Privacy Policy

1. Information We Collect

We may collect personal information, usage information, analytics information, and operational metadata when you use the Services. The information we collect may include:

• Account information, such as your name, email address, password or authentication credentials, profile photo URL, connected account/provider information, account status, account role, and account settings.
• Contact and communication information, such as email address, mailing address, phone number if provided, support requests, feedback, survey responses, messages, and other communications with us.
• User-generated content, such as hotel reviews, star ratings, and any other content you create, submit, or post publicly through the Services.
• Booking and transaction information, such as hotel selections, booking identifiers, reservation details, confirmation numbers, cancellation and refund information, payment status, payment processor references, guest name, guest email, guest count, check-in date, check-out date, price, currency, taxes, fees, and booking history.
• Trip and search information, such as destinations, trip dates, number of travelers, travel preferences, hotel searches, filters, sorting choices, map or location searches, hotel detail views, saved hotels, comparison lists, recommendation interactions, abandoned checkout events, and search/session identifiers.
• Saved traveler preferences, such as preferred destinations, hotel preferences, amenities, room preferences, accessibility preferences, budget preferences, loyalty or provider preferences, saved hotels, and other travel-related preferences you choose to save or that we infer from your use of the Services.
• Recommendation and personalization metadata, such as ranking signals, recommendation scores, FitScore or similar matching metrics, explanation metadata, prompt/context metadata, model output metadata, hotel attribute matches, preference weights, confidence signals, and quality assurance labels.
• Search metadata and analytics metadata, such as search IDs, destination/query text, dates searched, timestamps, result counts, supplier/API response status, partial-results warnings, error categories, latency, cache status, selected result identifiers, clicked result identifiers, booking funnel step, and conversion or abandonment events.
• Device, network, and technical information, such as IP address, approximate location derived from IP address, browser type, operating system, device type, device identifiers, user agent, referring URL, pages viewed, links clicked, session data, cookie identifiers, log data, error data, and security event data.
• Cookie and tracking information, such as cookie identifiers, local storage values, analytics identifiers, session identifiers, preference cookies, and similar technologies used to operate, secure, analyze, and improve the Services.
• Analytics and quality assurance information, such as feature usage, search quality outcomes, service health events, supplier performance, email delivery status, support outcomes, booking failure reasons, cancellation reasons, fraud/security signals, and aggregated reporting metrics.
• AI/LLM interaction information, if AI-powered features are used, such as natural language trip requests, extracted travel constraints, recommendation prompts, recommendation outputs, explanation requests, feedback on recommendations, and metadata used to evaluate model quality and service performance.
• Information from partners and service providers, such as hotel availability, pricing, cancellation policies, supplier references, payment processor events, identity provider profile information, map/geocoding results, email/SMS delivery events, fraud-prevention information, and analytics reports.
• Compliance screening information, such as the outcome of sanctions list checks (including whether a name matched or was flagged on publicly available sanctions, watchlist, or restricted-party databases) and the outcome of IP geolocation, VPN/proxy, and hosting-provider detection performed to comply with sanctions regulations, export control laws, and access restriction obligations. The name used for screening and the raw IP address are not retained in screening records; only the outcome, check type, and relevant metadata are stored.
• Other information you provide, upload, submit, or authorize us to collect through the Services.

We do not intend to collect full payment card numbers or card security codes directly on our servers. Payment information is handled by our payment processor as described below.

2. How We Collect Information

We collect information:

• Directly from you when you create an account, search for hotels, save preferences, book a hotel, contact us, submit feedback, or otherwise use the Services.
• Automatically when you access or use the Services, including through cookies, logs, analytics tools, device identifiers, and similar technologies.
• From service providers and partners that help us provide the Services, including hotel suppliers, booking partners, payment processors, identity providers, analytics providers, communications providers, cloud hosting providers, fraud-prevention providers, and AI/LLM service providers.
• From your browser, device, or network, including IP address, user agent, approximate location, referral information, and usage events.
• From third-party accounts you choose to connect or use to sign in, such as OAuth identity providers.
• From third-party review platforms, including Google, from which we may source hotel review and rating content to display on the Services.

