Privacy notice
Last updated 24 October 2026.
We hold only what your trips need. This notice sets out what that is, why we hold it, who sees it, where it is kept, and how to take it back.
In short
- We use your details to plan, book and run your trips.
- The houses on your bookings see what they need to host you.
- We do not sell your data or use it for advertising.
- Your data is stored in the United States, and some of it is processed by our server functions in Belgium. Requests to Ocean’s models may be processed elsewhere on Google’s global network.
- You can see, correct, export or delete it. Write to contact@notturno.studio.
Who is responsible
Notturno (“we”) is the controller of your personal data: we decide how and why it is used.
For anything in this notice, write to contact@notturno.studio.
What this notice covers
This notice covers notturno.studio, the Notturno apps for iPhone and Android, Ocean, and the emails we send. It applies to travellers, to people travelling on a trip someone else organised, to anyone who writes to us, and to people who use the partner portal on behalf of a house.
What we hold
Account. Your name, your email address and how you sign in: with Apple, with Google, or with a password. Passwords are held by our sign-in provider. We never see them.
Contact and address. Your phone number, a contact email if it differs, and your postal address. Your address also sets the currency we show prices in.
Photo. Your profile photo, if you add one.
Travel documents. Images of your passport, national identity card or driving licence, with the issuing country and expiry date, if you add them.
Travel preferences. Your answers to the travel questionnaire (atmosphere, interests, pace, where you like to stay, how you like to eat and shop), your home base, and a short summary built from those answers.
Trips. Destinations, dates, where you travel from, the plan, your special requests, the travellers on each trip, the companions you save, and what you ask for along the way: a car, a chef, a change of table.
People you travel with. When you add a guest or invite someone, you give us their name and, if you choose, their email address and phone number. Please tell them, and point them to this notice. For children, we hold only what the trip needs.
Payments. Your Stripe customer reference; the type, last four digits and expiry of saved cards; payments, refunds and each trip’s ledger; and your auto-charge limit, if you set one. Full card numbers are held by Stripe, never by us.
Standing. Your standing, how many trips you have confirmed, and what you have spent with us.
Ocean. What you write or say to Ocean, your conversations with her on the website, and the requests she files for you. See Ocean, below.
Notifications. The messages we send you in the app, whether you have read them, and the device token we need to send a notification to your phone.
Location, in the apps only. If you allow it, your device location while the app is open, to suggest what is near and to send a car to the right place. The website does not ask for your location.
When you write to us. Your name, email address and message, and the IP address it was sent from, when you use the contact or partner forms.
Technical records. IP address, browser and device type in our server logs. On the website, analytics only if you accept them (see the cookie notice). In the apps, a small set of usage events, such as a trip being requested or confirmed.
Partner portal. If you use the portal for a house: your name, work email and phone number, and what you do in the portal.
Where it comes from
Most of it comes from you. Some comes from others: a person who organises a trip and adds you to it; Apple or Google, when you sign in with them; Stripe, when you pay; and the houses on your trip, when they confirm or decline a booking.
Why we use it, and on what basis
The law asks us to name a lawful basis for each use. Here they are.
| What we do | Lawful basis |
|---|---|
| Run your account and your trips: draft, book, change, settle and keep you informed, and pass the houses on your bookings what they need. | Our contract with you. For people on a trip someone else organised: our legitimate interest in running the trip that person booked. |
| Take payment, add extras to the ledger, settle and refund. | Our contract with you. |
| Shape suggestions and drafts around your travel preferences. | Our contract with you. You can skip the questionnaire, or clear it at any time. |
| Answer and act on what you ask Ocean. | Our contract with you. We also ask your permission before your first conversation (see Ocean, below). |
| Keep records for tax, accounting and package travel law, and to deal with disputes and claims. | Legal obligation; our legitimate interest in defending claims. |
| Keep Notturno secure: sign-in checks, Google reCAPTCHA checks that requests come from a person, fraud prevention, limits on repeated requests, server logs. | Our legitimate interest in a safe service. |
| Count visits to the website. | Your consent, given in the cookie panel. |
| Count how the apps are used. | Your consent, given in the app. |
| Send news of a new edit. | Your consent. Each message has a way to stop. |
| Reply to enquiries and partner applications. | Our legitimate interest in answering you. |
| Respond to the police, courts or regulators. | Legal obligation. |
Where we rely on legitimate interests, we have weighed them against yours. You can ask us how, and you can object (see “Your rights”, below).
What you must give us
To confirm a trip we need your name, your email address and the names of everyone travelling, and a way to pay. Without them we cannot book it. Everything else you give us is optional.
Health, access needs and beliefs
Some details you give us can reveal your health, a disability or your religion: an allergy, a step-free room, a halal or kosher kitchen. We use them only to arrange the trip, and we share them only with the houses that need them.
We ask for your explicit permission when you give us details like these. You can withdraw it by removing the detail or by writing to us. The house may then be unable to cater for it.
Ocean
Ocean is an AI concierge built on Google’s Gemini models. When you talk to her, what you say goes to Google to be processed, with the context she needs: your first name, your home base, a summary of your travel preferences, and the trip you are discussing. She may also run a Google Search to answer a factual question.
She does not receive your travel documents, your card details, your photo, your email address or your phone number.
Google may process these requests in any country where it runs these models, including the United States, under its cloud data processing terms. Google does not use them to train its models.
We ask your permission before your first conversation. Without it you can still plan with the form, and write to the house. What is sent, where and for how long is set out in full at notturno.studio/legal/ai.
Your preferences, and decisions made automatically
We build a short summary of your travel preferences and use it to order suggestions and to brief Ocean. You can object at any time: skip the questionnaire, clear your answers in your profile, or write to us.
