Privacy Policy
Last updated: July 2026
Who we are
sotto.travel is a registered trade name based in the Netherlands, and the controller of the personal data described in this policy.
Chamber of Commerce (KvK): 96507020
VAT (BTW): NL005213643B66
Address: Schiekade 189, 3013 BR Rotterdam, the Netherlands
Email: [email protected]
Information we collect
When you order an itinerary, we collect your email address and the answers you give in the travel questionnaire (destination, dates, travel style, group size, and similar details). If ordering is temporarily paused, you can leave your email address instead so we can let you know when spots open up; in that case we collect that address and the questionnaire answers you already entered. In both cases we also record, where available, which link, ad or website brought you to the site (see Cookies & local storage below). We do not collect payment details directly: these are handled securely by Stripe.
How we use your information
Your information is used solely to create and deliver your itinerary, and to communicate with you about your order. Building your itinerary means sharing your relevant questionnaire answers with the local host curating your plan for that city. We will not sell, rent, or share your personal information with third parties, except as described below.
Third-party services
We use a small number of trusted third-party services to operate sotto.travel:
- Stripe: secure payment processing
- Resend: email delivery
- Supabase: secure data storage
- Anthropic (Claude): AI-assisted itinerary drafting
- Google (Gemini): AI-assisted itinerary drafting
- Cloudflare: website hosting and privacy-friendly, cookieless analytics
- Meta: ad measurement via the Meta pixel, set only with your consent
Each of these services has its own privacy policy and processes data only as needed to provide their service.
Data retention
We retain your order information (email, questionnaire answers, and delivered itinerary) for up to 12 months, after which it is deleted. The same 12-month limit applies to details left for the waitlist. You can request deletion at any time by contacting us.
Cookies & local storage
We use optional marketing and analytics cookies, currently one: the Meta (Facebook) pixel, which helps us see which of our ads bring visitors to the site. It is set only if you choose "Accept" in the cookie banner. If you decline, or simply ignore the banner, no tracking cookies are set. You can change your choice at any time via "Cookie settings" in the site footer, or .
Beyond that, your device stores two small things, neither of which tracks you or is visible to any third party. First, your quiz progress: when you take the questionnaire, your answers are kept temporarily in your browser (sessionStorage) so the form remembers where you are; this is cleared automatically when you close the tab. Second, a short note of which link, ad or website brought you here (for example "came via a sticker in a Rotterdam café"). That note stays in your browser and travels to us in full only if you place an order or join the waitlist, so we know which of our campaigns actually work. It is stored with your order and deleted with it under the retention policy above.
Separately, when you arrive through one of our tagged links, ads or short links, we count the visit itself: an anonymous ping records the campaign name, the country the visit came from, and the page you landed on. It contains nothing that identifies you, no IP address and no device details, and it works the same whether or not you order anything. These aggregate counts are kept for up to 13 months, in the same spirit as the Cloudflare analytics below.
In the same anonymous way, we measure how the questionnaire is used: which steps visitors reach and where they stop, so we can make it better. These measurements carry a random temporary code instead of any identity, are not connected to your answers, your email or your order, record no IP address or device details, and are kept for up to 13 months. For delivered itineraries we also record simple usage signals, such as the plan being opened or saved as a PDF, so we know our plans are genuinely useful on the road. Those signals are linked to the order they belong to, not to you as a visitor, and are deleted together with the order under the retention policy above.
For analytics we use Cloudflare Web Analytics, which is cookieless: it measures page views and referrers in aggregate, sets no cookies, stores nothing on your device, and does not track individuals or follow you across other websites.
Data security
We take reasonable precautions to protect your personal information from unauthorised access or disclosure. All data is transmitted over HTTPS.
Your rights
You have the right to access, correct, or delete your personal data at any time. To make a request, contact us at [email protected].
Third-party links
Our website and itineraries may contain links to external websites (restaurants, venues, etc.). We are not responsible for the privacy practices or content of those sites.
Changes to this policy
We may update this privacy policy from time to time. The current version will always be posted on this page.
Contact
Questions about your data or this policy? Contact us at [email protected].