Privacy Policy

1. Scope and who is responsible

This Privacy Policy explains how Outty ("Outty", "we", "us"), handles personal information collected through outty.co and related services. For the purposes of the EU and UK General Data Protection Regulation, we are the controller of the personal information described here.

It does not cover the practices of Viator, of the suppliers who operate the experiences we list, or of any other third-party site you reach from ours. When you leave Outty to book, that site's privacy policy governs the information you provide there, including your payment details.

2. Information we collect

Information you provide: your email address and authentication identifiers when you create an account or sign in, including a Google account identifier and profile basics if you use Google sign-in; any preferences or saved items you create; and the content of messages you send us.

Information collected automatically: IP address, approximate location inferred from IP at city level, browser and device type, operating system, referring URL, pages and listings viewed, search terms entered on the Site, clicks on booking links, timestamps and error diagnostics.

Information from third parties: the identity provider you choose for sign-in confirms your email and account identifier to us. Viator and affiliate network reporting may tell us that a referred booking occurred, in aggregated or pseudonymous form, so that commission can be attributed. We do not receive your payment card details from anyone.

We do not knowingly collect sensitive categories of personal information such as health data, precise geolocation, government identifiers or biometric data, and we ask that you not send them to us.

3. How we use information and our legal bases

To provide the Services: serving pages, running search, maintaining your account and session, and remembering your preferences. Legal basis: performance of a contract with you, or our legitimate interest in operating the Site.

To measure and improve: understanding which cities, categories and listings are viewed so we can rank, cache and prioritize content, and to compute aggregate popularity such as our popular destinations list. Legal basis: legitimate interests, or consent where required for analytics cookies.

To attribute affiliate referrals: passing a partner identifier to Viator so a qualifying booking can be credited to us. Legal basis: legitimate interests in operating a commission-funded service, or consent where required.

To secure the Services: detecting abuse, scraping, fraud and security incidents, and enforcing our Terms. Legal basis: legitimate interests and legal obligation.

To communicate: responding to your requests and sending service messages such as password resets. Marketing email, if we ever send it, will be opt-in where the law requires and always includes an unsubscribe link.

We do not sell personal information, and we do not share it for cross-context behavioral advertising as those terms are defined under US state privacy laws. We do not use your personal information to make decisions that produce legal or similarly significant effects about you.

4. Cookies and similar technologies

We use strictly necessary cookies and local storage to keep you signed in, maintain your session and protect against abuse. These cannot be switched off without breaking the Site.

We use limited functional and measurement storage to remember preferences and to count page and listing views in aggregate.

Clicking a booking link sends you to Viator with our partner identifier attached. Viator may then set its own cookies to attribute the referral. That is Viator's processing under Viator's policies.

You can clear or block cookies in your browser. Where required by law, we ask for consent before setting non-essential cookies, and you can withdraw that consent at any time.

5. When we share information

Service providers acting on our instructions: hosting and application infrastructure, our managed database and authentication provider, error monitoring and email delivery. They may process personal information only to provide services to us.

Viator and affiliate reporting: referral and attribution data as described above.

Legal and safety: where we are legally required to disclose, or where disclosure is necessary to investigate fraud or abuse, protect our rights, or protect the safety of any person.

Business transfers: in a merger, acquisition, financing or sale of assets, information may transfer to the successor, subject to this Policy.

We do not disclose your personal information to advertisers or data brokers.

6. International transfers

We operate from the United States, and our providers may process information in the United States and other countries. Where personal information is transferred out of the European Economic Area, the United Kingdom or Switzerland, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses and the UK Addendum, together with additional measures where necessary.

7. Retention

Account information is kept while your account is active and for a limited period afterwards so we can meet legal, accounting and dispute-resolution obligations, then deleted or anonymized. Server and security logs are kept for a short operational period. Aggregate view counts and analytics that no longer identify an individual may be kept indefinitely.

8. Your privacy rights

Depending on where you live, you may have the right to access the personal information we hold about you, to correct it, to delete it, to obtain a portable copy, to object to or restrict certain processing, to withdraw consent, and to appeal a decision we make about your request.

If you are in the EEA, the UK or Switzerland, these rights come from the GDPR and equivalent law, and you may also lodge a complaint with your local supervisory authority.

If you are a resident of California, Colorado, Connecticut, Virginia or another US state with a comprehensive privacy law, you may exercise the rights that law gives you, including the right to know, delete, correct and opt out of sale or sharing. As stated above, we do not sell or share personal information for cross-context behavioral advertising. We will not discriminate against you for exercising any privacy right.

To make a request, contact us using the details below. We may need to verify your identity, usually by confirming control of the email address on the account, and we will respond within the time the applicable law allows. You may use an authorized agent where the law permits.

9. Security

We use industry-standard measures appropriate to the risk, including encryption in transit, access controls on our database and administrative tools, row-level authorization rules so accounts can only reach their own records, and least-privilege credentials for server-side integrations. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

If you believe you have found a security issue, please report it to us privately before disclosing it publicly, and give us a reasonable opportunity to fix it.

10. Children

The Services are intended for adults planning travel. We do not knowingly collect personal information from children under 13, or under 16 where local law sets that threshold. If you believe a child has provided us personal information, contact us and we will delete it.

11. Changes to this Policy

We may update this Policy as our practices or the law change. The effective date at the top of this page reflects the latest revision, and material changes will be highlighted on the Site.