3. How We Use Information

We may use the information we collect to:

• Provide, operate, maintain, and improve the Services.
• Create, authenticate, secure, administer, and support user accounts.
• Search for hotel availability, prices, cancellation policies, amenities, and related travel information.
• Process bookings, payment authorizations, payment captures, cancellations, refunds, confirmations, and customer support requests.
• Share necessary booking and search information with hotel suppliers, payment processors, mapping providers, identity providers, communications providers, and other partners or APIs needed to provide relevant, current, and accurate information.
• Save traveler preferences, saved hotels, account settings, and personalization choices.
• Personalize search results, recommendations, hotel rankings, explanations, and user experience.
• Store search metadata and related operational metadata for analytics, quality assurance, product improvement, supplier performance monitoring, fraud prevention, troubleshooting, and service reliability.
• Analyze usage, performance, funnel events, conversion, failed searches, partial results, supplier failures, booking outcomes, and other service quality indicators.
• Process feedback, support requests, complaints, disputes, and inquiries.
• Send transactional emails, booking confirmations, booking failure notices, cancellation notices, password reset emails, account notices, support messages, and other service-related communications.
• Send SMS/text messages if you opt into a text messaging program.
• Screen users and transaction context against sanctions lists and publicly available restricted-party databases, and evaluate IP geolocation, VPN/proxy, and hosting-provider signals, to comply with applicable sanctions regulations, export control laws, and access restriction obligations. Screening is performed via third-party providers — OpenSanctions for sanctions list matching and ipinfo.io for IP intelligence — as described in Section 6.
• Detect, investigate, prevent, and respond to fraud, abuse, security incidents, unauthorized access, policy violations, and legal claims.
• Debug errors, audit systems, maintain logs, test features, train support workflows, and conduct quality assurance.
• Comply with legal obligations, enforce our terms and policies, protect rights and safety, and respond to lawful requests.
• Develop, evaluate, test, and improve analytics, recommendation, AI/LLM, and quality assurance systems.

4. Human Review and AI/LLM Processing

Some or all of the information we collect may be processed, reviewed, labeled, summarized, or analyzed by humans and/or AI/LLM services for analytics, quality assurance, support, safety, fraud prevention, service improvement, recommendation quality, and troubleshooting.

This processing may include trip dates, destinations, travel preferences, hotel searches, saved traveler preferences, account data, feedback, recommendation metadata, search metadata, error data, booking metadata, and other service usage data. We may use AI/LLM services to extract travel constraints, generate or improve recommendations, summarize feedback, identify quality issues, evaluate search relevance, detect anomalies, and improve the Services.

We seek to limit human and AI/LLM access to information that is reasonably necessary for the relevant business purpose. We do not intentionally provide full payment card numbers or card security codes to AI/LLM services.

5. Cookies and Similar Technologies

We may use cookies, local storage, pixels, tags, scripts, SDKs, and similar technologies to:

• Keep you signed in and maintain sessions.
• Remember preferences and settings.
• Operate checkout, search, saved hotels, and account features.
• Measure traffic, usage, search quality, and booking funnel performance.
• Detect fraud, abuse, errors, and security events.
• Improve the Services and analyze product performance.

You can usually control cookies through your browser settings. If you disable cookies, some features may not work correctly. We may also use analytics services that set or read cookies or similar identifiers.

We use Cloudflare Turnstile, a bot-detection and security verification service provided by Cloudflare, Inc. Turnstile is a strictly necessary security technology and cannot be disabled through our cookie preference center. When you submit a form or access a protected area of the Services, Cloudflare may process certain information about your request — including IP address, browser characteristics, and interaction signals — to determine whether the request originates from a human user. This processing is governed by Cloudflare's Privacy Policy and Terms of Service.

