FlipMyStay Privacy Policy (v2025-10-28)

Last updated: 28 October 2025

This Privacy Policy explains how 0xB Technologies Ltd, trading as FlipMyStay (“FlipMyStay”, “we”, “us”) collects and uses your personal data when you use our service.

1) What we do

You forward a hotel confirmation email to save@flipmystay.com. We parse the booking details and monitor for a cheaper like-for-like rate. If we find a better price we will notify you and let you know how to rebook it to take advantage of the better rate.

2) Data we collect and where it comes from

• From you (by email): your name, email address and the contents of the confirmation you forward (hotel, dates, room/board, price, cancellation terms, booking ref, party/ages if present)
• Derived data: watch identifiers, rate comparisons, currency, provider references, alert history
• Website/app data: your cookie/consent choices; strictly-necessary cookies; analytics only if you consent
• Support: messages you send us

We don't intentionally seek special-category data. If your forwarded email contains sensitive content (e.g., medical notes, passport scans, card images or attachments), we minimise by discarding attachments, redacting obvious payment data, and purging the raw message within 24h

3) Why we use your data (lawful bases)

If you don't provide the data marked above, we may be unable to deliver the service.

4) Who we share data with

We do not sell your data. We use trusted processors under Data Processing Agreements to run the service, including:

• Infrastructure & email routing/delivery
• Web/app hosting and security
• Product analytics (EU region, consent-based)
• Rate/booking partners to check availability and generate checkout links

Independent controllers: Any new booking you choose to make is with a third-party provider or hotel; their privacy policy applies to that booking.

We maintain a current vendor list at flipmystay.com/legal/vendors.

5) International transfers

Some providers process data outside the UK/EEA. We protect transfers using EU Standard Contractual Clauses, the UK IDTA/Addendum, and/or participation in the EU-US Data Privacy Framework (and UK extension), as applicable.

6) Cookies and analytics

We use a cookie banner/CMP. Non-essential cookies (e.g., analytics) load only after consent. You can change your choice any time via Cookie settings in the footer. See our Cookie Policy for details.

7) Retention — how long we keep data

• Raw forwarded email: kept up to 24 hours for parsing, then deleted
• Active watch data: until hotel checkout + 180 days, then deleted
• Service logs: kept for 12 months
• Marketing suppression/unsubscribe: kept indefinitely to honour your choice
• Support tickets: 24 months

8) Security

Encryption in transit and at rest, least-privilege access, audit logging, secured secrets, and vendor due-diligence. We assess incidents promptly and notify regulators/individuals where legally required.

9) Your rights (UK/EU GDPR)

You can request access, rectification, erasure, restriction, portability, or object to processing based on legitimate interests. For marketing, you can withdraw consent at any time using the unsubscribe link.

We may need to verify your identity. We aim to respond within 30 days (can extend by up to 2 months for complex requests). To stop monitoring immediately, use the cancel/stop link in our emails or email us at privacy@flipmystay.com.

10) Children

Our service is for adults 18+. We don't knowingly process children's data.

11) Automated decision-making

We do not carry out decisions based on automated processing that produce legal or similarly significant effects about you.

12) Complaints

If you're unhappy with how we handle your data, email privacy@flipmystay.com.

You can also complain to a data protection authority. In the UK: Information Commissioner's Office (ICO), ico.org.uk.

13) Changes

We will post updates on this page and change the "Last updated" date. For material changes, we'll notify you by email.

14) Contact