Privacy policy

Who is responsible for your data

The data controller is AROYO BRACHA LTD.

What we collect

You give us

• Name, email address, phone number
• Booking details: Service, dates, number of guests, ages of children
• Special requests: dietary needs, accessibility needs, medical notes you choose to share, and anything else you tell us matters for your trip
• Passport or ID details, only where a Host or the law requires them for a specific booking, and only for that booking
• Messages you send us, on the Platform, through our contact form, by email, or on WhatsApp
• What you write to our AI travel assistant, and your answers to its trip planner
• The lists you save, where the Platform offers them
• Reviews and photos you choose to publish
• Account details, if you create an account

What we need to make a Booking. To make a Booking we need your name, your contact details and the booking details: the Service or hotel, dates, number of guests and ages of children. For a Hotel Booking, the hotel may also ask for the names of the other adult guests. Passport or ID details are needed only where a Host or the law requires them. You do not have to give us these details, but without them we cannot make or manage the Booking. Everything else in this list is up to you.

We generate or receive

• Booking history and payment status
• Support conversation history
• Technical data: IP address, device and browser type, pages viewed, referring page, and how you move through the site
• If session replay is enabled: recordings of your interactions with pages on our site: clicks, scrolling, mouse movement and form field interactions. Payment fields and password fields are masked.
• If you arrived by scanning the QR code of a partner venue, which venue sent you

We do not store your full card number. Payments are handled by our payment processor and card details never reach our servers.

For a hotel booking

• The name of the lead guest in each room, and the names of the other adult guests if the hotel asks for them
• The hotel, your dates, the number of rooms and guests, ages of children, and the room and rate you choose
• Special requests for the hotel, such as bed type, a late arrival or accessibility needs
• Your phone number and email address, so we can send you the quote and the confirmation

You pay the hotel for your stay at the hotel, and we receive no card data for the room. If we ask you to save a card on our secure payment page (clause 23.6 of the Terms), our payment processor keeps it, as described in section 4, and your card details never reach our servers: Stripe keeps it with your name and the booking details, and with the line you agreed to and the time you agreed, as the record of your consent. We see the card's brand and last four digits, never the full number. When you send a room request to a Partner Hotel (clause 23.12 of the Terms), you save a card in the same way, and we also receive the email address and phone number you give us.

When you ask our AI assistant

When you use our AI travel assistant, we receive the messages you write, and the assistant writes its answers with a language model from Anthropic (section 4). To answer you, we send Anthropic your message and the relevant part of the conversation, with the trip plan you are working on and, if you turned them on, your saved preferences. If you use the trip planner, its questions ask for your dates or the number of days, who is travelling, the number of adults and children and the age of each child, the airport you land at, whether you stay in one place, and what you enjoy; we turn your answers into a question that we send to Anthropic like any other message. We never ask for the names of children. Our servers receive your messages as you wrote them, but keep only a fingerprint of each one, not its text, unless you turned on saving your conversations. To see what travellers ask about and to improve the assistant, we also keep a record of each answer that holds none of your words: the topics of your message from a fixed list (such as the town, the kind of trip, the month, the number of days and who is travelling), the Services and guides the answer showed, the tools the assistant used, and how the answer went (its length, speed, estimated cost and any error). Before we send a message to Anthropic, we automatically remove the email addresses, phone numbers and card numbers we recognise in it. This reduces what is sent but does not make a conversation anonymous, so please do not write payment details, passwords or sensitive personal information, such as health details, in the chat. If you are signed in and ask about your bookings, the assistant reads their reference, Service, date and status to answer you. To show cards about other places or about routes, it can send Google Maps a short search, such as the kind of place and the town, without your name or contact details. If you share a conversation, only its title (your first question, or the name you gave it) and a link to our assistant are shared, and only with the people you choose. The conversations you pin and the names you give them are kept only on your device. We do not use your conversations, your preferences or your ratings of its answers to train the assistant.

If you choose to save. If you have an account, you choose in the assistant's privacy settings what it keeps. Each choice is off until you turn it on: saving your conversations to your account; using saved travel preferences, which the assistant can suggest and you confirm one by one; saving automatically a preference you state clearly in the chat, which you can then edit or undo; and searching your saved conversations when you ask about an earlier one. Saving a preference automatically and searching your saved conversations are newer choices: the choices you made before they existed stay as they were, and turning either of them on asks you first to accept the updated notice (section 12). A preference can only be one of these: your budget, travel pace, languages, interests, destination, travel dates or number of travellers. We never save sensitive information as a preference. You can also save a plan yourself, with the "Save trip" button, with or without an account, and this does not depend on the choices above: the experiences in it are saved to one of your lists, each with its day and number of travellers (see "When you save a list"). Saved conversations, preferences and trip plans, and the earlier versions of a plan that we keep automatically when you change it, are stored encrypted. Without an account we do not save your conversation: it exists only while the page is open, and its plan is kept only if you save it with the "Save trip" button.