6. How We Disclose Information

We may disclose information to the following categories of recipients:

• Hotel suppliers, booking partners, travel APIs, inventory providers, and related partners so that we can search availability, return accurate hotel information, confirm bookings, process cancellations, obtain refund information, and provide up-to-date travel content.
• Third-party review platforms, including Google, from which we source hotel review and rating content for display on the Services. Content sourced from Google is subject to Google's Terms of Service; ReserveTheNight does not claim ownership of that content.
• Payment processors, including Stripe or similar providers, to process payment authorizations, captures, refunds, disputes, fraud checks, and payment-related compliance obligations.
• Identity and authentication providers when you register or sign in using a third-party account.
• Cloud hosting, database, infrastructure, security, logging, monitoring, and content delivery providers that operate and protect the Services.
• Analytics, product measurement, search quality, recommendation, AI/LLM, and quality assurance providers that help us analyze, improve, personalize, and troubleshoot the Services.
• Email, SMS, notification, and customer support providers that help us send transactional messages and respond to user requests.
• Fraud prevention, abuse detection, security, and compliance providers, including Cloudflare, Inc., which receives request data (such as IP address and browser signals) when Cloudflare Turnstile bot-detection is invoked. Cloudflare's processing is subject to its own Privacy Policy and Terms of Service.
• Sanctions and access-control screening providers, specifically: OpenSanctions (an open-data project), which receives a person's name and optional contextual information (such as nationality or country context) for matching against publicly available sanctions, watchlist, and restricted-party databases; and ipinfo.io, which receives the IP address associated with a request to provide geolocation, VPN/proxy detection, and hosting-provider identification. These providers receive only the minimum data needed for the screening check and process it solely for that purpose.
• Professional advisors, such as lawyers, auditors, insurers, accountants, and consultants.
• Government authorities, law enforcement, courts, regulators, or other parties when we believe disclosure is required or appropriate to comply with law, enforce our terms, protect rights and safety, or respond to lawful requests.
• Business transaction parties in connection with a merger, financing, acquisition, reorganization, bankruptcy, sale of assets, or similar transaction.

We may also disclose aggregated, anonymized, or de-identified information. We do not sell personal information for money. We do not currently share personal information for cross-context behavioral advertising as that term is used under the California Consumer Privacy Act, but if our practices change, we will update this Privacy Policy.

7. Payment Information

Payments are processed by our payment processor. We may receive and store payment-related metadata, such as payment intent identifiers, payment status, amount, currency, refund status, dispute status, and transaction-related timestamps. We do not intend to store full payment card numbers or card security codes on our servers.

Your use of payment services may be subject to the payment processor's own terms and privacy policy.

8. Data Retention

We retain personal information for no longer than 12 months from collection unless a shorter period is appropriate or a longer period is required or permitted by law, including for payment disputes, tax, accounting, security, fraud prevention, legal claims, or compliance obligations.

Booking and transaction records — including reservation details, confirmation numbers, guest information, payment references, and related financial records — are retained for up to 7 years from the date of the transaction to satisfy applicable tax, accounting, audit, and legal record-keeping requirements, or longer if required by law or ongoing legal proceedings.

Search metadata, analytics metadata, quality assurance data, recommendation metadata, telemetry, logs, and operational records are retained for analytics and quality assurance purposes for no longer than 12 months unless a longer period is required or permitted by law.

Contact-form submissions and support communications — including your name, email address, message, and any booking reference you provide — are retained for no longer than 12 months from collection, unless a longer period is required or permitted for ongoing support resolution, dispute handling, fraud prevention, legal claims, or compliance obligations.

Compliance screening records — including the outcome of sanctions checks and IP-based access control decisions — are retained based on outcome: records for clear or passed outcomes are retained for up to 90 days; records documenting a blocked or review-flagged outcome are retained for up to 7 years to satisfy audit, legal, and regulatory compliance obligations. Anonymous access-control records not linked to an account are retained for up to 30 days.

If you request deletion of your personal information, we will delete or de-identify information associated with you unless we need to retain it for a permitted legal, security, fraud-prevention, transaction, dispute, or compliance purpose.

9. Your Privacy Choices

Depending on where you live and applicable law, you may have rights to:

• Request access to personal information we maintain about you.
• Request deletion of personal information we collected from you.
• Request correction of inaccurate personal information.
• Opt out of certain uses or disclosures where required by law.
• Limit certain uses and disclosures of sensitive personal information where required by law.
• Withdraw consent where processing is based on consent.
• Close your account or request that we delete account data.

To make a privacy request, visit our contact page and select “Legal and privacy” as the topic. We will acknowledge your request within 5 business days and aim to fulfill it within 30 days. We may need to verify your identity before fulfilling your request.

