group. Questions and answers are deleted after 30 days, and the group's whole plan 30 days after the group stops being shared. The owner then chooses a departure and books it; the price can be split among the members (see "Paying together"). Basis: contract (6(1)(b)).

yourself in "Who's going" on a departure, then for 14 days after it ends you see the other guests of that departure who did the same, and can ask one to stay connected. The other guest gets one email with only your chosen first name and the experience's title, and accepts or declines. Connected guests can write to each other under the rules of the departure chat: a message asking to pay or book outside Jet.Guide is refused, and you can report a message and block a guest. We keep your opt-in with the words you agreed to, your connections (who, which departure, when) and the messages. Opting out stops new requests; ending a connection, or erasing either account, deletes it and its messages for both guests. Basis: consent (6(1)(a)); handling reports: legal obligation (6(1)(c)).

connections who turned it on too can see what you choose, each part on its own: the experiences you did (the listing's place, month and year, never the day, the party or the price), the lists you share one by one, and "recommended by" with your chosen first name on a listing you rated 4 or 5 stars or put in a shared list, this last only to connections who chose to see recommendations. Nobody else sees any of it, and it is not offered in the United Kingdom. You can hide an experience; blocking or ending a connection hides everything from that person. We keep your choices, the experiences you hid and the words you agreed to; turning the map off, or erasing your account, deletes them. Basis: consent (6(1)(a)).

travellers' names by the operator's deadline, give members' email addresses so that each pays their own share through a link (we keep only a hash of each link), and have the receipts made out to a company (its name, address, country and, if given, VAT and registration numbers and a billing email). The operator sees the names, without addresses, in its portal; the list is never emailed. Shares are paid through Stripe. The names and the members' addresses are cleared 30 days after the activity (see "How long we keep it"). Basis: the contract with the organiser (6(1)(b)); emailing a member the link the organiser asked us to send: legitimate interest (6(1)(f)).

Price match, the club and other ways to pay

(Each of these applies only while it is switched on.)

account or the booking's email address, the other site's link and price, when you saw it, your note, a screenshot if you add one (stored with the booking; leave other people's details out of it) and our team's decision. We do not open the link automatically; our team may look at the page. An approved claim refunds the difference or gives store credit; its amounts, dates and decision stay with the booking's financial record, and erasure removes the account, address, note and screenshot. Claims are counted per account and email address for the yearly limit. Basis: contract (6(1)(b)).

and the renewal consent). Early access to a departure gives you an access code of which we keep only a hash. If you use the cancellation cover, we keep the booking and the amount credited; that store credit is an accounting record (10 years) and loses the link to your account on erasure. The club never gives anyone a personal price. Basis: contract (6(1)(b)).

instalment with is kept by Stripe and charged on the dates shown. We keep that agreement (when, and which wording), the card's brand and last four digits, the schedule and each payment. The card is removed at Stripe once nothing more is due. On erasure the card details go; the schedule, amounts and agreement stay as financial records. Basis: contract (6(1)(b)).

checkout: you go to the provider, which receives what it needs for that payment under its own terms and privacy notice; we learn only whether it was paid. Scalapay and Alma, which let you pay later, are separate controllers for the arrangement you make with them.

Klarna, Afterpay/Clearpay, Scalapay or Alma lend you the price and pay us in full. If you choose one, it receives your name, email address, the amount and the booking's date to decide whether to grant the credit, and may check your creditworthiness under its own terms and privacy notice. It is a separate controller for the credit, which is between you and it, not Jet.Guide or the operator. We learn only whether the payment went through. Basis: contract (6(1)(b)).

On the day and on your phone

(Each of these applies only while it is switched on.)

report of yours still open), your booking page shows your options and up to three alternatives with seats that day, chosen by place, type and time, never by a profile of you. We email you and send a push notice once per booking and reason, and record that we did. Basis: contract (6(1)(b)).

you have arrived. Only with your consent, your browser's position is read once, rounded to about 100 metres and kept with the check-in; the operator sees who arrived, and an arrival on record stops you being marked a no-show without a person checking. The position is cleared after 30 days. Basis: consent (6(1)(a)).

(we keep only its hash, at most five per account, revoked when you sign out) and shows your next booking's title, time, meeting point and voucher link on your home screen and, within 4 hours of the start, on your lock screen, where anyone who sees your phone can read them. No name, phone number or price is shown. Remove the widget, or sign out, to stop it.

your booking, so the crew can check the pass and you can see how long it still runs. The crew's offline list holds only hashed codes, no names. The vehicle positions on the route page are about the buses and boats, not about you. These records stay with the booking and point at no one once it is anonymised.

often it was opened: no visitor id, address or cookie. The question is written into the assistant's box for you to read, change and send yourself.

email links a page where you give the account holder's name and IBAN (or, with an account, take it as account credit instead). The link works once; we keep the IBAN encrypted, and only our finance team sees it, to make the transfer; we delete it once the payment is made and keep only its last four digits with the claim. We email you when the details are given and when the money is sent. Basis: contract (6(1)(b)).

add-on put forward or, for an operator, a lower price for a random share of visitors (never a higher one, never based on who you are, and the page says that prices are being tested). Only if you allowed analytics in the cookie notice does your random visit id (tg_vid) choose your version, the same every time; otherwise you see the usual page and are not counted. We count showings per version and day without any visitor id, and the bookings made from visits in the test. Basis: consent (6(1)(a)).

Operators' texts, guest lists and loyalty

(Each of these applies only while it is switched on.)

Vonage or MessageBird (whichever we use). Texts about your booking go only to a phone that asked for texts about that booking. Marketing texts from the operator, such as a reminder about a checkout you did not finish or a request for a review, come only after you asked for them (on the booking page, or at the operator's desk) and confirmed by replying YES or using the link in the one confirmation text we send (it works for 48 hours). Each names the operator and has a stop link; replying STOP stops every text from that operator to that phone, and a STOP sent to Jet.Guide's own number stops them all. When you text the operator's number, your message goes to the operator's inbox and the operator can reply for 30 days. We keep the consent (the number, the words you agreed to, when), the STOPs and the texts (number and words); texts are deleted 90 days after they were sent (OPERATOR_SMS_RETENTION_DAYS). Basis: consent (6(1)(a)) for marketing texts; the contract for texts about your booking.

operator's emails" below) and the operator connects its own Mailchimp, Klaviyo or HubSpot, we send that tool your email address, name and language as a contact; nobody without that confirmed consent is sent. Withdrawing the consent with us unsubscribes you there, and unsubscribing there withdraws it here. We keep only a salted hash of the address and whether it is subscribed. The operator is the controller of its own tool.

counted by a salted hash of your email address, and every few visits earn a single-use code, emailed to you only if you agreed to the operator's emails. At its desk the operator can recognise you as a returning guest by your email address or phone number, among its own bookings only, and can group guests who travel together into a household (it may be shown guests who share a phone number, or with the same surname on the same departure). Erasure deletes the visit counts and household memberships. Basis: the operator's legitimate interest (6(1)(f)); the operator is the controller.

accept that page's notice, the operator's own Google Analytics, Google Tag Manager and Meta tags may load, and after you book our server may send the purchase to the operator's own Meta, Google Analytics and Google Ads accounts: the value, the currency, an event number that is not your booking reference, your email address and phone number only as one-way (SHA-256) hashes, and, where those tags set them, their browser identifiers (for example _fbp) and the ad click you arrived from. Analytics needs your consent to analytics; Meta and Google Ads need your consent to marketing; with Global Privacy Control on, or after "No thanks", nothing is sent, and a later "No thanks" stops what has not gone yet. We keep your choice and these identifiers for 90 days. Basis: consent (6(1)(a)). The operator is the controller of its ad accounts.

