How GetMyHotels handles privacy, payments, and travel regulation

EU Regulation 2016/679 and the UK GDPR govern how we process personal data of users in the EEA, UK, and Switzerland. Our lawful bases, retention windows, transfer mechanisms (SCCs + adequacy where available), and your rights of access, rectification, erasure, restriction, portability, and objection are documented in the privacy policy.

• Granular consent at signup + persistent cookie banner
• Data-subject access / portability / erasure self-serve
• Data Protection Impact Assessment on every new processing activity
• Sub-processor inventory with SCC clauses for all transfers

We honor the Do-Not-Sell-or-Share opt-out for targeted advertising, treat the Global Privacy Control (Sec-GPC: 1) header as an implicit opt-out, and provide CCPA-aligned access + deletion mechanisms for all California residents — extended to all US users for parity.

• /privacy-choices opt-out (no login required)
• Sec-GPC browser signal honored server-side
• Sensitive-info handling limited to what each booking strictly requires
• 45-day verifiable request response window

India's DPDPA Rules 2025 were notified in November 2025; we treat the act as binding for all India-resident users today. Substantive obligations (grievance officer, breach SLA, Consent Manager integration) come into force in November 2026 + May 2027.

• Consent ledger captures every grant + withdrawal with timestamp + policy version
• Verifiable parental consent path for users flagged as Indian minors
• Hindi + regional language privacy notices
• Tracked milestones in our internal DPDPA roadmap

Lei Geral de Proteção de Dados (Law 13.709/2018) applies to Brazilian users. Our privacy ledger, breach-notification process, and data subject rights match the GDPR baseline — LGPD requirements are a subset.

• Portuguese privacy notice (pt-BR locale)
• ANPD-aligned breach reporting workflow
• Lawful-basis register kept current

16 CFR Part 464 ('Trade Regulation Rule on Unfair or Deceptive Fees'), effective May 12, 2025, applies to short-term lodging. We disclose total price plus any mandatory fees at the earliest point in the search journey where the supplier has returned them; where the supplier has not, we render an unambiguous '+ taxes & fees' disclosure adjacent to the headline rate.

• All-in nightly price surfaced on hotel cards when supplier returns it
• Adjacent '+ taxes & fees' disclosure when not yet known
• Full itemized breakdown at checkout and in the booking confirmation

Flight result cards headline the total fare (taxes and government fees included), per DOT's full-fare advertising rule. For flights departing the EEA, UK, or Switzerland we surface a passenger-rights disclosure linking to the European Commission's EU 261 explainer.

• Total fare (not base fare) headlined on every flight card
• EU 261 rights link rendered at point of sale for in-scope departures
• Cancellation + refund policies surfaced before payment

We never see raw card numbers. Stripe handles every payment under its PCI DSS Level 1 certification. Our integration uses hosted payment elements + tokenized references so we sit in the lowest PCI scope (SAQ-A).

• Stripe tokenized payments only
• No card data in application logs, databases, or backups
• TLS 1.2+ enforced on every payment surface

The GetMyHotels mobile app ships a privacy manifest (Apple PrivacyInfo.xcprivacy), targets Android API 36 ahead of the August 31, 2026 Play deadline, and provides in-app account deletion (Apple 5.1.1(v) / Play account-deletion URL requirement).

• Sign in with Apple offered alongside Google (Apple 4.8)
• Account deletion in-app + at /account/delete on the web
• UGC report affordance on chat messages (Apple 1.2)
• Privacy manifest declares required-reason API usage + tracking domains

Our design system aims for WCAG 2.2 Level AA across web and mobile. New screens are reviewed for color contrast, keyboard navigation, semantic structure, focus states, and screen-reader labeling before merge. Existing screens are remediated on a rolling basis.

• Semantic HTML + ARIA labels on every interactive surface
• Color contrast verified against the design tokens
• Keyboard navigation tested on every release
• VoiceOver and TalkBack labels on mobile