Privacy notice

Who we are

TravelHood is operated by {company_legal_name}, {company_postal_address}, a company based in Greece. We decide what happens to your data, so under the GDPR we are its controller.

Write to about anything in this notice. A person reads every message.

What TravelHood does today

TravelHood is not open yet. Today you can read about it, join the waitlist, and ask us never to list or email your business. There are no accounts yet. Before accounts open, we will update this notice.

TravelHood is for businesses and the people who work in them. It is not meant for children.

When you join the waitlist

We keep your email address, what you asked for (the search you typed, or that you want to set up or claim a profile), when you agreed and the wording you agreed to.

We use them only to send you a link to confirm your address, then one email when TravelHood can do what you asked. We never add you to a newsletter. Our legal basis is your consent, which you give when you send the form and confirm the link. You can withdraw it at any time by writing to .

If you do not confirm within 30 days, we delete it. If you confirm, we delete it at the first of these: 12 months after you confirmed, 90 days after we send you the one email about it, or within a day of you opening a TravelHood account with that address. If you ask us to delete it, we do it within 30 days.

When you ask us to remove your business

We send one email to the address you give, with a link to confirm. The link works once and expires after 7 days. We do not store the address itself. We keep a fingerprint of it (a one-way code that cannot be turned back into the address), a partly hidden copy such as ow•••@gmail.com, the business's own domain if it has one, and the date.

When you confirm, we add the fingerprint, and the domain if there is one, to our do-not-contact list, and we delete any waitlist entry for that address. An address at a free email provider such as Gmail blocks only that address, never the whole provider.

We keep the do-not-contact list for good, because it is what stops us showing or emailing that business again. It holds only fingerprints, domains, a reason and the date. The request itself, with the partly hidden copy, is deleted 30 days after the link is used or expires. Our legal basis is our legitimate interest in respecting your request not to be contacted.

Businesses that have not joined

Today TravelHood holds no information about businesses that have not joined. When that starts, these rules apply, and we will update the date of this notice first.

What we keep: the business name, website, location, activity types, a short description, the business contact address it publishes, and the page and date we took each detail from.

Where the data comes from: the business's own public website. For each business we record the page and the date we took the details from.

Why: so that a named TravelHood member can send that business one request, once. Our legal basis is our legitimate interest in letting travel businesses reach each other, which we have weighed against the business's own interests. The member sees the business name and website, never its contact address.

How long: we check each record again after 90 days before showing it, and delete it after 12 months in which it appeared in no search and no request.

Your choice: every email we send to such a business has a one-click link that stops all TravelHood email to that address and its domain, for good. You can also use Remove my business, or write to .

When you visit the site

The site sets no cookies. It remembers in your browser's local storage whether you chose the light or dark theme and what you answered about analytics. Those choices stay on your device and are never sent to us.

Cloudflare hosts the site and Supabase runs our forms. Like any host, they handle your IP address to deliver pages and block attacks. We do not store your IP address. To stop abuse of the forms, we keep a one-way code made from it for 2 days, then delete it.

In your browser, we use Google Analytics only if you press Allow analytics. It counts which pages are visited, sets no cookies on this site, is not used for ads, and we keep its data for 2 months. Google receives your IP address to make the count. You can change your choice at any time under “Analytics choices” at the bottom of every page. Separately, our server sends Google Analytics a count of confirmed sign-ups and removals. Those counts carry nothing that identifies you: no email address and no IP address.

The check that you are a person

When you open the waitlist or removal form, it loads Cloudflare Turnstile to check that you are a person and not a bot. Nothing loads before you open a form, and it sets no cookie on our site. Cloudflare may store data under its own domain, challenges.cloudflare.com. We receive only a pass or fail result, which our server checks with Cloudflare. Cloudflare, Inc. does this on our behalf, as our processor.

When you write to us

Messages to reach the founder's mailbox. We keep them only as long as we need to answer you and to show that we did.

Who else handles your data

Only the people who run TravelHood can see your data. We never sell it, and we never share it for anyone's marketing. These companies handle it for us, under contracts that bind them to our instructions:

• Supabase, Inc. stores our database, in the EU (Ireland).
• Resend, Inc. sends our emails from its EU region (Ireland). It handles your address and what the email says, including any search you typed.
• Cloudflare, Inc. hosts the site and runs the check that you are a person.
• Google LLC runs Google Analytics. It receives the page counts you allow and our server's counts of sign-ups and removals.

These are US companies. Where they may reach data from outside the EU, they rely on the EU's standard contractual clauses or the EU–US Data Privacy Framework.

Your rights

You can ask for a copy of your data, ask us to correct it or delete it, ask us to stop using it, or ask for it in a format you can take elsewhere. You can withdraw your consent, and object to how we use your data, at any time. Write to . We answer within 30 days, and when you ask us to delete your data, we delete it within 30 days.

If you think we handled your data wrongly, you can complain to the Hellenic Data Protection Authority (www.dpa.gr), or to the data protection authority where you live or work. We would like the chance to put it right first, but you do not have to ask us before you complain.

We make no decision about you by automated means alone.

Changes to this notice

When we change this notice, we change it here and update the date at the top.