Operators' AI front desk, phone receptionist and assistants

(Each of these applies only while it is switched on, and an operator uses it only if it chooses to.)

(messages on Jet.Guide, email, WhatsApp, Instagram and texts) and on the phone. Every reply says that it was written by AI. The AI answers only from the operator's listings, its FAQ and live availability; refunds, changes, complaints, safety and a request for a person go to the operator's team. Our AI model provider receives your messages with email addresses, phone numbers and links removed. If you want places, the AI can hold them in your name and send you a link to pay, once you give your name and email address. We keep the conversation, the AI's replies and decisions (which the operator's team reviews) and, for a call, your phone number: all deleted 30 days after the last message. Basis: the operator's and our legitimate interest in answering you, and the contract when you book (6(1)(f) and (b)).

automated AI assistant is speaking and that saying "person" puts you through. The telephony provider (Twilio or Vonage) carries the call, turns your speech into text and reads the answers out. Calls are never recorded. What was said is kept only if the operator keeps transcripts and you say yes when asked; otherwise only that you called, when and how the call ended. A payment link is texted to the number you called from.

Claude or ChatGPT) to the business's back office, at a level the member's role allows. The assistant can then read the operator's departures and bookings, your name and contact details included, and at a higher level hold, move or cancel bookings, a cancellation only after a confirmation. The assistant's provider handles what it reads under the operator's arrangement with it, and the operator is responsible for that. We record which tool was used, when and on which booking or departure, never your details.

reports, which we compute. The question itself is not stored, only which report was run.

Waivers, passes, resale and sales channels

(Each of these applies only while it is switched on.)

again for a new booking of the same listing within the operator's validity period (at most two years), when your name and email address match and the waiver's wording has not changed. Nothing is copied; the earlier signature is kept until the new activity's retention period ends.

booking. It is kept, with the email address you gave, for the operator to link it to your booking at check-in: 7 days unless the operator sets between 1 and 30. Once linked it is handled as any waiver; if not, it is deleted.

The operator sees them with the waiver; they are deleted with the waiver's personal fields (see "How long we keep it").

Turbopass or another the operator accepts), the operator's scanner checks it with that company, which receives the pass number. We keep the pass number, a hash and the last four characters of its code, the category and the rate, so that the operator can invoice the pass company; never your name or contact details. Vouchers of GetYourGuide, Viator and other resellers are checked against the booking they sent us.

page, its widget or at its desk; you are told who sells it and who provides it. The selling operator receives your name and contact details and may email you a payment link; the operator who runs it receives your name and the booking. Each is responsible for what it does with them.

Tiqets, Musement, Google Things to Do or an OCTO reseller, and its operator manages those channels through Jet.Guide, the channel sends us the booking with the lead traveller's name and the party, and we keep it for the operator; changes and cancellations go both ways. The channel is a separate controller under its own privacy notice. A booking that cannot be placed automatically keeps the name at most 30 days (see "How long we keep it").

Photos after the tour

(Each of these applies only while it is switched on.)

departure. On your booking you choose whether photos you are in may be shared with the other guests ("share") or not ("keep me out"); a child on a booking is kept out unless the adult who booked chooses "share". Before the album is shown, a team member must confirm that nobody who is to be kept out can be recognised; we keep who confirmed it and when. Only the guests of that departure see the album, through their own booking. You can have any photo taken down ("I'm in this photo"): it is removed for everyone at once and its files are deleted; the operator sees that it was taken down, not by whom. Location and camera details are removed from every photo. The photos and your choice are deleted 30 days after the departure (we may set between 7 and 180 days). If the operator sells a photo package, buying it gives you the full-size photos; without it you see small previews. The 30 days run from the end of the departure. A photo package bought after the tour gives you the full-size photos until the album is deleted; it is not sold in the album's last 48 hours, and a photo taken down is removed for buyers too, so download the ones you want to keep.

nothing of them.

Orders from authorities and sanctions checks

(The sanctions check applies only while it is switched on.)

content, to give it information about you, or to produce or keep data (Digital Services Act, Arts. 9 and 10; the e-Evidence Regulation (EU) 2023/1543). Our legal team records each order, checks it and answers it. While an order asks us to keep data, the accounts, bookings and messages it names are left out of our usual deletion periods, a sealed copy of them is kept, and your account cannot be erased (we tell you only that a legal obligation stops it). We tell you about an order when the law and the order allow it: who sent it, what we did and how to challenge it. Basis: legal obligation (6(1)(c)). The order is kept for 5 years after it is closed; the copy only until the hold ends.

services in Crimea, Sevastopol and the occupied areas of Ukraine. Each night we compare the names of operators, of their owners and of partners (affiliates, creators) with the list the EU publishes. A possible match holds their payouts and approval until our staff have checked it; the match and the decision are kept as a compliance record. Travellers' names are not checked. Basis: legal obligation (6(1)(c)).

should not), we record it in our incident register: what happened, which data and how many people, the risk to you and what we did. We keep that record even when the incident does not need reporting. We tell the data protection supervisory authority within 72 hours of becoming aware of it unless it is unlikely to put anyone at risk, and we tell you directly, in your language, when it is likely to put you at high risk: what happened, what it may mean for you and what you can do. If an operator's guests are concerned, we tell the operator too. Basis: legal obligation (6(1)(c)). The record is kept for 5 years after the incident is closed.

Partner network

(The partner network applies only while it is switched on: AFFILIATE_NETWORK_ENABLED.)

Partner network (partners only). When a partner applies with another partner's invite link or code, we keep who invited them (their sponsor), fixed when we approve the application, and any correction our staff make, with its reason. To keep the network honest we compare a partner with the partners above them: the domain of a verified company email address, the payout account, the tax or VAT number, and salted hashes of the network address (and of the address with the browser) they applied from — never the address itself. A match holds the overrides concerned until a person on our staff has reviewed them; nothing is decided by the comparison alone. A partner sees the names of the partners they invited and only totals for the levels below; nobody in the network sees travellers. Basis: the contract with the partner (6(1)(b)) and our legitimate interest in preventing fraud (6(1)(f)). Kept while the partner account is open; the overrides with the payout records (accounting law).

