Privacy policy
What data we process about you, why, how long we keep it, who we share it with and what your rights are. In plain language.
Last updated: 28 October 2026
This is a translation. If the English and Dutch versions differ, the Dutch version applies. Dutch version
Who we are
Adriana Travels, Chamber of Commerce (KvK) 90547136, Adriaanstraat 39BIS, 3581 VS Utrecht, the Netherlands. We decide why and how your data is processed on this website. That makes us the controller under the General Data Protection Regulation (GDPR). Questions about your privacy? Email us at info@adrianatravels.com.
A few terms
- Personal data: any information that says something about you, such as your email address or your IP address.
- Processing: anything that can be done with that data, such as receiving, storing, forwarding or deleting it.
- Controller: whoever decides what data is used for and how. That's us.
- Processor: a company that processes data on our behalf, such as our hosting provider.
What data we process
- What you tell Adriana: your questions and wishes, and the dates and group you choose in the search bar.
- Technical data: your IP address, temporarily and only in hashed form (a code that can't be reversed), for the counters against misuse; if you're logged in, Adriana also counts per account, hashed in the same way. Also the data that ends up in the server logs on every visit (IP address, browser, requested page).
- Your cookie and language choice: whether you allow statistics and marketing and when you chose that, and whether you want the site in Dutch, English or Swedish.
- Your message to us: if you email us or use the contact form, your name, your email address, what you write and which language you use the site in.
- A call with a villa expert: if you book a call, your name, your email address, for a phone call your phone number, what you'd like to talk about, the day and time you choose (in Dutch time) and the language of the site.
- Your account (if you create one): your email address, your first name, your password (stored encrypted; we can't read it), whether you want villa inspiration by email, your language (Dutch, English or Swedish, for our emails), the villas you save and your conversations with Adriana. If you log in with Google, we receive your name, your email address, a link to your profile picture (which we don't use), a unique Google number and whether your email address is verified with Google. Our account service also records when you log in and from which IP address, to prevent misuse.
- Newsletter: if you sign up, your email address, the language, where you signed up (the form or your account), when you signed up or unsubscribed, the IP address you signed up from and the consent text you saw.
Why, and on what basis
We may only process data if there is a legal basis for it (Article 6 GDPR). Per purpose:
| Purpose | Data | Basis |
|---|---|---|
| Searching villas for you with Adriana | What you tell Adriana | Contract: you ask us for this service |
| Your account: logging in, saving villas, finding your conversations with Adriana, showing your calls with a villa expert | Account details, saved villas, stored conversations, login times | Contract: you create an account yourself |
| Security and preventing misuse | IP address, server logs | Legitimate interest: keeping the site secure and affordable |
| Visitor statistics: how many people visit the site, which pages they view and whether they click through to a partner | Page visits, country, device and browser, without cookies and without storing your IP address | Legitimate interest: improving the site and seeing what works |
| Marketing | None yet | Consent |
| Booking a call with a villa expert and sending you the invitation | Name, email address, phone number (for a phone call), topic and chosen time | Contract: the appointment you make with us |
| Sending the newsletter | Email address and language; time of sign-up, IP address and consent text as proof | Consent |
| Answering your question (email or contact form) | Name, email address and your message | Legitimate interest: being able to help you |
| Administration | Invoices and payments | Legal obligation |
How Adriana works (AI)
- Adriana is an AI. So you're talking to a computer, not a person.
- The AI is made by Anthropic. Anthropic acts as our processor: it only uses your questions to create the answer and doesn't train its AI on them.
- If you're not logged in, your conversation is only stored in your own browser. If you are logged in, we keep it in your account so you can continue later. You can always delete it there. Our logs only record how much text was processed, not what you wrote.
- Adriana doesn't make decisions about you with legal effects. She only suggests villas; you choose.
- We don't build a profile of you. Adriana only uses an old conversation if you click Continue yourself.
- Adriana can make mistakes. Always check the price and availability with the partner before you book.
Sensitive data
You write to Adriana in your own words. Only share what's needed to find a suitable villa, such as someone using a wheelchair or travelling with small children. Adriana doesn't need to know anything about your health, religion or other sensitive matters. If you do mention something like that, we only use it to find a suitable villa, and we don't keep it, except in your stored conversation if you're logged in. You can delete that conversation yourself.
Your account
You don't need an account to search with Adriana. If you create one, you can save villas and continue talking to Adriana later. You log in with your email address and a password, or with Google.
Logging in with Google: you briefly go to the Google login page. It tells us who you are (your email address and name); we never see your password there. Google sees that you log in with us. Google is responsible for what happens to your data there; it is not a processor of ours.
Calls in your account: under Appointments you see your upcoming calls with a villa expert. We fetch them from Cal.com using your account's email address, only if you have confirmed that email address. We don't store them separately.
Downloading your data: in your account, under Settings, "Download my data" gives you everything we keep with your account, as a file.
Deleting your account: in your account, under Settings, choose "Delete my account" and confirm. Your account, your saved villas and your stored conversations are then deleted permanently, straight away. Our account service makes no backups on our current plan, so no copy is left behind. Calls with a villa expert are kept separately from your account at Cal.com and are deleted according to the period below. If it doesn't work, email info@adrianatravels.com.
A call with a villa expert
If you book a free call, we send your name, your email address, for a phone call your phone number, what you'd like to talk about, the chosen day and time (in Dutch time) and the language of the site (for the invitation) to Cal.com, our scheduling service. Cal.com puts the appointment in our calendar and sends you the invitation, with a link to reschedule or cancel. For a video call, Cal.com also creates the video link. If you open that link, you're on Cal.com's website.
We only use this data for this call. We delete the appointment from Cal.com no later than 12 months after the call.
