What we keep, and why

Who controls your data

The data controller is A350 Consulting AS, a Norwegian limited company operating as Fermata.

For any privacy or legal matter, including a request to exercise your rights, write to [email protected].

What we collect

We collect only what the service needs to work. The categories are:

• Account data: your email address, a hashed password (stored with bcrypt, which means we cannot read it), and your plan or tier.
• Product data: the rooms you track with their dates and target prices, and the alerts we have sent you.
• Technical and usage data: your IP address and request metadata, processed by Cloudflare; aggregate, cookieless visit analytics via Cloudflare Web Analytics; and error and diagnostic data via Sentry.
• Payment identifiers: handled by Stripe. Your card details go to Stripe directly and never reach our servers. We store only Stripe’s customer and subscription identifiers and your plan status.
• Sign-in token: when you sign in, one token is stored in your browser’s local storage so you stay signed in; signing out removes it.

The price observations Fermata records are about hotel rooms and their rates. They do not describe people, so they are not personal data.

Do you have to give us this data

Some data is needed to provide the service, and some is collected only if you choose to use a feature:

• Your email address is required to create an account and sign in. Without it we cannot provide an account or send the alerts you set.
• Payment identifiers held by Stripe are required to take a paid plan. Without them we cannot provide paid features. Your card details still go to Stripe directly and never reach our servers.
• Tracking rooms is voluntary. We collect that product data only when you choose to track a room, and you can stop at any time.

Why we use it, and our legal basis

Under GDPR Article 6, every use of your data rests on one of the following legal bases:

• Performance of a contract: running your account, the room-tracking service, sending the alerts you set, and billing your plan.
• Legitimate interests: keeping the service secure, preventing abuse, counting visits in aggregate, and monitoring errors so we can fix bugs.
• Legal obligation: keeping tax and accounting records as Norwegian law requires.
• Consent: relied on only where we specifically ask for it. Today none is required, because our analytics are cookieless and our email is transactional.

Email and communications

We send transactional email only, through Postmark, our email processor. We do not send marketing. There are two kinds:

• Price alerts you set on a tracked room.
• Account and security email, such as password resets.

The unsubscribe link in any alert turns alerts off. Account and security email is essential, so it always sends.

Cookies and local storage

We use no advertising cookies and no cross-site tracking. Our visit analytics are cookieless and count visits only in aggregate; they do not profile you or follow you around the web. The only thing stored in your browser is the strictly-necessary sign-in token described above, which keeps you signed in and is removed when you sign out.

Because we set no advertising or tracking cookies and our analytics are cookieless, no cookie-consent banner is required.

Booking links to Hotels.com are affiliate links through Stay22. When you click one, you leave Fermata: Stay22 and Hotels.com record the click on their own sites and may set their own cookies there to attribute a booking, under their own privacy notices. The link carries only the hotel, your dates and party, and a label naming the page you clicked from, never your name or email.

Who we share it with

We do not sell your personal data. We share it only with the sub-processors that run parts of the service for us, and where we are legally required to. The sub-processors are:

• Stripe: payment processing.
• Postmark: email delivery.
• Railway: hosting.
• Cloudflare: content delivery, reverse proxy, security, and cookieless analytics.
• Sentry: error monitoring.

Sending data outside the EEA

The service is hosted in the EU (the Netherlands). Some of the processors above are US-based, so your personal data may be transferred outside the EEA. Where that happens, it is covered by appropriate safeguards, for example the EU Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.

How long we keep it

We keep each category only as long as it is needed:

• Account and product data: kept while your account is active and deleted when you close your account.
• Price observations: these are about rooms and their rates and do not describe people, so they are kept.

How we protect it

We take reasonable measures to protect your data:

• Data is encrypted in transit with TLS.
• Passwords are hashed with bcrypt, so we cannot read them.
• Cloudflare sits in front of the service as a proxy and security layer.
• Card data is never stored on our servers; it goes directly to Stripe.
• Access to systems and data is limited.

Your rights

Under GDPR Articles 15 to 22 you have the right to:

• Access the personal data we hold about you.
• Have inaccurate data rectified.
• Have your data erased.
• Restrict how we process your data.
• Receive your data in a portable form (data portability).
• Object to processing based on our legitimate interests.
• Withdraw consent where our processing relies on it.

To exercise any of these, write to [email protected]. We respond within one month, as GDPR Article 12(3) requires. You also have the right to lodge a complaint with the supervisory authority; in Norway this is Datatilsynet (datatilsynet.no).

Changes to this notice

If we make a material change to this notice, we email account holders before it takes effect. Continued use of the service after a change takes effect means you accept the updated notice.

Contact

For any privacy question, or to exercise any of your rights, write to [email protected].