Privacy Policy

1. What we collect

We only collect what we need to run this website and arrange your travel:

• Account details: your name, email address, optional phone number, and a securely hashed password. We never store your password itself.
• Google sign-in details: if you use Google, we receive your name, email address and a Google account ID. We do not receive your Google password.
• Enquiry details: what you tell us about your trip, such as destination, dates, number of travellers and your message.
• AI guide conversations: if you use the AI guide, we store your questions, its answers and the cost of each reply.
• Technical records: your IP address, browser details and the pages or actions you request, which we use to keep the site secure.

2. How we use it

• To create and secure your account, including sending verification and password reset codes.
• To reply to your enquiries and arrange the travel you ask for.
• To answer your questions through the AI guide.
• To protect the site, prevent abuse and investigate problems.
• To send you travel offers, but only if you ticked the box to receive them. You can opt out at any time.

We do not sell your personal information.

3. Who we share it with

We use trusted service providers to run the site. They handle your information only so that they can provide their service to us:

• Supabase, which hosts our database.
• Resend, which delivers our emails.
• Google, if you choose to sign in with Google.
• Anthropic, which provides the AI behind the AI guide. Your questions and the country information are sent to it to produce an answer.
• Our hosting and caching providers, which run the website and its background services.

When you ask us to arrange travel, we share the details needed with the airlines, rail, bus and cruise operators, hotels and other suppliers involved. We may also disclose information when the law requires it.

4. Cookies

We use only the cookies this site needs to work. We do not use advertising or tracking cookies.

• hgt_session keeps you signed in. It lasts for up to 7 days, or 12 hours for staff.
• hgt_csrf protects your account from forged requests. It lasts until you close your browser.
• hgt_oauth keeps Google sign-in secure. It lasts for 10 minutes.

If you block these cookies, you will still be able to read public pages, but you won't be able to sign in.

5. How long we keep it

We keep your information for as long as we need it for the purposes in this policy, including keeping your account open, handling your travel, and meeting legal, tax and accounting duties. When we no longer need it, we delete or anonymise it. Password reset and verification codes expire after 10 minutes.

6. How we protect it

We encrypt connections to our database, store passwords only as hashes, limit repeated sign-in attempts and restrict access to personal information. No online service can promise complete security, so please use a strong password that you don't use anywhere else.

7. International transfers

We and our providers operate in more than one country, and our database is hosted in the European Union. Your information may be processed outside the country where you live, including when suppliers abroad need it to deliver your trip.

8. Your rights

Depending on where you live, you may have the right to:

• ask for a copy of your personal information;
• correct information that is wrong;
• ask us to delete your information;
• object to or limit how we use it;
• withdraw your consent, including for marketing, at any time;
• complain to your local data protection authority.

To use any of these rights, contact us using the details below. We may need to confirm your identity first.

9. Children

This website is for adults. People under 18 should not create an account or send us their details. A parent or guardian can make travel enquiries for a child.

10. Changes to this policy

If we change this policy, we will update it here and change the date at the top. For important changes, we will tell you by email or on the site.