Your standing is calculated automatically from your confirmed trips and what you have spent. It decides whether mid-trip extras are charged at once or shortly after a trip ends.
No decision with a legal or similarly significant effect on you is made by automated means alone.
Who sees it
The houses on your trip. The hotels, restaurants, drivers, chefs, guides and ateliers on your bookings see your name, email address, phone number, photo, dates, party size, and the requests that concern them. A house on your trip can also see that trip: its dates, its travellers and its plan. Each house uses this to host you, under its own responsibility as a controller.
The people you travel with. Everyone on a shared trip sees the plan and each other’s names. The organiser sees what is booked and paid.
Our service providers. They handle data on our instructions, under contract, and for nothing else:
- Google: sign-in, our database, file storage, server functions, website hosting, push notifications, our mailbox, the models behind Ocean (Vertex AI and Firebase AI Logic) and the Google Search lookups she runs, server logs, reCAPTCHA checks where you sign in, and analytics if you accept them.
- Stripe: payments, saved cards, and Klarna payments taken through Stripe.
- Twilio SendGrid: delivery of the emails we send.
- Apple: delivery of notifications to iPhones.
Others who act on their own account. Apple and Google, when you sign in with them. Apple, when you buy standing in the iPhone app. Klarna, if you pay with Klarna. Banks and card networks. Our professional advisers. The police, courts or regulators, where the law requires it. A buyer of Notturno, or of part of it, who would be bound by this notice.
We do not sell your data. We do not use it for advertising, and we do not let anyone else use it for theirs.
Where it is held
Your data is stored in the United States, and some of it is processed by our server functions in Belgium. Requests to Ocean’s models may be processed elsewhere on Google’s global network.
Our main database sits in Google Cloud’s United States multi-region. Files you upload, such as your photo and documents, are stored in the United States (Iowa). Our website runs in the United States (Iowa). Our server functions run in Belgium. The models behind Ocean run on Google’s global network, so the place is not fixed. Stripe processes payments in the UK, the European Union and the United States. Our emails are sent from the United States.
When your data leaves the UK, we rely on these safeguards: for the European Union, the UK’s adequacy regulations; for the United States, the UK Extension to the EU-US Data Privacy Framework where the recipient is certified, as Google, Stripe and Twilio are, and otherwise the UK International Data Transfer Addendum to the EU standard contractual clauses; and for any other country where Google runs Ocean’s models, the same Addendum, as part of Google’s cloud data processing terms. Write to us for a copy.
How long we keep it
| What | How long |
|---|---|
| Your account and profile | While your account is open. |
| Your photo and travel documents | Until you remove them or close your account. They are deleted from storage at once; copies in Google’s backups are overwritten in its normal cycle. |
| Trips, payments and ledgers | While your account is open. When you close it, a locked record of your account, trips and payments is kept for up to seven years, for tax, refunds and disputes, then deleted. It is never used for marketing. |
| Ocean conversations | On the website, your conversations with Ocean (what you write, her replies and a short summary) are kept with your account, so they carry on when you come back. They are kept until you close your account, and then deleted. They are not archived. In the apps, conversations are not kept on our servers. The requests Ocean files for you, and the notes she sends you, are kept with your account until you ask us to delete them, at contact@notturno.studio; closing your account does not yet remove them automatically. Google may hold a request for a short time to run and protect its service. |
| Notifications | While your account is open. |
| Enquiries and partner applications | Up to two years after our last exchange. |
| Records of repeated requests (IP address) | Up to seven days. |
| Server logs | 30 days. |
| Website analytics | 14 months, and only if you accept analytics. |
| Your marketing choice | Until you change it. |
How we protect it
Data travels encrypted and is encrypted where it is stored. Your photo and documents sit in a folder that only your signed-in account can open. Card numbers never reach us. Inside Notturno, access to personal data is limited to the people who run your trips. If a breach puts you at risk, we will tell you, and the ICO, as the law requires.
Your rights
You can ask us to:
- show you what we hold about you, and send you a copy;
- correct anything that is wrong;
- delete your data;
- restrict how we use it while a question is settled;
- send your data to you, or to someone else, in a format a computer can read;
- stop using it where we rely on legitimate interests, including for the preference summary;
- stop sending you news of a new edit, at any time;
- review a decision made by automated means alone, if one is ever made about you.
Where we rely on your consent, you can withdraw it at any time. That does not affect what we did before.
Much of this you can do yourself in your profile: edit your details, remove documents, clear your preferences, close your account. For anything else, write to contact@notturno.studio. We may ask you to confirm it is you, usually by replying from the email address on your account. We reply within one month, around 30 days, and usually sooner. If a request is complex we may need up to two more months; if so, we will tell you within the first month and say why. There is no charge.
Messages from us
We send messages about your trips: confirmations, changes, settlement. We send news of a new edit only if you have asked for it, and every one has a way to stop. You choose which notifications reach your phone in your profile.
Children
Notturno accounts are for adults. We do not knowingly hold an account for anyone under 18. A child’s details reach us only when an adult adds them to a trip, and we use them only for that trip.
Complaints
Please tell us first, at contact@notturno.studio. We acknowledge a data protection complaint within 30 days and tell you what we are doing about it.
You can also complain to the ICO, the UK regulator for data protection, at ico.org.uk/make-a-complaint (opens in a new tab) or on 0303 123 1113. If you live in the European Union, you can complain to the regulator where you live.
Changes to this notice
We update this notice when what we do changes, and tell you in the app or by email when the change matters. The date at the top shows when it was last updated.