Privacy Policy
We respect your privacy and only collect the minimum data needed to operate and improve the site.
What we collect
- Usage analytics: anonymous page views and events (e.g. filter usage). Used to understand what's working and fix issues.
- Outbound clicks: when you click a booking link, we record a basic log (time, hotel slug, referral parameters). Used for performance reporting and fraud prevention.
- Collections: the email you enter to save or find a collection, whether you opted in to marketing emails, and the hotels and titles you put in your collections. Nothing else identifying is collected. We do not use this data for tracking ads.
Cookies and local storage
We may use cookies for analytics and affiliate attribution. We also use local storage on your device to remember your saved collections (their links and edit tokens) so you can keep adding to them. You can clear these at any time in your browser.
Lawful basis
Our lawful basis for processing is consent and legitimate interests. Collections are created, and marketing emails sent, only because you chose to: you enter your email to save or find a collection, and you separately opt in before we send you anything promotional. Where required, we also request consent for analytics cookies.
Retention
Collections and the email tied to them are kept until you delete them or ask us to. You can delete everything yourself at any time (see Your rights below).
Magic-link access tokens (the links we email you to find your collections) expire after 30 minutes and cannot be reused once expired.
Who processes your data
We use a small number of specialist providers to run the site and never sell your data to anyone. Supabase hosts our database. Vercel hosts the application. Resend sends the emails you request (a magic link, or marketing email if you opted in).
Third parties
We also work with analytics providers and affiliate networks (e.g., Impact/Booking.com). These services may receive basic event or click information to attribute bookings and measure traffic.
Your rights
Under GDPR you have the right to:
- Access: ask what data we hold about you.
- Rectification: ask us to correct inaccurate data.
- Erasure: ask us to delete your data (the right to be forgotten).
- Restriction: ask us to limit how we use your data.
- Objection: object to how we process your data.
- Withdraw consent: stop marketing emails, or withdraw any other consent, at any time.
- Portability: receive the data you gave us in a portable format.
- Complain: lodge a complaint with your national data protection supervisory authority.
To access or erase your data yourself, use Find your collections. Enter your email, open the link we send you, then view or permanently delete everything from that page.
To stop marketing emails: use the unsubscribe link included in any marketing email, or delete your data as above.
For anything else, or if self-service does not cover it, email us directly: per@gotcosy.com
Contact
Email: per@gotcosy.com