Privacy

Information processed

• Search: Search: the free-text query, interpreted dates, destination, purpose, number of travellers, rooms, budget and preferences, as well as hotel choices, provider results and errors.
• Trip and booking: Trip and booking: booking reference, hotel, location, dates, travellers, roles, prices, cancellation information, owner tokens and, on the direct-booking path, the guest’s name, email address, phone number and confirmation details.
• Price watch and cancellation deadline: Price watch and cancellation deadline: watch ID, booking information, threshold, latest price observation and, when provided, email address.
• Flight watch: Flight watch: flight number, flight date, status, actual flight observation, EU261 assessment and locally generated claim letter.
• Voluntary feedback: Voluntary feedback: category, message and whether contact is requested. A message may itself contain personal information and is stored as an internal event.
• Contact form: Contact form: subject, booking reference, email address, message and urgency. The information is sent to answer the question.
• Technical events: Technical events: search ID, booking ID, choice ID, adjusted search text, provider, response time, status and technical error type. Free text in feedback and adjustment payloads may contain personal information.

Browser storage

The following information is stored locally in your browser. It is not sent to Tripnorm as a browser identifier. It remains until you clear the relevant record or use your browser’s site-data setting. Records in localStorage remain until cleared; records in sessionStorage disappear when the tab is closed.

• tripnorm.searchHistory.v1: search query, interpreted destination, purpose, budget, dates, number of results and selected hotel names; up to 50 records.
• tripnorm.costCenter.v1: cost centre, project number or another reference entered by you.
• tripnorm.cookieConsent.v1: your cookie choice and the time of the choice; no identifier.
• tripnorm.myBookings.v1: booking ID, reference, owner token, hotel, location, any next-day effect, dates, travellers, provider and saved time; up to 30 records.
• tripnorm.savedHotels.v1: saved hotel, search query, role, price snapshot, number of nights, location and saved time; up to 100 records.
• tripnorm.flightWatch.v1: watch ID, owner token, passenger count, any claim letter and the answer to the fourteen-day question.
• tripnorm.externalWatch.v1: watch ID and owner token for the cancellation deadline.
• tripnorm.booking.resume.v1: current booking details, choice, price watch and owner token in sessionStorage.
• tripnorm.payment.v1.<boknings-id>: technical IDs for the current payment, stay details, room, price, cancellation details and the guest’s name, email and phone number in sessionStorage.

Server memory storage

When Supabase is not connected, some information is stored in the process’s memory. It disappears when the process restarts. Memory storage covers bookings, price watches, flight watches, external cancellation watches, technical events, the email outbox and deferred sends. The search-history server table is not stored in memory; without Supabase, no search_runs record is saved. The memory outbox may contain complete email messages when no email provider is configured.

Connected database

When a Supabase database is connected, information is stored in the corresponding tables. This includes search_runs with queries and responses, provider_attempts with provider status, hotel_choices with hotel and rationale data, analytics_events with technical events and feedback payloads, booking_handoffs with booking and confirmation data, price_watches with watch data and any email address, flight_watches, external_watches, price_watch_checks with price observations, email_optouts with unsubscribed email types and email_sends with delivery status.

The database’s actual region is determined by the connected Supabase project and must be documented in the operating environment. Tripnorm’s code does not send the information to any other database region.

Logs and email

Technical logs mainly contain a timestamp, request ID, search ID, booking ID, provider, response time, security level and error message. Email addresses are masked in email events. Logs may contain error text from an underlying system and must therefore be treated as operational data.

Price watches, the contact form and any booking or trip messages are sent through the configured email provider. Resend uses its API and may process the information in the United States. If no provider is configured, the message is built in a process-local outbox instead of being claimed as sent. The price-watch email address is removed from the watch when the watch ends or is cancelled.

Recipients and processors

Information may be processed by Tripnorm’s suppliers, including the connected Supabase database and the configured email provider. Resend is used for email delivery and may process the information in the United States. We do not sell personal information or use it for other marketing.

Legal basis

Search and price comparison rely on our legitimate interest in providing the service you request. Processing necessary to complete or handle a booking relies on the contract with you. Price watching relies on your consent and can be withdrawn. Feedback is processed so we can improve the service based on what you choose to share; the contact form is processed so we can answer your question.

Retention

Local records are cleared by you or when site data is cleared. sessionStorage disappears when the tab is closed. Process memory disappears on restart. In the current version, there is no automatic pruning of search_runs or analytics_events in the connected database; there is no automatic 90-day pruning rule. A PROPOSAL for 90 days is documented but not enabled. Information may therefore remain for as long as it remains in the current storage.

Your rights

You can request access to, correction of or deletion of your information, object to processing or request a restriction. You can also complain to the Swedish Privacy Protection Authority. The contact details are listed on the About the company page when a working address has been published.