When you save a list

Where the Platform offers lists (clause 25.1 of the Terms), we keep your lists: the name of each list and, for each Service in it, the choices you saved, such as the date, time and number of travellers, and any note or discount code you entered. For a transfer, a list also keeps what you entered in the transfer form: the route, the addresses where you are picked up and dropped off, flight numbers, the note for the driver (which can include the age and height of a child who needs a seat), and your name, email address and phone number. When you book a Service from a list, we also keep a record linking the list to that booking and its status and, if you book without an account, the contact details you gave for it. The heart on a Service's card or page saves only the Service. A trip you save from our AI travel assistant is saved as a list: for each experience, its day and the number of adults, children and infants, with the plan's notes for each day and links to rides; never the ages of children, hotels or prices. If you book without an account, the booking form for the next experience in the same list can be filled in with the contact details of your last booking from that list: we read them from that booking when you open the form, and we do not store them again. When you share a trip, you send the text yourself, from your device; it holds the name of the trip, its dates, the number of travellers and links to its Services. A list made without an account is linked to your browser by the tm_travel_guest cookie, and moves to your account if you sign in. The contents of your lists, and the contact details we keep for a booking, are stored encrypted. We use them to keep your lists for you, to show you a price for each saved Service, to let you book each one, and to let our AI travel assistant answer you about them. When the assistant reads your lists, we send Anthropic the list names, your saved choices and the status of any booking made from them, without your contact details, addresses, flight numbers or notes. Hosts do not see your lists: a Host receives only the booking you make with it.

A room request to a Partner Hotel

When you request a room at a Partner Hotel whose price is on request (clause 23.12 of the Terms), we receive your name, email address and phone number, the dates, rooms, bed setup and guests you choose and a name for each room, and then the hotel's answer: its confirmation number, an alternative it offers, or a decline. We pass the request to the hotel and keep a record of it and of the emails we send about it.

When you contact us

Our contact form sends your name, email address, phone number if you give it, your message, the language of the page and the page you wrote from to Formspree, which delivers them to us by email (section 4). The form also offers to open WhatsApp with your message already typed; nothing is sent until you send it in WhatsApp yourself.

Car rental and flights

We do not rent cars or sell flights ourselves. Our car rental search sends the offices, dates and times you choose to the website of Top Rent A Car, which opens in a new tab: you book there, and you give your details, including your driving licence, to Top Rent A Car directly, under its own terms and privacy policy. Our flights page links to Skyscanner in the same way. We do not receive what you enter on their websites.

Partner venues

Some venues that work with us, such as restaurants and hotels, show a QR code that leads to our site. If you scan one, we remember in your browser, for 90 days, which venue sent you, so that the venue can be paid a commission if you book. The venue sees only how many bookings and how much commission came through its code, never your name, your contact details or the details of your booking.

Reviews of a transfer

If you send a review of a transfer through our review link, we receive the name you give, your rating, what you wrote and, if you add them, the places you travelled between. We publish the review as you sent it (clause 15.1 of the Terms).

Why we use it, and our legal basis

Marketing is separate and optional. Accepting our Terms does not sign you up for marketing. You opt in, and you can unsubscribe in one click in any marketing email. Booking emails are not marketing and continue regardless, because you need them.

Hotel bookings. We use your details to check rates and availability, send you a quote, book the stay you confirm through Expedia TAAP, and handle changes, cancellations and any late cancellation or no-show fee. The legal basis is performance of a contract (Art. 6(1)(b)), including what you ask us to do before booking, such as checking availability and sending a quote. If you give us the names of other guests, we use them only to book the stay they are part of, based on our legitimate interest in completing the booking you asked for (Art. 6(1)(f)). Please point them to this policy. Requests that reveal health information, such as accessibility needs, are passed on only with your explicit consent (Art. 9(2)(a)).

Hotels, photographers and business contacts. When we ask a hotel, its brand or owner, or a photographer for permission to use photos, we use contact details published on their website or given to us by the hotel, and keep the emails we exchange: the approver's name, role and company, and the names of photographers we credit. We use them to request and record the permission, to credit photographers and to handle withdrawals and removal requests. Legal basis: our legitimate interest in using photos lawfully and being able to prove it (Art. 6(1)(f)). For photographer credits, it is also our legal obligation to name them, which follows from the author's right to be named under Bulgarian copyright law (Art. 6(1)(c)). We keep them while we use the photos and for 5 years after, or longer while a claim about the photos is open. Our email provider stores them for us, and we show them to a rights holder, lawyer or court only if our permission is disputed.