10. Security

We use administrative, technical, and organizational safeguards designed to protect personal information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials.

11. Children's Privacy

The Services are intended for users who are at least 18 years old. We do not knowingly collect personal information from children under 18. If you believe a child has provided personal information to us, contact us at admin@reservethenight.com and we will take appropriate steps to delete it.

12. International Users and European Privacy Rights

The Services are operated from and hosted in the United States. If you access the Services from outside the United States, your information may be transferred to, stored in, and processed in the United States and other countries where we or our service providers operate.

European Economic Area, United Kingdom, and Switzerland

If you are located in the European Economic Area (“EEA”), the United Kingdom (“UK”), or Switzerland, the following additional terms apply to you under the General Data Protection Regulation (“GDPR”) and applicable national data protection law.

Legal bases for processing. We process your personal data on the following legal bases: (a) contract — processing necessary to perform a booking or provide the Services you requested, including reservation confirmations, payment processing, cancellations, and account management; (b) legal obligation — processing required to comply with applicable law, including tax, accounting, anti-fraud, and law enforcement obligations; (c) legitimate interests — processing for fraud prevention, security, service improvement, analytics, and quality assurance, where those interests are not overridden by your rights; and (d) consent — processing for optional analytics, personalization, and similar technologies where you have given consent through our cookie preference center.

International data transfers.When we transfer your personal data from the EEA, UK, or Switzerland to the United States or other countries that have not been deemed to provide an adequate level of protection, we rely on Standard Contractual Clauses approved by the European Commission or the UK Information Commissioner's Office, or other lawful transfer mechanisms. You may request more information about these safeguards by contacting us using the details in Section 15.

Your rights. Subject to applicable law and certain exceptions, you have the right to: access the personal data we hold about you; request correction of inaccurate data; request erasure of your data; restrict or object to certain processing; request data portability; and withdraw consent at any time where processing is based on consent. To exercise these rights, visit our contact page and select “Legal and privacy” as the topic.

Right to lodge a complaint.If you believe we have processed your personal data in violation of applicable law, you have the right to lodge a complaint with the supervisory authority in your country of residence. In the UK, this is the Information Commissioner's Office (ICO). In the EEA, this is the data protection authority of your EU member state.

13. California Privacy Notice

This section applies to California residents and supplements the rest of this Privacy Policy. It describes our practices under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”).

Categories of Personal Information We May Collect

• Identifiers, such as name, email address, account ID, IP address, device identifiers, cookie identifiers, payment processor references, booking identifiers, and similar identifiers.
• Personal information categories listed in California Civil Code Section 1798.80(e), such as name, contact information, payment-related information, and transaction information.
• Commercial information, such as bookings, purchases, hotel searches, saved hotels, cancellation and refund information, travel preferences, and transaction history.
• Internet or other electronic network activity information, such as pages viewed, searches performed, clicks, device data, cookies, logs, referral data, session data, and analytics events.
• Geolocation data, such as destinations you search, locations you enter, and approximate location inferred from IP address.
• Inferences, such as travel interests, hotel preferences, personalization signals, recommendation scores, saved traveler preferences, and analytics-derived preferences.
• Sensitive personal information, such as account login credentials. Payment card details are handled by our payment processor; we do not intend to store full card numbers or card security codes.

Sale or Sharing of Personal Information

We do not sell personal information for money. We do not currently share personal information for cross-context behavioral advertising as that term is used under the CCPA. If that changes, we will update this Privacy Policy and provide the required opt-out mechanism.

California Privacy Rights

California residents may have rights to know/access, delete, correct, opt out of sale or sharing, limit sensitive personal information use, and non-discrimination. To exercise these rights, visit our contact page and select “Legal and privacy” as the topic, noting your request is a “California Privacy Request.” We will acknowledge your request within 10 business days and respond within 45 days. If additional time is required, we will notify you and may extend the response period by an additional 45 days as permitted by applicable law.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated “Last updated” date and will be effective when posted. Your continued use of the Services after an updated Privacy Policy is posted means you acknowledge the updated policy.

15. Contact Us

If you have questions, requests, or complaints about this Privacy Policy or our privacy practices, contact us at: