Privacy Policy

local-hotel.com is operated by LOCALHOTEL LTD (company number 17229743), registered in England & Wales at 167-169 Great Portland Street, 5th Floor, London W1W 5PF. We decide how your personal data is used (we are the controller). Contact: support@local-hotel.com.

• Account data: email, name, phone number if you add one, hashed password, and the name of the website or link that brought you to us when you signed up (for example chatgpt.com), if your browser tells us. We keep it in memory while you browse and store it only on the account you create; no cookie is used for it. We also keep your country and time zone, worked out from your IP address when you sign up and each time you start a booking, so we send emails at a sensible hour where you are.
• Booking data: hotel choice, dates, the guests on the booking (the lead guest's name, email and phone, and the name of each room's lead guest), price, payment and refund status, and the supplier's reference.
• Accessibility requests: some properties that contract with us directly let you tell them about accessibility needs. This may include health information, so we keep what you write only if you tick to share it with the hotel. We record that you agreed and when. We send it to that property only, keep it with the booking, and remove it if you delete your account.
• Pets: on properties that allow pets, how many, their weight and whether one is an assistance animal, so the property can prepare and price the stay.
• Browsing data: searches, hotels viewed, wishlist and price alerts, used to fill your account history.
• Search log: to improve search, for 90 days we keep one anonymous record of each search: the text typed into the search box, the place it matched, the date and time, how many hotels it found, the number of nights and guests, how many days ahead the stay was, whether it came from a map pin or a suggestion you picked, the site language, and your country. We work out the country from your connection when you search; we do not keep the IP address itself. No account, device or IP address is attached to the record, and it sets no cookie. Please do not type personal details (names, emails, phone numbers, booking references) into the search box; we remove what looks like an email address, phone number, booking reference or full postcode with a house number, but cannot catch everything.
• Support emails: when you email us we keep a copy of the message in our support mailbox and a short record of it (sender, subject, a snippet) so we can answer and follow up.
• Error reports: if you tell us something on a page looks wrong, we store your message, the page it was about, and (only if you choose to give them) your name and email, so we can come back with a question or say thanks. We keep a keyed hash of your IP address, never the address itself, purely to stop abuse of the form, and your browser type.
• Price alerts and event price watches: both need an account. We email the alert to your account's confirmed email address only, so an alert waits until you have confirmed your address. An event watch switches off once its email is sent or the event has passed.
• Host applications: if you apply to list a property we keep the details you give (contact, company, address, the property and its rooms) and when you accepted our host terms, with the IP address the application came from. We do not ask for bank details on the form: once you are approved you set up payouts in Stripe's own form, and Stripe holds those details.
• Technical data: IP address (rate limiting, fraud prevention), browser type, request times.

• Contract: to make and look after the bookings you ask for, and to run your account.
• Legitimate interest: to operate, secure and improve the service, to answer support emails, and to ask for a review of our service after a stay (you can refuse at any time).
• Consent: for non-essential cookies (see the Cookie Policy), for price emails you asked for, and, as explicit consent, for an accessibility request that may include health information.
• Legal obligation: accounting records (six years after the end of the year they relate to), security incident response.

We pass the smallest set of data each one needs:

• LiteAPI, our booking supplier. For a booking it receives the lead guest's first name, last name, email and phone, the first name, last name and email of each room's lead guest, the dates, the hotel and the room, and the payment confirmation from its card form. If you change the name on a booking it receives the new details and any note you add.
• The property, when you book a property that contracts with us directly: your name, email and phone, the stay, any pet details and any accessibility request you agreed to share.
• Stripe, payment processor. Receives card details directly from your browser; we never see the full card number. Stripe also stores a customer record linked to your email when you buy a pass or subscribe, and holds the identity and bank details of hosts it pays out to. stripe.com/privacy.
• Google, in three ways.
  • Sign-in, when you choose it. If you use “Continue with Google”, or accept the optional one-tap prompt we may show when you go to book, Google issues us a signed token carrying your email address, name and profile picture, and Google learns that you visited this site. The one-tap prompt only appears if you accepted the Preferences cookie toggle; declining leaves the ordinary sign-in button, which loads nothing until you click it.
  • Our support mailbox runs on Google Workspace (Gmail), so emails you send us are stored there.
  • Google Analytics, only if you accept analytics cookies: the pages you view, your device and an approximate location, and for a booking its reference number, value, currency, hotel and number of nights; when you are signed in, our internal account number (not your name or email). If you also accept advertising cookies, Google may use the visit to measure our adverts; ad personalisation is always switched off.
  policies.google.com/privacy.
• Anthropic, an AI service we use to sort the support inbox and draft replies for a person to check. It receives the sender's name and email, the subject and the message (shortened), and for a reply about a booking that booking's reference, status, hotel and dates. Every reply is read and sent by a person.
• Resend, our email sender: your email address and the content of the emails we send you.
• Sentry, error monitoring: when something breaks it receives technical details of the error and your account number and role, not your name or email.
• Vercel, hosting: runs the site and sees each request, including your IP address.
• Neon, our database host: stores the data described here.
• Upstash, a fast store for caching and rate limits: IP addresses and a keyed hash of an email address, kept only for the length of a rate-limit window, and short-lived search results.
• GoatCounter, cookieless visitor counting. Receives a hashed IP address (one-way salt, rotated every 8 hours and never retained beyond that window) plus the page URL, referrer and browser string for each page view. No cookies, no cross-site tracking, no profile building. goatcounter.com/help/gdpr.
• OpenStreetMap: our maps load their tiles from OpenStreetMap's servers, which see your IP address, and we look up typed place names with its search service (the text only).
• Trustpilot: our review request links to Trustpilot's public review page. We do not send Trustpilot your details; if you leave a review, Trustpilot's own terms apply.