We also compare the network address a partner last used our site from (a salted hash) and, when Stripe reports it, a salted hash of the payout bank account, and we check whether a booking that would earn an override was bought by a partner above (the same account, email address or card); such an override is held for review too. The salted sign-up hashes are deleted 180 days after the application, the others when the partner account is closed and erased. Sales totals are shown only for levels with at least three partners, so no one can read a single partner's sales.

Partner tools

Opening-soon list. While our partner programme is closed, you can leave your email address on the programme page (and, if you like, what kind of partner you are, a website and a country) to be told once when it opens. We first send a confirmation link; an address not confirmed within 7 days is deleted. A confirmed address gets one email when the programme opens and is deleted 30 days later, and every address after 18 months at the latest. We keep the words you agreed to and a salted hash of the network address you sent the form from (to stop abuse), never the address itself. The email address is used for nothing else. Basis: your consent (6(1)(a)), which you can withdraw at any time with the link in our email.

LinkSwitcher and the partner bar. A partner's LinkSwitcher script on their own site reads only the addresses of links to our site and turns them into the partner's tracked links; it sets no cookie, stores nothing and sends nothing about the reader. Following such a link is an ordinary partner click (tg_clid, below). The partner bar on our pages, shown only to signed-in partners, remembers on that browser only whether the partner folded it (tg_partner_bar).

Payout details of operators and partners

(Choosing a bank or Revolut payout applies only while it is switched on: PAYOUT_METHOD_CHOICE_ENABLED.)

Bank details for payouts (operators and partners). An operator or a partner who chooses to be paid by bank transfer or through our Revolut Business account gives us the account holder's name, the IBAN and, if they like, the BIC. We keep the IBAN encrypted and show only its last four digits, also to our staff; it is opened only to make a payment, and a salted hash of it is compared with other payees' to spot one account behind several businesses. Our staff check the details against a bank letter or statement before the first payment. A change is confirmed with the password and told by email, also to an address the account recently moved away from. For a payment through Revolut, Revolut receives the holder's name and the IBAN. Basis: the contract with the payee (6(1)(b)) and our legitimate interest in preventing fraud (6(1)(f)). Kept while the account is open; on erasure the holder's name and the IBAN are removed and only the last four digits stay with the payout records (accounting law).

Checks on reviews

(The comparison of card, network and device hashes in the second paragraph applies only while it is switched on: REVIEW_FRAUD_LINKS_ENABLED. The automatic hiding in the third paragraph applies only while it is switched on: REVIEW_FRAUD_AUTO_HIDE_ENABLED.)

Checks on reviews. To keep reviews genuine we check new and recent reviews for signs of fake reviews: many reviews of one listing or operator in a short time compared with its usual pace, the same text posted under another account, accounts that give the same rating to the same operators, only 5 stars for one operator and 1 star for its competitors in the same town, and a reviewer who is the operator's owner, a member of its team or one of its partners (the same account or email address). We use only the reviews and the account and booking details we already hold. A new review with such a sign waits until a person on our staff has looked at it; a published review stays published unless a person decides otherwise. Nothing is deleted and nothing is decided by the check alone (except the automatic hiding in the last paragraph, once it is switched on); if we hide a review, its author receives the reasons and can contest the decision. Basis: our legitimate interest, and that of travellers and operators, in reviews that can be trusted (6(1)(f)). The signs are kept with the review; the text of a review is also kept as one-way hashes of its parts, to find copies, and deleted with the review's text.

When we switch it on, the checks also compare the salted hashes already kept by the fraud check on bookings (of the card and of the network a booking was paid and made from) and, for accounts that joined through an invite, of the device: different reviewers of one operator paying with the same card, joining on the same device or, three or more of them, booking from the same network. Never the card number, the network address or the device id itself. The hashes are kept no longer than described above (180 days for the booking check).

Automatic hiding. When we switch it on, and from a date we announce, a new review that shows strong signs of being fake (for example the same text as another account's review, written from an account of the operator's own team) is hidden at once by the check, without a person deciding first. This is a decision taken by automated means alone. Its author is told at once which signs were found, in plain words, and that the decision was automated, and can contest it; a person on our staff then reviews it and can publish the review. Reviews with a lower score still wait for a person. Basis: as above (6(1)(f)); you have the right to have a person look at it, to give your point of view and to contest the decision (Art. 22(3)).

Cookies and browser storage

Analytics and advertising tags — only with your consent. When we switch them on, the site can load Google Analytics 4 and Google Ads (Google Ireland Ltd / Google LLC) and the Meta pixel (Meta Platforms Ireland Ltd). They load only after you say yes in the cookie notice — in every country, the United States included — and never while Global Privacy Control is on. They set their own cookies (for example _ga, _gcl_au and _fbp) and receive your IP address, the pages you view and, for a booking made with your consent to advertising, the conversion described above. Saying no, or later changing your mind under Cookie settings in the footer, keeps them off. (An opt-out model for US visitors, US_TRACKING_OPT_OUT, applies only while it is switched on.)

Performance measurement — only with your consent to analytics. When we switch it on (RUM_ENABLED), your browser measures how fast each page loads and responds (Core Web Vitals) and sends those numbers to us once per page, with the site version, the kind of page, whether it is a phone or a computer and the country your connection comes from (as our network provider sees it). Nothing that identifies you or your visit is stored with them: no account, visit id, IP address or browser details. We keep the readings for 35 days to see how fast the site is for everyone.

Counting where visits come from — anonymous, without identifying anyone. When we switch it on (TRAFFIC_SOURCES_ENABLED), the first page you open in a tab sends us, once, the address of that page, the address of the page you came from and the campaign tags in the link (for example utm_source). We use them only to add one to a daily count: the kind of source (a search engine, an AI assistant, a social network, a partner, an ad, an e-mail, another site or none), the name of that search engine, assistant, network or site, the kind of page, the site version, the country your connection comes from and whether it is a phone, a tablet or a computer. We store no IP address, browser details, visit id or full address of the page you came from, and the counts cannot tell one visitor from another. The tab keeps the kind of source (tg_src) so that a booking made in it can be counted for that source. If you say no to analytics in the cookie notice or opt out on Your privacy choices, nothing is sent or counted.

Everything else below is either strictly necessary for a service you asked for or a preference you set. (Audit of 2026-10-02, docs/22 Phase 2; wave Y.)

| Name | Where | What for | How long | |---|---|---|---| | tg_clid | first-party cookie, and localStorage | When you arrive through a partner's link or QR code, a random click id so the partner can be credited if you book. It contains no personal data. | the partner program's window, usually 30 days | | tg_token | localStorage | keeps you signed in | until you sign out | | tg_seat_ctx | first-party cookie (HttpOnly, sent only to our API) | only on a departure with assigned seats: a random value that ties the seats you are holding to this browser, so no one else can use or extend your hold; we keep only a hash of it, and a keyed hash of your network address until a day after the hold ends, to limit how many seats one network can hold | 4 hours | | tg_locale, tg_currency, tg_market | localStorage | your language, currency and site version (country) | until you change them | | tg_wishlist | localStorage | saved experiences while signed out | until you clear it | | tg_compare | localStorage | up to four experiences you picked to compare (only their ids; nothing is sent until you open the comparison) | until you clear it | | tg_queue_pass | sessionStorage | only in a waiting room for a high-demand on-sale: your place in the line (a signed pass), so reloading the page keeps it | until the tab is closed | | tg_play_code:<booking reference> | sessionStorage | the ticket code that opened a self-guided tour, so the player stays open while you walk | until the tab is closed | | tg_play_quests:<booking reference> | localStorage | the quests of a self-guided tour you solved with no signal (the stop and your answer, never a photo), kept only until they are sent | until you are back online | | tg_cart | localStorage | the cart, while it is switched on | until you check out or clear it | | tg_recent | localStorage | recently viewed experiences, shown only to you | until you clear it | | tg_recent_searches | localStorage | your recent searches, shown only to you in the search box, and only while "Recommended for you" is on | until you clear them or turn recommendations off | | tg_cookie_notice, tg_install_dismissed | localStorage | that you closed this notice (or, with the one-line notice, moved on to another page after seeing it) or the "install the app" prompt | until you clear it | | tg_theme | localStorage | the appearance you chose (light or dark); nothing is stored while it follows your device | until you change it | | tg_app_review_asked | localStorage | in our phone app only: when the app last showed the store's rating prompt, so it is not shown more than once every 120 days | until you clear it | | tg_privacy_country, tg_privacy_optout | localStorage | the country you told us on Your privacy choices, and your "Do Not Sell or Share" choice | until you change them | | tg_oidc_key, booking-link tokens | sessionStorage | a one-time key for signing in with Google or Apple; the link to manage a booking you opened from an email | until the tab is closed | | tg_personalise | localStorage | set to "0" when you turn "Recommended for you" off; nothing is stored while it is on | until you turn recommendations back on | | tg_concierge | sessionStorage | the handle of your conversation with our concierge, so this tab can continue it; the conversation itself is kept on our side as described above | until the tab is closed | | tg_live_chat | sessionStorage | only while you chat with our support team: the chat's number and the key that opens it in this tab; the conversation is kept on our side and goes into your support request when the chat ends | until the tab is closed | | tg_kiosk | localStorage | only on an operator's self-service kiosk tablet: the kiosk's device token, set when the operator pairs the tablet; no guest's name, email or booking is kept on the tablet | until the operator removes or re-pairs the kiosk | | tg_promo | sessionStorage | a promo code from the link you arrived with (?promo=), so prices can show it | until the tab is closed | | tg_family_mode | sessionStorage | only when you switch family mode on in search: that it is on, your children's ages and whether you need stroller access, sent only with your searches to filter them; we keep nothing on our side | until the tab is closed | | tg_creator_code | sessionStorage | the creator code of a creator's page you opened (/c/…), so the checkout's code field starts with it; you can remove it there | until the tab is closed | | tg_partner_consent | localStorage | on a hotel's, airline's or agent's transfer page (/h/…) only: your choice about that partner's own analytics and advertising tags. They load only after you accept, never on the page where you type your name, email or phone, and with their automatic collection of form data switched off | until you clear it | | tg_bt:<booking reference> | sessionStorage | the signed link to manage a booking you opened from an email, taken out of the address bar | until the tab is closed | | tg_ticket_link_<id> | sessionStorage | the signed link to a ticket a friend sent you | until the tab is closed | | tg_device | localStorage | a random id for this browser, only when you open the invite-a-friend page; we receive only a salted hash of it, to tell an invite's friend from its sender | until you clear it | | tg_supplier_account | localStorage | for operators on several business accounts: which one the portal acts for | until changed or you sign out | | tg_supplier_all_tools | localStorage | for operators: that you chose to see every tool on the dashboard before your first booking | until changed | | tg_oauth_nonce | cookie (HttpOnly) | for operators and our staff connecting Xero or QuickBooks only: a random value that ties the consent to the browser that started it, so a consent link sent to someone else cannot connect their books; essential | 10 minutes, deleted when the consent returns | | tg_consent | localStorage | your choice about our analytics and advertising tags (yes or no to each, and the version of the words you saw); essential, to remember your choice | until you change it or the words change | | tg_vid | localStorage | a random visit id, so a booking days later can be credited to the campaign or link the visit started from. Set only with your consent to analytics; deleted when you withdraw it | 90 days | | tg_touch | sessionStorage | the campaign the visit arrived with (utm_* and, only with consent to advertising, an ad click id), sent with a booking; set only with your consent to analytics. Without it the campaign is kept in the page's memory and gone when the tab closes | until the tab is closed | | tg_src | sessionStorage | the kind of source your visit came from (one word such as search engine or social network, nothing about you), sent with a booking made in this tab so bookings can be counted per source; not set if you said no to analytics | until the tab is closed | | tg_sub | localStorage | the signed link to your newsletter preferences, kept only if you agreed to emails about experiences you viewed, so this browser can tell us which listings you looked at; based on that consent | until you unsubscribe, turn those emails off or clear it | | tg_pseudo | sessionStorage | a test-language switch for our developers; never set on the public site | until the tab is closed | | tg_scan_sound, tg_scan_venue, tg_scan_auto | localStorage | operator's voucher-scanner settings | until changed | | tg_editor_preview | localStorage | whether the operator's listing editor shows the traveller preview | until changed | | tg_trip_plans | localStorage | the private links of trip plans you saved without an account (up to 20, with their titles), so you can open them again on this browser; we keep only a hash of each link | until you remove the plan or clear it | | tg_first_launch | localStorage | in our phone app only: when the app was first opened on this device, so that a page you chose before installing it (its short code, which Google Play hands to the app as tg_link) is opened once, on the first launch. Only a public page is kept this way (never a booking, payment or sign-in link), with only its campaign and search parameters. On an iPhone, which has no such code, and only when we switch it on, a page chosen with an App Store tap is matched instead by a keyed hash of the network address the tap came from, for at most 2 hours and without any affiliate's parameters. We delete the code and the page 7 days after the tap | until you clear the app's data | | tg_bdraft:<listing> | sessionStorage | what you filled in on a booking form, kept as you leave for the payment page, so that after a cancelled payment the form comes back as you left it, with the booking that holds your places; never sent to us; of the operator's questions only your choices are kept (never free text, numbers or dates, such as a document number or a date of birth) | until the booking is paid, you sign out or the tab is closed (offered back for at most an hour, then deleted) | | tg.r23p5.gift | sessionStorage | a gift of an experience you are using: its code, the experience, the party and its add-ons, so the listing's booking form can book it; booked again after a cancellation, also what that booking chose (occasion and message, add-ons, guide language, pickup; your special requests and a typed pickup address only when you are signed in to the account that made it); never put in a link | until the gift is booked, you choose to book without it or the tab is closed | | tg_rvdraft:<booking reference> | sessionStorage | the review you are writing, so that a reload loses nothing; sent only when you post it | until you post it, sign out or the tab is closed | | tg_widget_token | localStorage | in our phone app only, with home-screen widgets on: a read-only token that lets the widget show your next booking (it can read nothing else); revoked when you sign out | until you sign out | | tickets kept by the app | the app's own store (iOS Keychain on this device only; Android, encrypted with a key that never leaves the phone) | in our phone app only, signed in: the tickets of your bookings that you opened (title, time, place, each ticket's code and barcode), so they show with no network; kept for your account only, never for a booking link opened without signing in, and forgotten when you sign out, when your session ends (for example "sign out everywhere" after losing your phone), when another account signs in, and after reinstalling the app | until then, and each booking at most two days after it starts | | tg_concierge_seed | sessionStorage | a first question for the assistant brought by a link you followed; shown in the assistant's box for you to change or send yourself, never sent for you | until the assistant opens or the tab is closed | | tg_voice_read_aloud | localStorage | that you asked the concierge to read its answers aloud ("1"); nothing else | until you switch it off or clear your browser data | | tg_hop_pack_<listing>, tg_hop_queue_<listing> | sessionStorage, localStorage | only on the phone of a hop-on/hop-off operator's crew: the signed pass list for scanning without signal (hashed pass codes and their validity, no names), and the boardings scanned offline until they upload | the list: until the tab is closed; the boardings: until uploaded | | push subscription | the browser's push service | only if you switch notifications on: lets us send you the notices you chose | until you switch them off, or the browser drops it | | offline gate queue | IndexedDB | an operator's voucher scans made without signal, until they upload | until uploaded or signed out | | app shell | service-worker cache | the site's own files, so it opens offline | replaced by each release | | tg_ad_clicks | localStorage | only after you open a listing from a card marked "Ad": a signed note of that click for that listing (which ad campaign and which listing, nothing about you), sent with a booking of the listing so the operator pays its higher ad commission; your price is the same with or without it | 7 days | | tg_partner_bar | localStorage | only for a signed-in partner: that they folded the partner bar on our pages ("0"); nothing else | until they open it again or clear it | | tg_chunk_reload | sessionStorage | the time our page last reloaded itself because a new version of the site was released while it was open, so it reloads at most once and then shows a message instead; nothing else | until the tab is closed |

