ATAbooking Privacy policy
Effective date: 2 November 2026
Who handles your information
AI Makers LLC, a New Mexico limited liability company, United States, operates ATAbooking and is responsible for the personal information it uses to run this service. For privacy questions or requests, contact hello@atabooking.com.
This policy covers travellers, hotel representatives, builders and visitors using ATA. Your chosen AI application and the hotel also handle information under their own privacy notices. A hotel is responsible for its own accommodation, guest-service and legal records.
What reaches ATA and why
| Activity | Information received or created | Purpose |
|---|---|---|
| Search and availability | Destination or hotel/room identifiers, travel dates, party size, budget and requested amenities | Find and quote suitable stays. Names and contact details are not needed for a search. |
| Booking holds, requests and management | Hotel/room, dates, party size, guest name and email, optional phone and notes, calling application name if supplied, hold and ATA references, hotel reference when available, price/currency, commission, status and timestamps | Verify booking requests, manage the booking, show its outcome, assist with changes and reconcile completed stays. |
| Confirmation and abuse prevention | Hashed confirmation credentials, failed attempts, expiry times, request identifiers and email-, phone-, IP- or hotel-based limits | Prevent unauthorised bookings, duplicate requests and abuse. |
| Hotel account and billing | Business and contact details, authorised team members, account/access records, statements, invoice/payment identifiers and status, payment-method type and masked details | Operate the hotel account and collect ATA’s hotel-service fees. |
| Service, security and support | IP address of the connecting device or gateway, client/protocol information, request time and route/tool, response status, errors and messages you send to support | Run and protect the service, limit abuse, investigate faults and answer enquiries. |
ATA receives the fields your AI application sends to our tools and returns results to that application. We do not need or request your full conversation history. Booking responses may include the reference, status, stay details and guest name/email, which the application may display or store under its own policy. Authorise sending guest details before making a booking request.
Keep notes relevant to the stay. Do not include card numbers, passwords, identity documents or medical information. Discuss necessary sensitive requests directly with the hotel through an appropriate channel.
When a service is marked DEMO, fictional bookings can still create stored records if you submit details. The demo does not send those records to a real hotel or charge money. Use fictional details; you can use the same privacy-request route if you accidentally submit personal information.
How we use and share information
For a real booking request that you authorise and submit, we pass the necessary booking details, guest name/email, supplied phone and relevant notes to the selected hotel and its authorised reservation-system provider. We receive booking references, status changes and values needed to manage the request and verify hotel billing. Other hotels do not receive your guest record just because you searched.
Authorised staff and contracted hosting, support and communications providers may access information as needed to operate the service. Stripe processes hotel billing, including the hotel’s payment method and mandate. ATA receives billing identifiers, status and masked method details; full card or bank credentials are entered with Stripe, not in ATA’s booking tools. This is separate from the traveller’s payment to the hotel. Stripe also handles information for its own fraud-prevention and legal purposes; see Stripe’s Privacy policy.
We may disclose necessary records to meet a legal obligation, protect people or establish legal claims. ATA does not sell personal data, use it for targeted advertising, or use booking content to train general-purpose AI models. This describes ATA’s practices, not your chosen application’s independent practices.
Where applicable law requires a legal basis, we use information to perform our agreement with you or take steps you request; meet legal duties such as accounting; and pursue legitimate interests in reliable service, security, fraud prevention and handling disputes. For information supplied about another traveller, we rely on the applicable basis for arranging and managing that traveller’s stay, rather than assuming they signed an agreement with ATA. Optional consent-based uses require a separate choice, and consent can be withdrawn. We cannot process a booking without its essential guest and stay details.
Storage, international processing and security
ATA’s main application and booking database are hosted on our server in the European Union. AI Makers LLC is a US operator, hotels may be in other countries, and service providers or authorised staff may process information elsewhere. EU hosting does not mean all processing stays in the EU.
Where applicable law requires safeguards for international transfers, we use the safeguards required for the transfer, such as an applicable adequacy decision or appropriate contractual protections. Contact hello@atabooking.com for information about recipients, processing locations and applicable safeguards.
We use access restrictions, encrypted connections and security controls appropriate to the information and service. No system can guarantee absolute security.
Retention and deletion
We keep booking data for two years after the stay ends, then remove the guest’s name, contact details, notes and agent. We keep the booking reference, dates, room, guest count, amounts and status as accounting evidence. For a cancelled or declined booking or a no-show, the two-year period runs from the cancellation, the decline or the scheduled end of the stay, respectively. Guest personal information in unconfirmed holds is wiped seven days after the hold was created. An unconfirmed hold expires sooner; expiry frees inventory independently of this deletion period.
| Other records | Retention |
|---|---|
| Search tool inputs | Used for the request, without a separate saved search history. Essential security metadata follows the log period below. |
| Demo booking records | Guest details removed within 30 days of creation. |
| Hotel account/contact and support records | While needed for the account or enquiry, then up to two years after closure or resolution. |
| Routine access, error and security logs | Up to 30 days. Relevant incident evidence may be kept longer for a documented investigation or legal need. |
| Commission invoices and accounting evidence | For applicable accounting and tax retention requirements; keep only necessary fields, not the full guest booking record or guest notes. |
| Backups | Rotated within 90 days, restricted to recovery; deletions are reapplied if a backup is restored. |
Where a legal obligation or active dispute requires specific records to be kept longer, we restrict their use to that purpose and delete them when the requirement ends. Backup copies expire through the rotation period above and are not used for ordinary service operations.
Hotels, your AI application and Stripe set their own retention for information they control. Disconnecting an integration does not automatically cancel a booking or erase records already lawfully held.
Your choices, cookies and contact
You can omit optional phone/notes and avoid sending unnecessary details through your assistant. You may request access, correction or deletion of information held by ATA. Depending on applicable law, you may also request portability or restriction, object to legitimate-interest processing, withdraw consent, and complain to a privacy regulator. Contact hello@atabooking.com; include an ATA reference if relevant, but do not send sensitive identity documents unsolicited. We may reasonably verify your identity and will explain any lawful limit on your request.
The hotel portal and sign-up flow use essential session and security cookies to keep you signed in, maintain your sign-up and protect requests against forgery. Payment pages may use Stripe cookies under its policy. Any non-essential tracking requires the notices and choices applicable to that use.
Search ranking uses supplied travel criteria. Availability and abuse controls may automatically limit requests. Contact us if you believe a restriction is wrong.
The service is not directed at children under 13. An authorised adult should supply information needed for a family booking; avoid putting children’s names or sensitive details in free-text notes. Tell us if a child has supplied information that should be removed.
We will date updates to this policy and give appropriate notice of material changes. A policy update is not, by itself, consent to a new use of your information.