Your right to object. You can object at any time to our use of these details by writing to hello@makeyourtravell.com. If you appear in a hotel photo on our site, write to us and we will remove it within 48 hours.

Who we share it with

The Host providing your Service. Your name, phone number, guest count, ages of children where relevant, and any special request that affects delivery. Hosts receive what they need to serve you and no more. Hosts are independent controllers of the data they receive.

Our payment processor. Stripe (Ireland, EU) handles card payments and refunds. Where the Deposit option is used, the cash portion is paid directly to the Host and we receive no payment data for it.

Expedia, our hotel booking partner. We book most hotel stays through Expedia TAAP, the travel agent program of Expedia Group, of which we are a member. To book your stay and manage the booking, we pass Expedia the guest names, dates, number of guests and ages of children, the room and rate, your special requests for the hotel (any that reveal health information only with your explicit consent) and, where the booking needs it, a contact phone number or email address. Unlike the service providers listed below, Expedia does not act on our instructions: it is an independent controller of the details it receives. Our agreement with Expedia allows it to use them only for fulfilling and supporting the booking, providing optional services we choose to use, paying our commission and reconciling accounts, handling complaints, analysing and improving its booking services, preventing fraud, calculating and reporting taxes on the stay, meeting its obligations under the agreement, its privacy statement and the law (including requests from law enforcement and tax authorities), and a merger or sale of its business. Expedia's privacy statement explains how Expedia itself handles personal data:

The hotel. The hotel receives your booking details from Expedia, and from us when we pass on a request or a change, and uses them to host you. A Partner Hotel (clause 23.12 of the Terms) receives them from us directly, not through Expedia. It is an independent controller of the data it receives and of what it collects from you at the hotel, and handles it under its own privacy policy.

Meta (Facebook and Instagram). Only if you accept advertising cookies, the Meta Pixel tells Meta which of our pages you view and when you start a booking, book or contact us, so that we can measure our ads and show relevant ones. Meta and we decide together on collecting this, as joint controllers; Meta then uses it as its own controller, under its own privacy policy.

Partner venues. A partner venue that sent you to us (section 2) receives only how many bookings and how much commission came through its code.

Service providers acting for us

These act on our instructions under data processing agreements.

Authorities, where the law or a court order requires it.

We do not sell your personal data. We share it for advertising only through the Meta Pixel, and only if you accept advertising cookies.

Sending data outside the EU

• an adequacy decision where one exists. Israel has an EU adequacy decision, so sending your details to Israel is treated as equivalent to sending them within the EU; or
• Standard Contractual Clauses approved by the European Commission, together with additional safeguards where needed.

How long we keep it

We keep personal data only as long as it is needed for the purpose it was collected for: booking and payment records, for the retention periods required by Bulgarian accounting and tax law; sensitive details such as passport data or health notes, deleted shortly after the Service is delivered; marketing contact details, until you unsubscribe; and everything else, until it is no longer necessary or you ask us to delete it.

Reviews you published stay on the site indefinitely, unless you ask us to remove yours.

Hotel bookings. We keep the quote you confirmed, the booking confirmation and the record of any fee we charged as booking records, for the retention periods for booking and payment records set out above. Expedia and the hotel keep what they receive for the periods set in their own privacy policies. A card saved to hold a Hotel Booking is removed from Stripe 14 days after check-out, or 7 days after a cancellation with no fee (clause 23.6 of the Terms); the record of your consent is kept with the booking records.

Permission records for hotel photos. The emails in which a hotel, its brand or owner, or a photographer gives or withdraws permission to use photos, with the approver's name, role and company: while we use the photos and for 5 years after, or longer while a claim about the photos is open (see section 3).

The AI assistant. We save a conversation only if you turned on saving in your account; otherwise it exists only while the page is open. Saved conversations are deleted 90 days after the last message saved in them. Saved preferences are deleted 12 months after you save them, and details about a specific trip 30 days after that trip ends. A saved trip plan is deleted 90 days after your last change if it has no dates, or 30 days after it ends if it has dates; opening it does not extend this. You can delete any of them sooner. Turning off saving deletes your saved conversations and the preferences drawn from them, turning off saved preferences deletes all your preferences, and neither deletes your saved trip plans; deleting all your saved AI data also deletes your saved trip plans. The visitor session of someone without an account, which counts the messages they send and links their lists to their browser, ends 30 days after it starts and holds no conversation. A record of your privacy choices, which holds no conversation, is kept for one year, and a note that you deleted a conversation or a trip plan, which stops a late answer from bringing it back, for 90 days. A record of an answer, which holds none of your words (section 2), is deleted 30 days after the answer; after that we keep only totals by day, which say nothing about any one person. Anthropic, our hosting providers, our security logs and our backups may keep data for their own periods, which can differ from these.