Two things the page loads from elsewhere, without cookies: the fonts (Google Fonts) and the map tiles (OpenStreetMap, or the provider we configure). Both see your IP address when your browser fetches them.

Security check (draft — added with wave O): on sign-up, the forgot-password form, the form to report content, quote requests and a partner's transfer booking page, we may load Cloudflare Turnstile (Cloudflare, Inc., United States) — or hCaptcha (Intuition Machines, Inc., United States) instead — to tell people from bots. It is loaded only when you open one of those forms, never elsewhere on the site, and mostly runs unseen. It receives your IP address and characteristics of your browser and of how the page is used, and tells us only whether the check passed; we keep nothing from it. We treat it as strictly necessary for a form you asked to send (ePrivacy Art. 5(3) exemption; GDPR 6(1)(f): protecting the service from abuse), so no consent is asked. Turnstile sets no cookies; hCaptcha may set its own.

Global Privacy Control is honoured everywhere: if your browser sends it, we treat it as a request not to sell or share your data (we do neither) and record it on your account if you are signed in. Your privacy choices shows what we received.

Where you live

These additions apply on top of this notice, by where you live (we use the country of your connection, or the one you choose on Your privacy choices):

categories, "Do Not Sell or Share", Global Privacy Control, 45-day answers.

Who receives your data

requests and pickup — what they need to run it. An operator can also write to everyone booked on a departure at once: your replies go to the operator only, and travellers never see each other's contact details. You can turn off the email copies of these group messages for a booking (the link in each one, or the voucher); the message still appears in your conversation. That choice is kept with the booking and erased with it. If we switch on guest statistics, an operator also sees figures about its guests as a group (languages, countries from the phone number's prefix, kinds of party, how many come back), never for fewer than 5 guests.

or Amazon SES, whichever we use), hosting, and DeepL (DeepL SE, Germany) for machine translation. DeepL translates listing text, and — only when you or the operator press Translate — the text of a message or a review. Only that text is sent: never your name, email or booking details. For messages DeepL acts as our processor under a data processing agreement and does not keep the text to train its models (DeepL API Pro terms). The translation is stored with the message and is erased with it. Messages and reviews go to DeepL only. Listing text may instead be translated by Google Cloud Translation (Google Ireland Ltd / Google LLC), for example when DeepL is unavailable: Google receives only that text, acts as our processor under its Cloud Data Processing Addendum and does not use the text to train its models. An exception to "only when you press Translate": an operator's message to you (also a message to everyone on a departure) is machine-translated by DeepL into your booking's language for the email we send you, labelled as a machine translation, with the operator's original below it (only the message text is sent; MESSAGE_AUTO_TRANSLATE_ENABLED). The translation is kept with the message and erased with it.

service (Brevo, Mailchimp or Klaviyo — the last two in the United States) receives a newsletter subscriber's email, language, country and topics; the affiliate networks Awin and Travelpayouts receive, for a booking that came through their link, the booking reference, the amount and the network's click id; our error-reporting service (Sentry or a compatible service) receives error reports from which names, email addresses, tokens and payment details are removed; and for US bookings a sales-tax calculator** (Stripe Tax, TaxJar or Avalara) receives the amount and the places of the service — never your name or contact details. Each acts as our processor.

PBC, United States; or another provider we name here before switching) generates text for features that are labelled as AI-generated: summaries of published reviews, listing drafts from an operator's own notes or website, and reply and message drafts that the operator edits before sending. For reviews, only the review text and rating are sent, never the reviewer's name. For reply drafts, only the last few messages of that one conversation are sent, with names replaced and email addresses, phone numbers and links removed, plus the listing's public details and the booking's date and party size — never your email, phone, booking reference or payment details; nothing is sent until the operator presses Suggest a reply. The provider acts as our processor under its commercial terms and data processing addendum, does not train its models on this data, and keeps it only briefly for abuse monitoring. We keep no copy of what was sent or answered for drafts; we log only that a draft was made (feature, model, size, cost). Review summaries are stored with the listing and list which reviews they used. The same provider also finds the topics in published reviews (only the review's sentences are sent, never the reviewer's name), translates and improves listing text when an operator asks (listing text may then be translated by it instead of DeepL or Google), and reads the pages of an operator's own website to propose draft listings (the catalogue importer, which fetches them as TheGuideBot).

