Privacy policy

Scope

This policy explains the personal data handled by myhoteloffers.com when you search, book, use an account, contact a property or our support team, submit a property, post a review or question, or use the booking assistant.

It also covers the myhoteloffers.com app for Android and iOS, which uses the same account as the website.

Deleting your account

You can delete your account at any time in the app, under My account, then Delete account, or on our account deletion page, which works without the app too. That page explains what we delete and which records we have to keep.

Data the platform handles

• Account and profile data: name, email address, optional phone number and profile image, email-verification status, language and currency preferences, role, and a password hash or linked sign-in-provider account data.
• Session and security data: session identifiers, expiry times, IP address, user-agent information, and security or moderation records.
• Search and booking data: destination and stay choices, guest counts, the ages of children travelling, room and rate details, guest contact details and country, special requests, prices, taxes, cancellation terms, rewards data, and booking status.
• Messages and public contributions: booking messages and attachments, Book together messages, support requests, reviews, review scores, helpful votes, property questions, and property responses.
• Partner and property data: listing applications, property and room details, policies, rates, availability, contacts, images, certifications, team membership, and administrative audit records.
• Communication data: an email address, locale, unsubscribe information, email-delivery status, and review invitations.
• Payment records: amount, currency, payment timing and status, refund status, and Stripe payment identifiers. We do not store a full card number.
• Browser data: essential cookies and browser storage used for sign-in, booking access, language, currency, cookie choice, interface preferences, and temporary form or message drafts.
• Usage data: the pages you view, the page that sent you here, your browser and device type, and your approximate region, collected through Google Analytics as described under Cookies and browser storage.
• Booking-assistant data: the prompt you send, the assistant session identifier, and the tool results needed to answer or act on the request.
• Flight passenger data: each passenger's name, gender, date of birth and nationality and, when the airline asks for them, the passport number, its issuing country and its expiry date.
• Saved travellers: if you save travellers to your account, each one's name, gender, date of birth and nationality and, if you add them, the passport number, its issuing country and its expiry date. Only you can see them, the passport number is stored encrypted, and you can change or delete each traveller at any time. They are deleted with your account.
• Reports: when you report a review, an answer, a message or an AI Agent reply, the reason you chose, your note and a copy of what you reported, so our team can check it.
• Message photos: photos you add to a booking message (JPG, PNG, WebP or AVIF, up to 8 MB each and up to 4 per message). They are stored privately and only the property and our support team can see them.
• Approximate location: the city and its rough coordinates that our network provider works out from your IP address, used only to suggest stays near you and, in the app, an airport near you to fly from. We do not store it on our servers. On the website, your browser keeps the suggested city and its coordinates in a cookie for 30 days after your last visit.
• Precise location: your device's coordinates, only if you choose Use my location on the website and allow it in your browser. We use them only to find the nearest city with stays and to show stays near you, and we do not store them on our servers. Your browser keeps them in the same cookie for 30 days after your last visit and sends them to us with each visit.

Why we use the data

We use this data to search and price stays, create and manage bookings, process payments and refunds, split a stay across several payers, send requested alerts and service messages, provide support, operate partner tools, publish and moderate contributions, protect accounts and the platform, investigate failures or misuse, and keep records needed for booking, accounting, dispute, or legal work.

Payments

Online payment details are collected by our payment partners: Stripe, through Stripe's Payment Element, or, for a booking confirmed through one of our travel supply partners, that partner's secure payment form. We send the payment partner the amount, currency, receipt email, booking description, and internal booking or participant identifiers. It returns payment identifiers and status updates that we store with the booking. Card details entered in these forms do not pass through our application server, and we do not store full card numbers. Your card statement may show the payment partner's name rather than myhoteloffers.com.

Pay-at-property rates do not create an online payment through us at checkout.

Cookies and browser storage

Essential cookies keep you signed in, remember language and currency, store your cookie choice, and grant short-lived access to a booking after you prove ownership. The control-panel sidebar and region suggestion also remember their state. Temporary drafts and booking-assistant session identifiers may be stored in the current browser tab.

We use Google Analytics 4 to see which pages people use and where the site fails them. The cookie banner lets you choose essential cookies only or accept analytics. Until you accept, the site tells Google Analytics not to use cookies: Google receives only cookieless signals when a page is viewed or used, carrying the page address, the time, and your browser type, with no identifier that recognizes you on a later visit. If you accept, Google Analytics sets cookies named _ga and _ga_ followed by an ID, which last up to two years and let it count you as the same visitor across visits. Advertising storage, ad personalization, and Google signals stay off whatever you choose. Google may process this data in the United States.

If you accept analytics, we also remember for 30 days which ad, campaign, or website brought you to us, in a cookie named MHO_ATTR. If you then book, we keep that source and your Google Analytics ID with the booking, so we can see which campaigns lead to bookings. While you are signed in, Google Analytics receives an internal account number, never your name or email address, so your visits on different devices count as one visitor. With essential cookies only, none of this is stored.

