Privacy Policy
1. Introduction
Welcome to WeiFinders ("we", "us", "our"). Your privacy is important to us. This Privacy Policy explains how we collect, use, and safeguard your information when you visit or use our website and services worldwide, in accordance with UK GDPR and other applicable laws.
2. Data We Collect
- Identity & Account Information:Email address, username, display name, profile picture (including from Google if you sign in via Google Login).
- User-Generated Content & Interactions:Guides, itineraries, custom places, images, videos, comments, FAQ, and links that you publish, and actions such as likes, dislikes, bookmarks, and ratings. Published guides and public itineraries may remain visible after account deletion under “Deleted User”.
- Usage & Diagnostic Data:Server logs including IP address, pages viewed, features used, timestamps, error logs, and other technical information generated as you navigate our site. Used to maintain, secure, and improve the platform.
- Cookies & Tracking Technologies:We use strictly-necessary cookies to enable core site functionality, analytics cookies (e.g. Google Analytics) for aggregated statistics, and marketing cookies (e.g. affiliate-tracking IDs) to attribute bookings made via our partners. Non-essential cookies are set only with your consent via our cookie banner.
- Preference & Profiling Data:Your saved content, search filters, and personalization settings used to tailor recommendations.
- Communications Data:Messages you send via support forms, in-app chat, or feedback surveys, with metadata.
- Chatbot Interaction Data:Transcripts of your questions, our responses, and related metadata used to power and improve our AI chat service.
- Consent & Preference History:Your opt-in/opt-out records for cookies and marketing, stored with a timestamp for audit purposes.
- Payment Information:We do not store payment details. All transactions are handled by Stripe; see Stripe’s Privacy Policy for details.
3. How We Use Your Data
- To manage your account and personalise travel recommendations.
- For subscription management, billing, and payment processing via Stripe.
- To send updates, promotions, and marketing communications (with consent).
- To analyse behaviour and improve our services.
- To support site functionality and security.
- For affiliate tracking via cookies and similar technologies (with consent).
4. Sharing Your Information
We do not sell your personal data. We may share your information with:
- Service providers (payment processors, hosting, analytics).
- Affiliate programme partners (e.g. GetYourGuide) when you click a labelled “Ad” or “Paid link”; shared data is limited to a booking reference or hashed click ID required to attribute commission.
- Law enforcement or regulators when required by law.
- Parties in mergers, acquisitions, or asset transfers (with safeguards).
5. Data Security
We implement encryption and access controls to protect your data. In the event of a breach, we will notify authorities and affected users as required.
6. Data Retention and Breach Notification
Account Information: Retained while your account is active. When you confirm account deletion, we immediately disable the old account and remove its email, username, login provider, and Stripe customer reference from the active user record. The old internal user ID remains only as a pseudonymous ownership and audit reference. A later account created with the same email is a separate account and does not regain the old account’s content.
User-Generated Content & Interactions: Private guides, private itineraries, drafts, saved items, likes, ratings, preferences, feedback, and chatbot transcripts are removed from the active service when account deletion is confirmed. Published guides and public itineraries may remain available under “Deleted User” so existing public pages and links continue to work. Contact us if you want retained public content reviewed for removal.
Custom Places: Private custom places that are not used anywhere else are deleted when you delete your account. Public or reused custom places may be archived so existing itineraries keep working, and any direct ownership attribution is removed.
Custom Place Images: User-owned custom place images are removed when you delete your account. If a place is archived to preserve an existing itinerary reference, the structured place entry may remain without those images.
Usage & Diagnostic Data: Retained for up to 360 days.
System Logs: Retained up to 90 days in Google Cloud Logging.
Cookies & Tracking: Session cookies deleted on browser close. Google Analytics cookies retained 13 months; affiliate cookies such as gyg_partner_id retained 31 days. All non-essential cookies require consent.
Communications & Chatbot Data: Account-linked feedback and chatbot transcripts are deleted from the active service when account deletion is confirmed. Support correspondence held outside the product may be retained only while needed to resolve the request or establish legal claims.
Consent Logs: Direct network and device identifiers are removed on account deletion. The remaining consent record is retained for up to 24 months after deletion for compliance audits.
Billing Records: Payment-card details are held by Stripe, not WeiFinders. Subscription and transaction records may be retained for up to seven years where needed for tax, accounting, fraud, or legal-claims purposes.
Deletion Processing: Firebase authentication, private media, custom-place, and contributed-photo deletion is attempted immediately after the database deletion completes. If a provider or storage service is temporarily unavailable, a daily reconciliation process retries the cleanup. Data may remain in encrypted backups until those backups rotate under the applicable backup schedule and is not restored to the active service.
Breach Notification: We will notify the ICO within 72 hours of discovering a breach and inform affected users if there is a high risk to their rights.
8. International Data Transfers
Your data may be processed outside your country. We rely on UK Addendum SCCs or IDTA and other legal safeguards to comply with data-protection laws.
9. Your Rights
If you are a resident of the UK or EU, you have the right to access, correct, delete, or port your data, and to restrict or object to processing. To exercise these rights, please contact us using the details below.
10. Children's Privacy
Our services are intended for users aged 18 and over. We do not knowingly collect data from individuals under 18.
11. Updates to This Policy
We may update this Privacy Policy periodically. Continued use of our services constitutes acceptance of any changes.
12. Accessibility
We are committed to ensuring our website is accessible to everyone. If you encounter any issues, please contact us at [email protected].
13. Data Controller & Contact Information
WeiFinders is the data controller. For questions, requests, or concerns, contact us:
- Email: [email protected]
- Address: WeiFinders, 124 City Road, London, EC1V 2NX
- Contact Page: Contact Us