and WhatsApp messages; Vonage (Vonage, United Kingdom/United States) may carry SMS instead, whichever we configure. They receive your phone number and the text, and tell us whether it was delivered and whether you replied STOP. WhatsApp messages also pass through Meta's WhatsApp Business platform. Texts are deleted from our systems after 180 days.

messages you send to their own WhatsApp number (through Twilio), Instagram account (through Meta Platforms' Instagram messaging) or booking email address (through our inbound email provider, Postmark, Resend, Mailgun or Amazon SES; with Amazon SES a message may also sit briefly in our own storage bucket at Amazon Web Services before we read it). We keep the message, the number, Instagram-scoped id or email address you wrote from, and link it to your booking with that operator when the number or email matches a paid booking. Messages to our own WhatsApp number reach an operator only if you hold a paid booking with them. We do not send these messages to anyone else, and a question you asked on Jet.Guide before booking stays masked as before. Replies go back on the same channel, only within 24 hours of your last WhatsApp or Instagram message, and never for marketing. These threads are deleted 365 days after their last message; you can ask the operator or us to delete one sooner. The basis is the operator's and our legitimate interest in answering you (6(1)(f)) and, for a booking, the contract.

message, forward your email or upload a screenshot of it, and have an AI model (our AI provider, as above) draft a booking from it — your name, contact details, date and party as you wrote them. The operator checks every field and confirms; nothing is booked by the AI. Screenshots are not stored; the text and the draft are cleared 30 days after the operator decides.

FlightAware AeroAPI (whichever we configure) receives the flight number, the arrival date and the airport — never your name, email, phone or booking.

zones, destinations). If we switch on an outside geocoder — OpenStreetMap Nominatim, Google Places or Mapbox — it receives the text you typed, the language and, where we have it, a nearby point to bias the results; never your account or booking. Nominatim answers are cached for 30 days, Google's for at most a day, Mapbox's are not stored.

drive times on our own server. If we switch on a routing service — OSRM (on a server we run or contract) or Google Routes — it receives only the coordinates of the stops and of the start, which can include the position of a pickup address you gave; never your name, the address text, your contact details or your booking.

whichever we configure), it holds our listings and receives the words you search for and the language — not your account or any booking.

delivers them — Google (Chrome, Android), Mozilla (Firefox), Apple (Safari) or Microsoft (Edge). The message is end-to-end encrypted (RFC 8291): the push service sees only ciphertext, the address your browser gave us and when it was sent. In our app (Android and iOS) notifications are carried by Google Firebase Cloud Messaging (Android) and Apple Push Notification service (iOS): they receive the device's push token and the notification's title and text — for example that a booking is confirmed, a reminder or your driver's details — and can read them; they are not end-to-end encrypted.

booking changes, Apple's push service (APNs) tells your device to fetch the new pass from us. A Google Wallet pass is created at Google when you tap "Save to Google Wallet" and updated by us through Google's Wallet API. A pass carries the experience, date, time, meeting point or pickup, party size, the booking reference and its code — never your name, email, phone or answers.

account id at that provider, your email, whether they verified it and your name; we tell them nothing but that you are signing in to Jet.Guide. They are separate controllers for your account with them.

cover at checkout. For the quote the insurer's distribution partner receives the trip's date, length, country and cost, the number of travellers and the country you live in — not your name or contact details. Once the booking is paid, it receives your name and email and the booking reference, to issue the policy. The insurer is a separate controller for the policy and any claim, under its own privacy notice (linked next to the offer). We keep the quote, your choice and the words you saw.

storage, car rental, hotels) pass nothing about you or your booking. A partner's affiliate tag is added to the link only if you allowed advertising cookies; we count clicks only in total.

may show offers sold by other platforms — Viator, GetYourGuide, Tiqets, Musement, Klook, Civitatis, Kiwitaxi and GetTransfer, whichever are switched on. When you choose one, our link counts the click and takes you to the partner's site. The partner receives only a random click id with our partner id — never your name, email, account, booking or address — and only if you allowed advertising; without that consent you go to the partner without any id of ours. We keep the click (the partner, the offer, the page it was on, and a code that changes every day so that a double click counts once) without your account, network address or browser, for 13 months. The partner reports back its booking reference, the status and our commission, nothing about you. What you book there is between you and the partner, under its terms and privacy notice.

offers could be shown, we check whether you booked one of our services in the last 24 hours — only to hold back a partner's transfer or activity that could make a linked travel arrangement with it. Nothing about this check is kept or sent to a partner, and which offers you see does not depend on any profile of you.

none of our own carriers drives a route, we may sell you a transfer from a wholesale supplier — Mozio, Hoppa or Suntransfers, whichever are switched on — run by the company named on the offer. To search, the supplier receives the places, the time and the number of passengers and bags, nothing about you. When you book and pay, it receives the lead passenger's name, email and phone, the flight number if you give one (so the driver can follow a late landing) and your note to the driver, to book and run the ride; it tells us the driver's name, phone and car. We keep the booking for as long as other bookings (accounting). The supplier and the company that drives are separate controllers for the ride.

your membership of a partner's programme (an airline's miles, a bank's points) to your account, we keep the membership number and the name you give, and send the partner, for each booking that took place, the number, the name, our booking reference, the date, the amount and the points earned — by its API or in a file our staff send it. Turning points into credit with us sends the number and the points to take off. Nothing else about your bookings is sent. Remove the membership at any time: nothing more is sent. When you add a number, the partner first receives it to send you a code that confirms the membership is yours; once you enter the code, the partner gives us a consent token so that we can show your balance and turn points into credit. We keep the token with the membership, never include it in your data download, and erase it with the membership. One exception to "nothing more is sent": a refund of a booking that had already earned points is still reported to the partner by our staff, so that those points are taken back.

Bulgaria you may pay a booking through ePay.bg (ePay AD, Bulgaria) — by card or from your ePay micro-account on ePay's own page, or in cash at an EasyPay office against a 10-digit code we email you. ePay receives from us the amount, a payment number and a short description (the booking reference and the experience), never your name or contact details; what you enter on its page is handled by ePay under its own terms. A refund goes back through ePay to the card or micro-account; for cash paid at EasyPay we email you a link to a secure form, valid once and for 14 days, where you enter the IBAN and the account holder's name, to send it by bank transfer (please do not send bank details by email). The IBAN is stored encrypted and used only for that transfer; our finance team sees it masked to its country, check digits and last four characters and opens it in full only to make the transfer, which is logged. Once the refund is made, only the masked IBAN and the name are kept, with the refund record.

the IBAN (Verification of Payee, Regulation (EU) 2024/886). The bank receives the name we hold and the IBAN; we keep its answer, the name checked, the name it returned on a close match and the IBAN masked to its country, check digits and last four characters, with the payout record. This concerns operators and partners, which are usually businesses.

listing or guide profile, or one you add to your review, goes to our video provider — Mux (Mux, Inc., United States) or Cloudflare Stream (Cloudflare, Inc., United States), whichever we configure — or is kept on our own storage. The provider receives the file and, when someone watches it, the viewer's IP address and browser, as any video host does; never your name or booking. A review video is shown only with the published review, can be hidden by our moderators, and is deleted with your review or when you ask us to erase your data.