None of them may sell your data. We will update this list before adding a new processor.

• Account data: until you delete your account.
• Booking records: six years after the end of the year of the stay (UK accounting requirement), then deleted.
• Browsing data (searches, viewed hotels): 12 months from last activity.
• Search log: 90 days.
• Emails we send you: the address and content details for 18 months, then only a record that an email was sent.
• Support emails: our record for 24 months.
• Error reports: 12 months.
• Event price watches: deleted 30 days after the alert is sent or the event has passed.
• Payment provider notices (Stripe webhooks): their content for 90 days.
• Invitations to create an account: 30 days after they expire.
• Host applications we turn down: 12 months after the decision.
• Our record of what our staff did in the admin tools: six years after the end of the year.
• Server logs: kept by our hosting provider for a limited period.

Under UK GDPR you have the right to:

• Access: download your data from your account page (Article 15).
• Portability: the download is a machine-readable JSON file (Article 20).
• Erasure: delete your account at any time from your account page; we ask for your password, or a recent sign-in, first. We then delete your account and what is linked to it: saved hotels, alerts and history, error reports you sent, invitations, email preferences and our records of your support emails (the emails themselves stay in our support mailbox). We keep each booking record for our accounts until six years after the end of the year of the stay, with your name, your companions' names, your contact details, notes and any accessibility request removed. While you have a stay that has not finished, the account cannot be deleted: cancel the stay first (if it can be cancelled) or delete your account after check-out, so the property and our support team can still look after your stay. Our record of what our staff did keeps the action but no longer names you. We delete what we hold; the booking supplier, the property and Stripe keep the booking and payment records the law requires them to keep (Article 17(3)(b) and (e)).
• Rectification: edit your name and email on your account page.
• Restriction / objection: email support@local-hotel.com and we'll act within 30 days.
• Complaint to the ICO: ico.org.uk if you're unhappy with how we handle your data.

Some of the providers above store or process data outside the UK, for example in the European Union or the United States. Email support@local-hotel.com if you would like to know where a provider processes your data and the safeguards that apply.

We send transactional emails (booking confirmations, refund updates, password resets) as part of fulfilling your booking. These are not marketing and you cannot opt out while you hold an active booking with us, because we need to reach you about it.

We only email you about prices if you asked us to. There is an unticked box at sign-up, separate from accepting these terms, and leaving it unticked changes nothing about your account. If you tick it we record when you did and the exact wording you agreed to (PECR / UK GDPR Art. 6(1)(a)). If you later turn it off, we keep that record and note when you withdrew.

That permission covers three things and nothing else: price drops in places you follow, the cities you search for when something worth knowing changes there, and now and then what people have actually paid through the site. No general mailing list, no third-party advertising, and nothing sold or shared. Every one of those emails carries a one-click unsubscribe, and you can change your mind on your account page at any time.

A few days after a stay we may email once to ask for a review of our service. That email has an unsubscribe link; use it and we will not ask again. Emails about your bookings still come as normal.

Price watching is its own thing and needs an account. When you ask us to watch a price, the alert you get is the service you asked for rather than marketing, so it is sent whether or not you ticked the box above, and it stops when you stop watching.

We do not make decisions about you that are based solely on automated processing and that produce legal or similarly significant effects (UK GDPR Article 22). Rate-limit and fraud checks are advisory inputs to human review, not automatic account decisions.

We don't knowingly collect personal data from anyone under 18. Account creation requires confirmation that you are 18 or older (see our Terms of Service). If we learn that we have collected data from a child, we will delete it.

If a personal-data breach is likely to result in a high risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware (UK GDPR Article 33) and notify affected users without undue delay (Article 34). Our internal first contact in an incident is support@local-hotel.com.

Passwords are hashed with bcrypt (cost factor 12). All traffic is HTTPS-only with HSTS preload. We use CSRF protection on all mutating endpoints, rate limiting on sensitive endpoints, and standard browser security headers (CSP, X-Frame-Options).

We'll email registered users 30 days before any material change to this policy. Minor wording fixes are pushed silently; see the “Last updated” date above.