When you click through to a partner
You don't book with us, but with our partner. If you click through, you're on the partner's website. From that moment, the partner's privacy policy applies, and the partner may place its own cookies.
We don't send any personal data in the link: only the address of the villa at the partner, with a code that tells the partner you came through us. Your browser only tells the partner which website you came from (our domain name), not which page. Also read how we earn money.
Who we share data with
We don't sell your data. We only share it with services we need to make the site work:
| Service | What for | Role | Where | Transfer outside the EU |
|---|---|---|---|---|
| Vercel | Hosting the website and anonymous visitor statistics | Processor | Frankfurt (EU) | US company, certified under the EU-US Data Privacy Framework |
| Supabase | Villa database, and the accounts: logging in, saved villas and stored conversations | Processor | Ireland (EU) | US company; data processing agreement with standard contractual clauses |
| Anthropic | The AI behind Adriana | Processor | United States | Standard contractual clauses in Anthropic's data processing agreement |
| Cal.com | Booking calls with a villa expert and sending invitations | Processor | United States | Standard contractual clauses in Cal.com's data processing agreement |
| Resend | Sending messages from the contact form to our mailbox, the emails for your account (confirming your address, new password), and sending the newsletter | Processor | United States | US company; data processing agreement with standard contractual clauses |
| Upstash | Counters against misuse, with only hashed IP addresses and account codes | Processor | Frankfurt (EU) | US company, certified under the EU-US Data Privacy Framework; otherwise standard contractual clauses |
We have a data processing agreement with all of these services.
Google: if you log in with it, Google is responsible for what happens there (see "Your account" above). It is not a processor of ours.
Dictating with the microphone: that's a feature of your own browser, not ours. In Chrome your voice goes to Google, in Safari to Apple. They are responsible for that themselves; they are not processors of ours. We only receive the text that appears in the input field, and only if you send it.
Data outside the European Union
If data goes to a country outside the European Economic Area, such as the United States, that's only allowed with extra protection. The table above shows which, per service: the EU-US Data Privacy Framework (an agreement between the EU and the US) or standard contractual clauses (fixed terms drawn up by the European Commission).
How long we keep data
| Data | Where | How long |
|---|---|---|
| Your conversation with Adriana | In your browser (sessionStorage) | Until you close the tab |
| Your account (email address, first name, password, newsletter choice, language) | Supabase | Until you delete your account. If you haven't logged in for 2 years, we delete your account, after emailing you first. |
| Saved villas and stored conversations (only if you're logged in) | Supabase | Until you delete them yourself, or your account |
| Login times and IP address | Supabase | At most 7 days in our account service's logs. With your login session until you log out. |
| Login cookie | Cookie in your browser | Until you log out, at most 400 days |
| Your questions and the answers | Anthropic | Deleted within 30 days, except for misuse investigations or a legal obligation |
| Server logs | Vercel | 1 hour |
| Visitor statistics | Vercel | Anonymised, viewable for 12 months |
| IP address (hashed) for the counters against misuse | Upstash | At most 48 hours |
| Your cookie choice | Cookie in your browser | 6 months |
| Your language choice | Cookie in your browser (NEXT_LOCALE) | 1 year |
| Messages to us (email and contact form) | Our mailbox | 2 years after our last contact |
| Delivery data for the contact form and account emails | Resend | 30 days |
| Newsletter | Supabase and Resend | Until you unsubscribe; we keep proof of your consent (time of sign-up, IP address and consent text) for 2 years after that. |
| Call with a villa expert | Cal.com | No later than 12 months after the call |
| Administration | Accounts | 7 years (legal retention obligation) |
Your rights
Access, correction and deletion
You may know what data we hold about you, and ask us to correct or delete it.
Restriction and portability
You may ask us to temporarily stop using your data, for example while we look into a request of yours. And you may receive your data in a form you can give to someone else.
Objection
If we use your data on the basis of our legitimate interest, you may object to that (Article 21 GDPR). You can always object to emails with offers; we'll then stop sending them.
Withdrawing consent
If you gave consent, you can always withdraw it, just as easily as you gave it (Article 7(3) GDPR): via Cookie settings at the bottom of every page, or via the unsubscribe link in the newsletter.
How to make a request
If you have an account, you can do a lot yourself: in Settings you change your first name, download your data and delete your account. Email info@adrianatravels.com. We reply within a month. Sometimes we first ask you to show who you are, so we don't give your data to someone else. We can't look up a conversation with Adriana without an account for you: we don't keep it.
Complaint
Not happy with how we handle your data? Let us know first. You can also always file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), the supervisory authority in the Netherlands.
Newsletter
If you sign up for villa inspiration by email (now and then, at most once a month), this is how it works:
- you're on the list straight away and get a welcome email. If it wasn't you, you unsubscribe from it in one click;
- as proof of your consent we keep the time you signed up, the IP address you signed up from and the consent text you saw;
- every email contains a link to unsubscribe in one click;
- if an email can't be delivered because the address doesn't exist (any more), or you mark it as spam, we unsubscribe you automatically.
We send the newsletter with Resend (United States, standard contractual clauses). Your sign-up is stored in our database at Supabase (Ireland).
In your account you switch villa inspiration by email on or off under Settings. You can switch it on once your email address is confirmed, and that puts you on the list straight away; switching it off unsubscribes you straight away.
Security
We protect your data with appropriate measures (Article 32 GDPR): the site only works over an encrypted connection (https), only we have access to the accounts of our services, secured with two-factor authentication, and we don't process more data than necessary.
Children
This site and the accounts are not intended for children under 16. If you're younger, ask your parent or guardian to search with you.
Changes
If anything changes in how we handle data, we update this policy. At the top you can see when that last happened. You can read more about cookies on our cookie page.