PDF attachments, documents) is checked by a virus scanner (ClamAV) running on our own servers; nothing is sent elsewhere. A file found infected is refused, and we keep its fingerprint (a hash), who uploaded it and when, as a security record.

guides or drivers to prove their identity through Stripe Identity (Stripe). The guide or driver photographs an identity document and, if required, takes a selfie that Stripe compares with it. Stripe receives these images and the data it reads from the document; we keep only the outcome (verified or not, and Stripe's reason code) and when. This concerns operators' staff, not travellers.

WhatsApp messages directly through Meta's WhatsApp Business Cloud API (Meta Platforms Ireland Ltd.). Meta then receives your phone number and the message and tells us whether it was delivered and read.

Azure AI Speech turn an operator's tour texts into narration (no traveller data); Twilio (Voice) connects our agent's call to your number when you asked for a call back.

an automation service (for example Zapier) to its account with an API key; they then receive its bookings, including your name and contact details, as they do through the operator's webhooks. The operator is responsible for those tools.

QuickBooks Online books. We then send them the operator's sales (our receipt number, the booking reference, the experience and the amount), refunds, our commission invoices and our payouts — by default under one contact for all guests; only if the operator chooses it, under your name. Never your email, phone or address. The operator decides on this transfer and is the controller of its books; we act for it.

operator may email you its news and offers, that operator can send you email campaigns through Jet.Guide. The operator writes them, chooses who gets them (for example guests of one of its experiences) and is the sender and controller of these emails; we send them on its behalf as its processor. Each one names the operator and has a one-click unsubscribe, which withdraws your consent to that operator; a complaint about one does the same. We keep which campaign went to your address and whether it was delivered or bounced, and a hashed copy of an address that unsubscribed, so it is not emailed again. We do not track opens or clicks.

checkout that lets an operator email you its news and offers is not enough on its own. Once the booking is paid we send that address one email with a confirmation link, and the operator may email you only after you use it. Until then nothing is sent and your address is not given to the operator for marketing; if you ignore the link, nothing ever is (it works for 30 days). We keep when the box was ticked, when we sent the link and when you confirmed, as the record of your consent. An earlier unsubscribe from that operator stays in force until you confirm again in this way. Consents given before this check existed wait for the same confirmation.

into your trip carries no structured booking data, its subject and up to 8,000 characters of its text go to our AI model provider (as above) to find the bookings in it. The provider acts as our processor and does not train its models on it; we keep neither what was sent nor the answer, only the items you then see as drafts, and our usage records keep only the size and the cost.

Google, Google (Google Ireland Ltd / Google LLC) sends us the bookings you make on Google Maps or Search and receives their status and the contact details on them back, and receives in feeds the operator's business name, address and the classes it offers. Google is a separate controller for its users' data.

Some providers are in the United States; transfers rely on the EU–US Data Privacy Framework or standard contractual clauses.

