Privacy and cookies
Who we are
bookingboxdaily.com and whobooksyou.com are run by KitsiGuard (Pty) Ltd, registration 2019/387087/07 (“we”). We decide what is collected and why, so under UK GDPR, the GDPR and POPIA we are the controller.
To reach us about your data, write to comms@bookingboxdaily.com or use the contact form below.
What we keep, and why
When you look up a hotel: the hotel name and city you typed, and Google’s public result for them. We need these to show you the answer, and Google’s result also becomes part of the daily record for that hotel. Basis: our legitimate interest in running the free lookup.
Your IP address, only as a code that changes every day and can’t be turned back into the address. It lets us limit free checks and stop abuse. Basis: legitimate interest in keeping the service available and its cost under control.
When you look up a hotel, we also ask for your email address and keep it with that request: the hotel and the dates. If you choose 3 free mornings, we send one email to confirm it was you; nothing starts until you confirm, and a request you never confirm is deleted after 7 days. Basis: your consent, which you can withdraw with the unsubscribe link in the email.
If you tick the newsletter box: your email address, the time you ticked it and the exact wording you were shown, kept until you withdraw. Basis: your consent. The 3 mornings never depend on it.
If you have an account: your email address, your name and the hotels you watch, so you can sign in and get your morning report by email. Basis: our contract with you. Paid members can switch the morning email off in Settings.
If you set a password, our sign-in provider (Supabase) stores it only as a one-way hash; we never see it.
When you ask for a sign-in link, we keep your email address and the time for 90 days, to limit how many links one address gets. Basis: legitimate interest in keeping accounts safe.
Our security records (sign-in attempts, bot checks, payment notices) keep only scrambled identifiers, a keyed hash of your email or of your visit, never the address itself, for 90 days, to stop abuse. Basis: legitimate interest in keeping accounts and payments safe.
When you ask us to add a city, or write to us: your email address, the city or your message, so we can answer. Basis: legitimate interest in answering you.
We don’t sell your data, and we don’t use it for advertising.
Who handles it
Vercel (hosting and the code that answers you; United States, Washington DC).
Supabase (our database; European Union, Frankfurt).
Resend (sends our emails; European Union, Ireland).
Cloudflare (the “are you a person” check, only when the page asks for it; Cloudflare’s global network).
DataForSEO (runs the Google search for us; it receives the hotel name and city only, nothing about you).
Healthchecks.io (tells us if the morning run fails; it receives no personal data).
Paddle (our reseller and Merchant of Record: it takes payments and keeps your billing details; we never see your card).
Zoho (our mailbox at comms@bookingboxdaily.com, for messages you send us).
Where a provider is outside the UK, the EU or South Africa, the transfer is covered by that provider’s standard contractual clauses (with the UK addendum).
How long
Google’s full result for a lookup: 90 days. The prices we read from it stay as part of the hotel’s record; they say nothing about you.
The lookup log with the daily IP code: 90 days.
Security records, with their scrambled identifiers: 90 days.
A sign-in link request: 90 days.
A request to watch a hotel that you never confirm: 7 days.
Your email after the 3 mornings: 12 months, or until you unsubscribe, whichever comes first. Unsubscribing deletes it straight away.
A city request: 12 months. A message you send us: 12 months.
Your account: while it is open. Ask us to close it and we delete it.
Vercel keeps its own request logs, which include IP addresses, for a short time under its own policy.
Your rights
You can ask to see the data we hold about you, have it corrected or deleted, object to how we use it, or take a copy. Write to comms@bookingboxdaily.com or use the contact form below; we answer within one month.
You can complain to a regulator: the ICO in the UK (ico.org.uk), the CNIL in France (cnil.fr), or the Information Regulator in South Africa (inforegulator.org.za).
These services are not meant for anyone under 18.
Changes
If this page changes, the date at the top changes with it. Last updated Fri 6 Nov 2026.