Skip to content
Set up a Price Alert

Legal

Privacy policy

In short: Tidaq sets no cookies, uses no tracking and no ads, and you don't need an account. Our own code stores no IP addresses.

Last updated: 15 October 2026

This is a translation for your convenience. The German version is legally binding.

1. Controller

Zaid Ghazal Prinz-Heinrich-Straße 17 24106 Kiel Germany

Email: zaidghazal216@gmail.com

2. Visiting the website (hosting by Cloudflare)

Tidaq runs on servers of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. When you open a page, Cloudflare processes technically necessary data: your IP address, date and time, the address you opened, your browser type and the page you came from. This is needed to deliver the page and to protect it from attacks.

The legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). Our server logs at Cloudflare are deleted after 7 days at the latest. Cloudflare is certified under the EU-US Data Privacy Framework.

3. No cookies, no tracking

We set no cookies for visitors and store nothing in your browser. We use no analytics or ad services that follow you across websites. Fonts and hotel photos come from our own server, without requests to third parties.

To see how many people use Tidaq and how fast the pages load, we use Cloudflare Web Analytics. It works without cookies and without storing anything in your browser, and it doesn't follow you across other websites. Cloudflare sees the page you open, its load time, your browser type and country, and shows us only totals. The legal basis is our legitimate interest in a working, fast website (Art. 6(1)(f) GDPR).

So nobody misuses our forms to send emails to strangers, Cloudflare Turnstile checks that a person fills in an alert or newsletter form when it's sent. Usually you won't notice; rarely a box to tick appears. For this check Cloudflare processes only the technical data it needs (for example browser features and your IP address), sets no cookies on our site and doesn't see what you type into the form. The legal basis is our legitimate interest in preventing misuse (Art. 6(1)(f) GDPR). Details: Cloudflare's Turnstile Privacy Addendum.

4. Database (Supabase, servers in Frankfurt)

We store prices, hotels and statistics with Supabase, Inc. on servers in Frankfurt am Main (EU). This includes anonymous counts that aren't linked to you:

  • Clicks on “View offer”: booking site, hotel, travel dates and number of guests.
  • Travel dates you open on a stay page and that we then check prices for: hotel, travel dates and number of guests.
  • Views of stay, hotel and city pages: which page (hotel, city, travel dates), not who opened it.

5. Links to booking sites

When you click “View offer”, the booking site or the hotel's website opens in a new tab. We pass on no data about you; the address only contains the hotel, the travel dates and the number of guests. From then on, that site's privacy policy applies. If a link is marked “Partner link”, the booking site or its partner network may set its own cookies there to attribute a booking to us. More in the affiliate disclosure.

6. Price alerts and deals by email

This feature is coming soon. Once it exists: when you set up a price alert, we store your email address, the stay you watch, the text of your consent and its time. We first send you an email with a confirmation link (double opt-in). Only after that do you get alerts, and only for what you asked to watch.

For the deals by email (once a week, only if you sign up) we store your email address, your language, the text of your consent and its time. Double opt-in applies here too. You can stop just the deals (on the manage page, linked in every email); your price alerts then stay.

For the price drop alert (at most one email a day, only if you sign up) we store your email address, your language, the city you chose (or "all cities") or the hotels you follow, the text of your consent, its time and the day of the last email, so you never get more than one a day. Double opt-in applies here too, and you can stop just the price drop alert or single hotels; your other alerts then stay.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time: with the unsubscribe link in every email or by email to us. We then delete your email address, all your alerts and the proof of your consent. If you don't confirm an address, we delete it after 7 days.

The emails are sent by the service Resend (USA). Resend processes your email address and the content of the email for this.

We don't measure whether you open our emails or click links in them.

7. Contact by email

When you write to us, we process your email address and message to reply (Art. 6(1)(f) GDPR). Our mailbox is hosted by Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). We delete the message once the matter is settled, unless we have to keep it.

8. Processors and transfers to the USA

Cloudflare, Supabase and Resend process data on our behalf under Art. 28 GDPR. Where data may reach the USA, this is covered by the EU-US Data Privacy Framework or the EU standard contractual clauses.

9. Your rights

You have the right to:

  • access your data (Art. 15 GDPR)
  • rectification (Art. 16 GDPR)
  • erasure (Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • object to processing based on legitimate interests (Art. 21 GDPR)
  • withdraw consent with effect for the future (Art. 7(3) GDPR)

10. Complaints

You can complain to a data protection authority. Ours is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein, Holstenstraße 98, 24103 Kiel, Germany, datenschutzzentrum.de.

11. Changes

When Tidaq changes, we update this policy. The version shown here applies.