Privacy Policy

1. Who we are and who is responsible

This Privacy Policy explains how Outty ("Outty", "we", "us") handles personal information collected through outty.co and related services. For the EU and UK General Data Protection Regulation (GDPR), Outty is the controller of the personal information described here. You can reach us about anything in this Policy at info@outty.co.

This Policy does not cover Viator, the suppliers who operate the experiences we list, or any other site you reach from ours. When you leave Outty to book, that site's privacy policy governs what you provide there, including payment details.

2. Information we collect

Account data (only if you create an account): email address, sign-in identifiers (including a Google account identifier if you use Google sign-in), display name, home city, and the lists and saved activities you create.

Messages: your name, email address, topic and message when you use our contact form, plus a reference number we assign.

Analytics data (only with your consent): a random visitor identifier and session identifier stored in your browser, pages viewed, referring site, clicks on booking links, which booking button wording you saw, browser and device type, and approximate country. We do not store your IP address in our analytics.

Consent records: a random consent identifier, the choices you made, the policy version, the date and your country. This is how we prove we asked before using optional storage.

Technical data: our hosting provider processes IP addresses and request details briefly to deliver pages and stop abuse.

We do not collect payment card details, and we do not knowingly collect sensitive data such as health data, precise location, government identifiers or biometric data.

3. How we use information and our legal bases

Running the Site and your account: serving pages, search, sign-in, saved lists and preferences. Legal basis: performance of a contract with you (GDPR Art. 6(1)(b)) and our legitimate interest in operating the Site (Art. 6(1)(f)).

Analytics and button testing: counting visits and booking clicks and comparing button wording. Legal basis: your consent (Art. 6(1)(a) and the ePrivacy rules on device storage). Nothing runs until you say yes, and you can withdraw at any time.

Affiliate attribution: when you click a booking link, Viator receives our partner identifier so a booking can be credited to us. Legal basis: legitimate interests in operating a commission-funded service. Viator sets its own cookies on its site under its own policy.

Advertising measurement: an OpenAI pixel tells OpenAI when a visitor who saw one of our ads on ChatGPT clicks a booking button, so we can measure and improve those ads. Legal basis: your consent (Art. 6(1)(a)). The pixel never loads without it, and you can withdraw at any time from "Cookie settings" in the footer.

Answering messages: replying to contact form requests, including privacy requests. Legal basis: legitimate interests, or steps you asked us to take.

Security and legal duties: detecting abuse and fraud, keeping consent records, and meeting legal obligations. Legal basis: legitimate interests and legal obligation (Art. 6(1)(c)).

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not make automated decisions with legal or similarly significant effects about you. The only advertising data sharing is the consented OpenAI measurement described above.

4. Cookies and similar technologies

Strictly necessary storage keeps you signed in, remembers your privacy choice and protects the Site. It does not need consent.

Analytics storage (a visitor identifier, a session identifier and a button-rotation counter) is only created after you accept analytics. If you reject or later withdraw consent, we delete it from your browser straight away.

We honor the Global Privacy Control (GPC) browser signal as a refusal of all optional storage.

Our Cookie Policy lists every item by name, purpose and duration. You can change your choice at any time from "Cookie settings" in the footer.

5. Who we share information with

Processors acting on our instructions: our hosting and edge network provider, our managed database and authentication provider, and our email delivery provider. They may use personal information only to provide their service to us, under data processing terms.

Viator (Tripadvisor group): receives our partner identifier and the page you came from when you click a booking link.

OpenAI: only if you accept marketing cookies, receives booking-button click events (activity, city, price) so we can measure our ChatGPT ads.

Google: only if you choose Google sign-in, to confirm your identity.

Legal and safety: where the law requires it, or to investigate fraud, protect rights or keep people safe.

Business transfers: in a merger, acquisition or sale of assets, subject to this Policy.

We never share personal information with advertisers or data brokers.

6. International transfers

We operate from the United States and our providers may process information in the United States and other countries. For transfers from the EEA, the UK or Switzerland we rely on the EU-US Data Privacy Framework where a provider is certified, and otherwise on the European Commission's Standard Contractual Clauses and the UK Addendum, with additional safeguards where needed.

7. How long we keep information

Account data: while your account is open. When you delete your account, it and your lists are erased immediately.

Analytics events: automatically deleted after 14 months. Totals that no longer identify anyone may be kept.

Contact form messages: deleted after 24 months.

Consent records: kept for 36 months so we can show a valid consent was given.

Your consent choice in your browser: 12 months, after which we ask again. We also ask again whenever this Policy changes materially.

8. Your privacy rights

Under the GDPR and UK GDPR you have the right to access your data, correct it, delete it, receive a portable copy, restrict or object to processing, and withdraw consent at any time without affecting earlier processing. You may also complain to your local data protection authority (in the UK, the ICO).

Signed-in users can do most of this instantly from their account page: "Download my data" gives a portable copy and "Delete my account" erases the account and everything tied to it.

Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other US states with privacy laws have the rights those laws give, including to know, delete, correct and opt out of sale or sharing. We do not sell or share personal information, and we honor Global Privacy Control as an opt-out. We will never discriminate against you for using a privacy right.

For anything else, use the contact form with the "Privacy or data request" topic or email info@outty.co. We may verify your identity by confirming your email address, and we respond within one month (GDPR) or 45 days (US state laws). Authorized agents may make requests where the law allows.

9. Security

We use encryption in transit, strict access controls, row-level authorization so accounts can only reach their own records, and least-privilege credentials for server-side work. No system is perfectly secure. If we learn of a breach that puts your rights at risk, we will notify the relevant authority within 72 hours and tell affected users without undue delay, as the GDPR requires.

If you find a security issue, please report it to us privately first.

10. Children

Outty is for adults planning travel. We do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, contact us and we will delete it.

11. Changes to this Policy

We may update this Policy as our practices or the law change. The effective date above shows the latest revision. For material changes we will ask for your cookie choices again and highlight the change on the Site.