Privacy policy

Reservado is operated by Digitalne storitve, Jorg Cimperman s.p., Zelena pot 23, 1370 Logatec, Slovenia, registration number 9814485. We are the controller of your personal data under the EU General Data Protection Regulation (GDPR). Contact us at [email protected].

• Account: your name, email address and profile photo from Google when you sign in.
• Bookings: what you book, dates, guests, prices, and your notes to the concierge.
• Traveller details for flights: names, date of birth, email and phone number, as airlines require.
• Payments: payment status and amounts. Card details go straight to Stripe; we never see or store them.
• Crypto: your wallet address and the on-chain transactions of your payments.
• Messages: your support chats and conversations with the AI concierge.
• Technical: IP address and request data, used to keep the service secure and to limit abuse.

When you choose Continue with Google, we ask Google only for the basic sign-in permissions (openid, email and profile). With your consent, Google shares with us:

• your name,
• your email address,
• your profile picture,
• a unique Google account identifier.

How we use it: only to create your Reservado account and keep it secure, to recognise you when you sign in again, to show your name and picture in your account, and to send you emails about your bookings and support requests. We do not access your Gmail, contacts, calendar, Drive or any other Google data.

How we store it: in our database in Frankfurt, Germany, protected by encryption in transit and access controls, for as long as your account is open. When you delete your account, it is deleted.

How we share it: we do not sell Google user data, we do not use it for advertising, and we do not use it to train artificial intelligence or machine learning models. We share it only with the service providers listed below that host our systems and send our emails, under contracts that limit their use to providing those services, or when the law requires it.

The AI concierge: only if you use it, your name and email address are included with your messages so it can fill in booking details for you. They are processed by Anthropic solely to generate the concierge's replies; Anthropic does not use this data to train its models. Your profile picture is never sent.

You can remove Reservado's access at any time at myaccount.google.com/permissions, and ask us to delete your account at [email protected].

Reservado's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• To provide your bookings and the account you asked for (contract, Art. 6(1)(b) GDPR).
• To meet tax, accounting and anti-fraud duties (legal obligation, Art. 6(1)(c)).
• To keep the service secure and improve it (legitimate interest, Art. 6(1)(f)).

We do not sell your data, and we do not use it for advertising.

We share only what each provider needs to do its job:

• Google: sign-in.
• Stripe: card, Apple Pay, Google Pay and bank payments.
• Coinbase (Developer Platform): your self-custodial crypto wallet. Only you control its keys.
• Duffel (flights) and LiteAPI (hotels): to book with airlines and hotels, who receive your traveller details.
• Partners for jets, yachts, villas, cars and lounges, when you book or request one of their listings.
• DigitalOcean (hosting) and Neon (database): both in Frankfurt, Germany.
• Cloudflare: domain and network security.
• Resend: booking and support emails.
• Anthropic: the AI that powers the concierge.

Some of these providers are based in, or may process data in, the United States. Where that happens, transfers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

Voice input uses your browser's built-in speech recognition. Depending on your browser, the audio may be processed by its maker (for example Google in Chrome or Apple in Safari).

Account data stays while your account is open. Booking and payment records are kept as long as tax and accounting law requires, generally up to 10 years. Support and concierge chats are deleted after 2 years. Security logs are kept for a short time only.

We use only the cookies needed to keep you signed in and to protect forms. No advertising or tracking cookies, so there is no cookie banner.

You can ask for a copy of your data, its correction or deletion, to restrict or object to its use, or to receive it in a portable format. Write to [email protected]; we answer within one month. Records we must keep by law are deleted when that period ends.

You can also complain to the Slovenian data protection authority, the Information Commissioner (Informacijski pooblaščenec), at ip-rs.si.

If we change this policy in a way that matters, we will tell you by email or on the site before it takes effect.