You can change your choice at any time with the cookie preferences link in the footer. Turning analytics off stops the analytics cookies and removes the ones already set. You can also clear this site's cookies and browser storage in your browser to withdraw a saved choice and show the banner again.

Mobile app

The app uses the same account and booking data as the website. It also handles:

• App sessions: the app keeps its sign-in tokens in your device's secure storage. We record each session with the sign-in method, the device type, the IP address and when it was last used, and you can end a session from the app.
• Push notifications: only after you turn notifications on, OneSignal receives your device's push token, model, operating system, app version, language and time zone. While you're signed in, the device is linked to your account number, never your name or email address, and to tags from your account: language, currency, member tier, whether a trip is coming up, your last destination city, and whether you book stays or flights. We use them to send booking updates in your language and, if you agreed to offers, price drops on stays you saved. You can turn notifications off in the app or in your device settings.
• App analytics and crash reports: in app versions that include them, Google Firebase Analytics records which screens and features are used, and Firebase Crashlytics sends a crash report with the device model, operating system, app version and what the app was doing when it failed. Neither uses the advertising identifier.
• AI Agent: the app asks before your first message to the AI Agent. Your messages go to OpenAI only after you allow it, and you can turn this off in Settings.
• On your device: the app keeps your language, currency and recent searches on the device. It adds a trip to your calendar only when you ask, and it never reads your calendar, contacts or device location. Maps load their images from OpenStreetMap, which receives your IP address and the area shown.

How long we keep data

Session, verification, booking-access, and temporary browser records have technical expiry times. Unsent booking-message attachments are removed by a scheduled cleanup process.

We keep account, booking, payment-reference, message, review, support, and partner records while we need them to provide the service and while your account stays open. Booking and payment records are kept for as long as accounting, tax, dispute, fraud-prevention, or other legal obligations require. When you ask us to delete your account, we delete or anonymize the rest of your data unless one of those obligations applies.

Who receives data

• The booked property receives the guest and stay information needed to provide the accommodation and respond to booking messages or requests.
• Our travel supply partners receive the guest and traveller names, contact details, stay or flight details, and special requests needed to confirm a hotel or flight booking with the property or airline. Their payment service receives the payment data for the bookings they confirm.
• Stripe receives payment and transaction data for online payments and refunds.
• Resend receives email addresses and message content needed to deliver account, booking, alert, group, review, support, and operations emails.
• Cloudflare R2 stores public property images and private booking-message attachments or generated booking documents.
• Google receives page-usage data through Google Analytics, as described under Cookies and browser storage.
• OpenAI receives booking-assistant prompts and the context or tool results sent through the OpenAI API when you use that feature. The assistant answers from our own property, price, and availability data and does not search the web.
• A social sign-in provider receives and returns account data when you choose that provider. Only the sign-in providers shown on the sign-in page are offered.
• Authorized administrators, property team members, and the database, cache, search, queue, and hosting services used to operate the platform can process data within their access and operational roles.
• OneSignal receives the push token, device details, account number and tags described under Mobile app, to deliver app notifications.
• Google receives app usage and crash data through Firebase Analytics and Crashlytics, in app versions that include them.
• Sentry receives filtered error reports from the app and our servers, in app versions that include it, without your account details or what you wrote.

We do not use advertising networks, and we do not sell personal data.

Every service provider that handles personal data for us may use it only to provide its service to us, and must protect it at least as well as this policy describes.

Your choices and rights

You can update available profile preferences in your account, unsubscribe through the link in any email we send, and choose essential cookies only in the cookie banner. You can turn analytics on or off at any time with the cookie preferences link in the footer.

Privacy rights vary by location and by the reason data is used. Depending on applicable law, you may be able to request access, correction, deletion, restriction, objection, portability, or withdrawal of consent. To get a copy of your data, correct it, or have your account and data deleted, write to support@myhoteloffers.com from the email address on your account. We respond within the time the applicable law requires. A complaint right and the responsible supervisory authority also depend on the law that applies to you.

Children travelling

An adult makes the booking. The booking flow asks the adult for the age of each child travelling because room occupancy and pricing can depend on age. It does not ask for a separate child account or a child's name. Do not put unnecessary information about a child in special requests, messages, reviews, questions, or assistant prompts.

The service is not directed at children, and accounts and bookings are for adults.

Security

Our security controls include hashed passwords, signed and expiring booking-access grants, hashed group invitation tokens, server-side access checks, private object storage, and short-lived signed links for private files. No system is completely secure. Keep login details, booking PINs, and group invite links private, and contact us if you think they have been exposed.

Changes and contact

We will update this page when the platform's data handling changes. Privacy requests and questions can be sent to support@myhoteloffers.com.