Saved lists. A list made without an account is deleted when your visitor session ends, 30 days after it started; opening or changing the list does not extend it. Lists in your account have no fixed end date: we keep them until you ask us to delete them or your account is deleted, and archiving a list does not delete it. What we keep so that you can undo a change to a list is deleted after one day. A booking you make from a list is kept with the booking and payment records, as set out above.

Room requests to a Partner Hotel. A request that becomes a Hotel Booking is kept with the booking records. A request that does not, because the hotel declined it or you did not accept its alternative, is deleted 12 months after it closes.

Partner venues. The note of which partner venue sent you stays in your browser for 90 days, and is then deleted.

Messages through our contact form. We keep your message and our reply as long as we need them to help you, as the first paragraph of this section sets out. Formspree, which delivers the message, may keep a copy for its own period.

Cookies and tracking

Your rights

You can ask us to:

Email hello@makeyourtravell.com. We reply within one month. There is no charge.

For the AI assistant you can do much of this yourself, in its privacy settings: see and export your saved conversations, preferences and trip plans, edit or delete a preference, delete a conversation, turn each choice off, or delete all your saved AI data at once. These settings open from My trip, also when the assistant itself is unavailable. This does not delete your booking and payment records, which we keep as section 6 sets out.

You can manage what you save yourself in My trip: book it or remove it. The export and delete buttons in the AI assistant's privacy settings do not include your lists: to get a copy of your lists, or to have a list deleted, email us at the address above.

For the details Expedia or the hotel hold about your stay, you can also contact them directly under their own privacy policies. If you are not sure whom to contact, write to us and we will help.

You also have the right to complain to a data protection authority. In Bulgaria, where we are registered, that is the Commission for Personal Data Protection. You can also complain to the data protection authority in the country where you live or work. We would welcome the chance to sort out your concern first, but you do not have to contact us before you complain.

Children

Security

Automated decisions

We do not make decisions about you by automated means alone, and we do not profile you in any way that has a legal or similarly significant effect.

The suggestions of our AI travel assistant are recommendations you are free to ignore (clause 24.2 of the Terms). If you turn on saved preferences, the assistant uses them to suit its suggestions to you, and you can turn this off at any time. Its suggestions are not a decision about you and have no legal or similarly significant effect on you.

AI assistant and your privacy

We send your question, relevant conversation context and permitted private context to Anthropic to answer travel questions. The host content assistant also uses Anthropic. OpenAI is used separately for approved website copy translation. Avoid sharing sensitive information. Removing obvious contact or card details is minimization, not anonymization. We do not collect raw chat feedback for automatic learning.

Guest chats stay in the open browser conversation. Account chat saving is optional and off by default; saved chats expire 90 days after the last saved turn. Personalization is a separate choice. Preferences expire 12 months after saving, and trip memories expire 30 days after the trip ends. Automatic saving of explicitly stated preferences and searching saved chats are separate, new consent choices, initially off. Existing choices are preserved; enabling either new choice requires acceptance of the updated notice.

Saving a trip requires your explicit action and is independent of chat saving and memory choices. Saved trips and their automatically recorded edit versions are encrypted. Undated trips expire after 90 days without an edit; dated trips expire 30 days after their end. Reading a trip does not extend its expiry.

Account privacy controls remain accessible when AI is unavailable. You can inspect, export, correct or delete saved data, disable recall or automatic memory, and withdraw optional consent. Contact hello@makeyourtravell.com for restriction or other rights requests. Turning chat saving or personalization off deletes the corresponding chats or memories; saved trips are managed separately. Erase all AI data also removes saved trips. Booking and payment records have separate purposes and retention.

Consent-change records contain choices, not conversations, and expire after one year; deletion markers expire after 90 days. Provider, security-log and backup retention can differ from these application periods. Contracts, international transfers and actual provider retention require operational review; we do not promise zero retention or EU-only processing. Analytics requires the relevant cookie consent and never includes chat text or saved private content.

Changes to this policy

We may update this policy. We will publish material changes prominently on the Platform and update the date at the top. Where a change requires your consent, we will ask for it.

Contact

Questions, requests, or anything about your data:

hello@makeyourtravell.com · +359 87 934 3468

AROYO BRACHA LTD, Petar Parchevich 29, Sofia 1000, Bulgaria