Privacy Policy
Last updated: October 2026
1. Information We Collect
We collect information you provide when making a booking: name, email address, phone number, and guest details. We also collect technical data such as IP address, browser type, and pages visited for analytics and security purposes.
2. How We Use Your Information
- To process and manage your hotel bookings
- To communicate booking confirmations and updates
- To provide customer support
- To improve our services and website
- To comply with legal obligations
3. Information Sharing
We share your personal information only with accommodation providers to fulfil your booking. We do not sell your data to third parties. We may share data with service providers who assist us in operating our platform (e.g., email delivery, payment processing).
4. Data Security
We implement industry-standard security measures to protect your personal data, including encrypted connections (HTTPS), secure session management, and access controls. Sensitive data such as API credentials are stored securely above the web root.
5. Cookies
We use essential cookies for session management and site functionality. No third-party tracking cookies are used without your consent.
6. AI assistants and the OBO MCP server
OBO offers a free, read-only search server for AI assistants such as ChatGPT, Codex and Claude (the "MCP server" at onebookingonline.com/mcp). It receives only the search details an assistant sends (destination, dates, guests, filters, currency, hotel references); never your name, email, account or payment details. It cannot create bookings or take payments.
For reliability, abuse prevention and service statistics the server records, per request, the tool name, timing, outcome, the assistant client name and a one-way hash of the requesting IP address. Prompts are never received. These statistics are kept for 90 days and then deleted automatically. Separately, every supplier request a search triggers is written to our technical API audit log together with the search details (destination, dates, guests) and the requesting IP address, for troubleshooting and dispute handling; that log is deleted after 14 days. Neither is shared with third parties.
Links produced by the server carry source tags (for example utm_source=chatgpt). If you complete a booking through such a link, the source tag is stored with your booking record for as long as the booking record itself, so that we can measure which channels lead to bookings. You can exercise the rights below over any booking record.
7. Your Rights
You have the right to access, correct, or delete your personal data. To exercise these rights, please email us at [email protected].
You can also do it yourself: signed-in customers export their data, file a request or delete their account from Privacy and data; if you booked as a guest, sign in with the same email (we send a one-time code, no password needed) and you will find your bookings and the same tools. Delete your data explains what is removed and what we must keep.
8. Contact
For privacy-related questions, contact us at [email protected].