How long we keep it

| Data | Kept | |---|---| | Account | until you erase it | | Booking financial record (amounts, dates, payment, ledger) | 10 years, as Bulgarian accounting law requires (Accountancy Act Art. 12) — without your name and contact details once you erase your account | | Booking contact details and answers | while your account exists; for guest bookings, (retention period to be set with counsel, proposal: 3 years after the experience) | | Reviews | while the listing exists; after erasure, shown as "Former traveller" and no longer linked to you | | Machine translations of a message or review (made on request, or automatically for an operator's message emailed to you) | as long as the message or review itself; deleted with it | | Reports under the DSA | the decision and its reasons are kept; the reporter's identity is removed when they erase their account | | Security log | kept; it is tamper-evident and cannot be edited, and records account events without your email | | Signed-in sessions | deleted 90 days after the session ends or was last used, and at once when you erase your account | | Text messages (SMS, WhatsApp) | 180 days, then deleted | | "Who's going" | until you turn it off (deleted at once), the booking is cancelled, the operator stops offering it, or 30 days after the departure | | Live driver location | only the latest position; deleted when the ride moves on, after 30 minutes at most, and at once when the driver withdraws consent | | Waiver signatures | personal fields (and health answers) cleared after the activity plus the operator's retention period (90 days unless the operator sets another); at once if the booking is cancelled or you erase your account. The fact of signing, the version and the hashes are kept | | Dietary needs and allergy notes | cleared 7 days after the activity; at once if the booking is cancelled, if you remove them on the booking page, or if you erase your account | | Identity details an operator asks for each participant (ID card or passport number, nationality, date of birth, passport expiry) | cleared 7 days after the activity; within an hour if the booking is cancelled; at once if you erase your account. Your other answers stay with the booking | | Price alerts | until the alert ends (a drop was emailed, 180 days, or its dates passed), then 30 days; at once on unsubscribe or erasure | | Recommendations | not stored | | Searches that found nothing | only the words, lower-cased, counted per day, market and language — never who searched (no account, address, device or session); words that look like an email address, a phone number or a booking reference are not kept at all; deleted after 90 days | | Concierge conversations | 30 days after your last message (CONCIERGE_RETENTION_DAYS), then deleted with any pending confirmations; at once when you delete the conversation | | Live chats with our support team | 90 days after the chat closes (LIVE_CHAT_RETENTION_DAYS), then deleted; the transcript in the support request is kept as support requests are | | Your own trip items and your forwarding address | until you delete them or erase your account; a forwarded email is not kept, only the items read from it | | Split payments | the amounts, payments and refunds stay with the booking's financial record; your friends' email addresses are removed 30 days after the split ends, or earlier when you erase your account or the friend asks; the card saved for the rest is deleted at Stripe when the split ends, and at once when you erase your account | | Departure chat | messages deleted 30 days after the departure ends (a reported message is kept with the report); the travellers you blocked until you undo the blocks or erase your account | | Bookings through Google | as other bookings; Google's identifier for you deleted with the booking's personal data | | Assistants linked to your account | until you remove the access or erase your account (the links and their tokens are then deleted); access tokens expire after an hour, refresh tokens after 30 days; the list of actions an assistant took stays with your account, and after erasure without it | | Fraud checks on bookings | the hashes of your email, network and card: 180 days, or until you erase your account if sooner; the score and signals stay with the booking record | | Chargeback evidence (only when switched on) | the network address and browser a booking was paid from: 180 days | | Messages with operators, and their attachments | email, WhatsApp and Instagram threads 365 days after the last message; every conversation and its files deleted when you erase your account or we act on your verified request | | Support requests | your name, address, subject and messages deleted on erasure; the category and dates stay for our service statistics | | Transfer details (pickup and drop-off addresses, flight number, the name on the sign, live position) | removed on erasure; the ride, its times and fare stay with the booking's financial record | | Group and private quote requests | your name, contact details, party details and notes removed on erasure; dates, amounts and payments stay | | Group bookings: the names list, members asked to pay a share, receipts to a company (only while switched on) | the names the organiser lists and the email address of a member asked to pay a share: cleared 30 days after the activity, or on erasure by the organiser or the member; a paid share's amount and payment stay with the booking's financial record. The company details the organiser gives for the receipts: removed on erasure; receipts already issued stay as issued | | Gift cards | the card, its balance and its payment: 10 years (accounting); the buyer's and recipient's names and addresses and the message are removed on erasure (a card bought for someone and not yet delivered keeps the recipient's address until it is sent) | | Store credit and rewards points | the balances and their ledger: 10 years (accounting), after erasure linked only to an anonymous account number. We do not erase an account with store credit left unless you say you give it up | | Invoices and receipts | 10 years, as issued: an issued invoice may not be altered (VAT Act Art. 114, Accountancy Act Art. 12) | | Travel insurance bought with a booking | the policy record stays with the booking's financial record (insurance distribution record keeping); the insurer keeps your policy as its own controller | | Passes and memberships | the holder's name and photo, the buyer's address, the saved card and the renewal consent removed when you erase your account (the pass can then no longer be used); the terms paid, refunds and gate entries stay with the financial record and the operator's record of admissions. An operator's offline gate list holds photos only encrypted and is deleted with that list | | Guide pay statements | kept for the operator as its payroll record while its account exists | | Skipper's licence (boat charters) | the scan deleted 19 days after the charter ends (after the deposit-claim window), keeping only the last three characters of the licence number; at once when you erase your account; a deposit claim, its photos and decision are kept as evidence for legal claims | | Newsletter and emails about listings you viewed | until you unsubscribe or erase your account; on erasure we also remove you from our email provider | | Proof of consent (texts, cookie choices) | kept as proof of what was agreed, without your phone number, account or network address once you erase your account | | Do-not-contact lists | a number that replied STOP, or a one-way hash of an address that opted out, kept so that we never contact it again | | Legal texts you accepted | 5 years after your last booking, as evidence of the terms agreed | | Privacy requests | that a request was made, its kind and dates: kept as proof that we answered; staff notes on how they checked your identity: 3 years after the request is closed; a download link works for 7 days | | Clicks on offers from other platforms | the partner, the offer, the page and a code that changes daily, without your account, network address or browser: 13 months, then deleted | | Bookings an operator's sales channel sent that could not be booked automatically (GetYourGuide, Viator, Expedia and others) | the lead traveller's name the channel sent, while the operator decides: at most 30 days after the channel sent it, then cleared; the channel, its reference, the party and the amount stay with the operator's sales record | | Trip plans | a saved plan: in your account until you delete it or your account; without an account, 30 days after its last change. A file you started from is never stored | | Travel preferences | until you turn the memory off (deleted at once) or erase your account; access needs until you withdraw their consent | | Reports that an AI answer is wrong | 180 days after our team closes them (a year at most while open); your account and note removed on erasure | | Carts saved by an assistant | deleted a day after the link expires (7 days unless we set another period, at most 30) | | Planning in a group | questions to the assistant and its answers: 30 days; the group's shortlist, votes and date poll: 30 days after the group stops being shared; your own additions and votes at once on erasure | | Guest connections | the opt-in until you opt out; a connection and its messages until either guest ends it or erases their account | | Price-match claims | the amounts, dates and decision stay with the booking's financial record; your account, address, note and screenshot removed on erasure | | Instalment plans | the schedule, payments and your agreement stay with the booking's financial record; the card details are removed on erasure, and the card itself at Stripe once nothing more is due | | Operator texts | the texts (number and words): 90 days after they were sent (OPERATOR_SMS_RETENTION_DAYS); a consent until you withdraw it or erase your account; a STOP kept so that the operator never texts that number again | | Conversations with an operator's AI front desk, and calls to its AI receptionist | 30 days after the last message or the call; at once when you erase your account | | Waiver height, weight and shoe size; walk-in waivers | the measurements with the waiver's personal fields; a walk-in waiver not linked to a booking after 7 days (or the operator's 1 to 30) | | Your position at the meeting point | cleared 30 days after the check-in | | Operator team sign-ins (security feed) | 180 days | | Driver pay statements | kept for the carrier as its payroll record while its account exists | | Buying through an AI platform | the checkout with your details: 30 days after its expiry time if it was not completed, 180 days after it was completed; our answer to each request: 24 hours; the status messages sent to the platform: 30 days | | An operator's own ad measurement | your choice and the identifiers sent: 90 days | | Photos after the tour | the photos and your choice: 30 days after the departure ends (we may set 7 to 180 days); a photo taken down: deleted at once; a photo package bought: its payment stays with the financial record | | Partner loyalty memberships | the membership number, the name and the partner's consent token: until you remove the membership or erase your account; the points sent for each booking: with the booking's financial record, without your account after erasure | | Transfers from wholesale suppliers | as other bookings: the lead passenger's name, email, phone, flight number and note to the driver removed on erasure; the ride and its fare stay with the financial record | | The travel map | your choices, the experiences you hid and the words you agreed to: until you turn the map off or erase your account | | Payments through ePay.bg and EasyPay | the payment and its refunds: with the booking's financial record; the IBAN you enter for a cash refund: encrypted until the refund is made, then only masked to its country, check digits and last four characters, with the account holder's name, in the booking's financial record | | Verification of Payee (payouts to operators and partners) | the bank's answer, the name checked and the IBAN masked to its country, check digits and last four characters: with the payout record |

Your rights

You can access, correct, download, restrict or object to the processing of your data, and erase it.

your account as a JSON file, or as a readable page. Once your email address is verified, it also includes what we hold under that address, such as bookings you made as a guest.

everywhere, and remove your name, email, phone, messages, uploads, saved lists and sign-in details, as listed in the table above. Financial records of your bookings are kept without your personal details, as the law requires. We cannot erase an account while it has an upcoming paid booking (the operator needs your details to run it), while a claim on one of your bookings is still being decided, or while you run an operator, partner or business account — contact us to close those first. If store credit is left, we ask you to confirm that you give it up.

viewed, the analytics and advertising choice on your device and Global Privacy Control, each with its off switch, and one button that withdraws all of them. An operator's marketing texts: withdraw on the booking page, or reply STOP to any of them.

Your privacy choices. We email a link to the address your data is held under, to verify that the request is yours, before we disclose or delete anything. A member of our team records how they checked who you are, then sends you a link to your data (it works for 7 days) or erases it under the same rules as the account's own erasure.

by email at once, look into it and tell you the outcome. You can complain to a data protection authority at any time as well (above).

We answer within one month. If we need longer, we tell you why within that month; the law allows up to two more months.