Privacy Policy

Translation notice: This English translation is provided for convenience and should be reviewed by qualified legal counsel. The German Privacy Policy remains authoritative.

1. Controller

2. Website access and hosting

Technically required connection data may include IP address, access time, requested URL, transferred data volume, browser and device information, and status or error data. Processing is necessary to provide the site, defend against attacks and diagnose errors under Article 6(1)(f) GDPR.

The site is provided via OpenAI Sites on Cloudflare infrastructure, whose services may process this connection data.

3. Registration and account

Registration processes first and last name, email address, an optional home base, and sign-in and confirmation data. The display name uses the first name and first letter of the surname. Supabase Auth provides sign-in and email confirmation; passwords are not stored in plain text. The legal basis is Article 6(1)(b) GDPR.

4. Optional emails

With voluntary consent, myhotelmap24.com may use the email address for product news, usage tips and its own offers. Consent status and time are stored as evidence. Consent may be withdrawn with future effect by emailing info@myhotelmap24.com. Registration and use do not depend on this consent. The legal basis is Article 6(1)(a) GDPR.

5. Stays, cruises, statistics and uploads

Registered users may store hotels, addresses, cities, countries, coordinates, dates, room and cabin information, ships, cruise lines, ports, trip purpose, travel party, ratings, booking channels and references, costs and notes. These entries produce private statistics and maps. Optional photos, invoices and booking confirmations are linked to the account; PDFs are technically read to prefill stay data. The legal basis is Article 6(1)(b) GDPR.

5a. Optional stay reminders

Users may voluntarily enable occasional emails about optional details still missing from saved stays. Consent status and time, sent content, delivery status and timestamps are recorded. Consent can be withdrawn in the profile at any time. The legal basis is Article 6(1)(a) GDPR.

6. Voluntary community and sharing

When enabled, participating users see only aggregated figures under the display name. Individual stays, exact dates, addresses, room and booking references, notes, costs, email addresses and files are excluded. Public statistic links use user-selected filters, metrics, design, name display and expiry and can be revoked at any time. Separate consent can contribute an anonymised place or route projection to the public community map. Existing users are not included automatically. The legal basis is Article 6(1)(a) GDPR.

7. Recaps and milestone emails

With separate consent, saved stays may be evaluated to send personal annual or quarterly recaps and travel milestone messages. This consent is voluntary, independent from marketing email consent and may be withdrawn in the profile with future effect.

8. Administration, contact and activity logs

For service administration, support, security and error analysis, the administrator may view registered users, confirmation and consent status, personal travel statistics and essential account activity such as sign-ins, stay edits and uploads. Contact-form names, email addresses, categories and messages are stored only to process the request. Messages sent through MyHotelMap24 are recorded with content, delivery status and timestamp. Logs do not contain passwords. The legal bases are Article 6(1)(b) and (f) GDPR.

9. Maps, place search and future AIS data

Hotel and place search uses Komoot Photon based on OpenStreetMap data; entered queries are transmitted to that service. Map tiles are loaded from OpenStreetMap and Leaflet from unpkg, which may receive the IP address. These are core features under Article 6(1)(b) or (f) GDPR.

External historical AIS queries will be activated only after the provider, storage rights, display rules and international transfers have been reviewed and this policy names the provider. Until then, cruise ports may be joined only by a clearly labelled estimated route.

10. Cookies and Google Analytics

Essential cookies and comparable storage support sign-in, session security and the saved privacy choice. The choice is stored locally as “mhm24_cookie_consent” and can be changed through Cookie settings.

Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, loads only after consent to Analytics. It may process pages viewed, time and duration, interactions, approximate region and browser, device and operating-system information. Advertising personalisation and Google Signals are disabled. With consent, we also store a data-minimised first landing path, referrer host, optional UTM source, medium and campaign, derived channel and language for a later registration. No hotel names, email addresses or user IDs are sent to Google Analytics.

Consent under section 25(1) TDDDG and Article 6(1)(a) GDPR can be withdrawn at any time. Withdrawal removes accessible Analytics cookies, local attribution data and, for a signed-in account, stored registration attribution. Processing in third countries, particularly the United States, cannot be excluded.

11. Recipients, retention and rights

Recipients may include Supabase, OpenAI Sites and Cloudflare, OpenStreetMap, Komoot/Photon and unpkg, and—only after consent—Google Ireland Limited. International transfers follow Articles 44 et seq. GDPR.

Account and stay data are generally retained while the account exists. Users can delete individual stays and files or start complete account deletion in their profile. Complete deletion covers the authentication account, profile, stays, cruises, uploads, shares, activity and email history and linked contact requests. A minimal non-public deletion lock may temporarily remain only when a technical error requires the cleanup to be retried. Statutory retention duties remain unaffected.

Subject to the GDPR, you have rights of access, rectification, erasure, restriction, portability and objection, and may withdraw consent with future effect. Requests can be sent to info@myhotelmap24.com. Complaints may be submitted to a supervisory authority, in particular the Bavarian State Office for Data Protection Supervision, Promenade 18, 91522 Ansbach.

12. Security and updates

Appropriate technical and organisational measures protect personal data against loss, manipulation and unauthorised access. This policy is updated when features, service providers or legal requirements change.

Version: 21 October 2026