Privacy Policy
Last updated: 1 November 2026
NovaBid Ltd ("we", "us") respects your privacy. This policy explains what personal data we collect when you use NovaBid, why we collect it, how we use it, who we share it with, and the rights you have under UK GDPR and the Data Protection Act 2018.
1. Who we are
NovaBid Ltd is a company registered in Scotland (company number SC886622), with its registered office at 5 South Charlotte Street, Edinburgh, EH2 4AN. Our registered email is hello@novabid.co.uk. We are the data controller for the personal data described in this policy, registered with the UK Information Commissioner's Office (ICO) under registration number ZC135378.
2. What we collect
Account data, name, email, phone, company name, role (SMB or hotel). Booking data, trip details (city, dates, budget, guest names and emails), confirmation codes, payment status. Hotel partner data, hotel name, address, contact details, photos, amenities, Stripe payout account identifier. Technical data, IP address, browser, device type, login timestamps, and the technical logs of requests made through an AI assistant connector (section 10). Partner Agreement signing: if you sign the Hotel Partner Agreement online, we record your name and position, the details you enter on the signature page (such as the operator's legal name, the notices email and your authority to sign), the date and time, your IP address and your browser, together with the signed document. We email the signed copy, including that record, to the address the agreement was sent to and keep one ourselves. We do not store payment card numbers; payment is handled by Stripe. Pop-up alerts: if you turn on pop-up alerts in Settings, we store, linked to your account, the notification address your browser gives us, its encryption keys and your browser type. We use them only to alert you to new trip requests, as part of the service (Article 6(1)(b) UK GDPR). Each alert is encrypted and delivered through your browser maker's push service (for example Google for Chrome, Microsoft for Edge, Apple for Safari, Mozilla for Firefox), which cannot read it. We keep this record until you turn alerts off, your browser withdraws it, or your account is closed.
3. Why we collect it (lawful bases)
To perform the service contract you have with us, creating accounts, processing bookings, paying hotels, sending booking confirmations (Article 6(1)(b) UK GDPR). To meet legal obligations such as tax records and fraud prevention (Article 6(1)(c)). For legitimate interests such as platform security, customer support, answering requests made through an AI assistant, knowing which channels bring us customers, and keeping a record of who signed a Hotel Partner Agreement and when, so that either side can prove it (Article 6(1)(f)). You can object to processing based on legitimate interests at any time (section 7).
4. Who we share it with
Stripe (payment processing & hotel payouts), Supabase (database & authentication, EU region), Resend (transactional email), Google Workspace (our internal email), Vercel (web hosting), Cloudflare (DNS & CDN). Each is contractually bound to handle your data only as we direct. None sell or use it for advertising. If you turn on pop-up alerts, each alert also passes, encrypted, through your browser maker's push service (Google, Microsoft, Apple or Mozilla, see section 2); that service is chosen by your browser, not by us, and cannot read the alert. When you make a booking, we also share the guest's name, email and phone number with the hotel you booked, so it can prepare for and deliver the stay. The hotel is an independent data controller of those details and may use them only to fulfil the booking, never for its own marketing without the guest's consent.
5. International transfers
Most of our processing happens in the UK and EU. Where data is transferred outside the UK/EU, it is to providers covered by the UK Extension to the EU, US Data Privacy Framework or under the ICO's International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses). Pop-up alerts are an exception: the push service your browser uses may be outside the UK and EU, but each alert is encrypted so that only your browser can read it, and we send that service nothing else about you.
6. How long we keep it
Account data: while your account is open, plus 7 years after closure, for tax records and the defence of legal claims. Booking data: 7 years (HMRC requirement). Partner Agreement signing records (section 2), including the IP address and browser recorded with the signature: while the agreement is in force, plus 6 years after it ends, for the defence of legal claims. Marketing logs: 2 years. Visit source tag stored with an account (section 10): while the account is open, or until you ask us to remove it. Technical and security logs, including requests from AI assistants: deleted automatically by our hosting provider within a short period and never later than 30 days; the rate-limit counter that uses your IP address lives in memory for minutes and never more than about an hour.
7. Your rights
Under UK GDPR you can request access to your data, correction of inaccurate data, deletion (subject to legal hold periods above), restriction of processing, and portability of your data. You also have the right to object: where we rely on legitimate interests (section 3), you can object at any time and we will stop unless we can show compelling grounds; where we rely on your consent, you can withdraw it at any time. To exercise any right, email hello@novabid.co.uk. We respond within one month.
8. If your details were provided by your employer
If a colleague or your employer booked travel for you through NovaBid, we received your name, work email and phone number from them in order to process the booking. We use this data only to manage your stay, sending your booking confirmation and sharing your details with the hotel so it can welcome you. This policy applies to you in full, including all the rights above. You will only receive emails about your booking, never marketing without your consent, and the hotel is under the same restriction.
9. Cookies
We use a small set of strictly necessary cookies for authentication and session security, and a few small items of browser storage that are also strictly necessary: your cookie choice, a draft of a trip request while you fill it in, and, if you turn on pop-up alerts, the subscription your browser keeps for them (section 2). With your consent, we may also use one measurement tag (the LinkedIn Insight Tag) to see whether our ads are working, and keep a note of which link or ad brought you to us (the visit source tag); neither is kept unless you accept via our cookie banner. See our Cookie Policy for details.
10. Using NovaBid from an AI assistant
You can use NovaBid from Claude (made by Anthropic) and from other AI assistants that offer our connector. When you ask an assistant about NovaBid or to prepare a trip request, it sends us only what that request needs: the city, dates, number of guests and rooms, your budget and any needs you describe. It does not send us your name, email address or the rest of your conversation. Please do not put personal details, such as guest names, in the needs. We use those details only to answer that request, on the basis of our legitimate interest in answering a request you started (Article 6(1)(f) UK GDPR). We do not save them in our database. You are not required to give us any of them; if you do not, we cannot answer. We keep a short technical log of each call: which tool was used and which assistant it came from, plus our hosting provider's (Vercel) standard request log with the IP address, time, web address and browser type. We use these logs to keep the service secure, prevent abuse and see how much the connector is used, on the basis of our legitimate interests in a secure, working service. The IP address is also held in memory for a few minutes to limit how many requests one source can make. Hosting logs are deleted automatically by our provider within a short period and never later than 30 days. You can object to any of this processing at hello@novabid.co.uk. If you ask the assistant to prepare a trip request, it gives you a link to our trip form with those details in the web address. That web address stays in your browser history and may appear in our hosting provider's request log. While you complete the form, your browser keeps a draft on your device, including any guest names you type, until you send or clear it; nothing in the draft reaches us until you post the request. The link also carries a tag saying which assistant it came from. If you accept measurement in our cookie banner, your browser keeps that tag until you close the tab, and if you then create a NovaBid account we store it with your account, together with the page you landed on and the page that referred you, so we know which channels bring us customers. If you decline, the tag is not kept. You can ask us to remove it from your account at any time. See our Cookie Policy. Your conversation with the assistant is held by its provider (for Claude, Anthropic PBC) under that provider's own terms and privacy policy. The provider decides how your conversation is used and is a separate controller of it; it does not act on our instructions and we do not act on its. We are the controller only of what reaches our servers, as described above.
11. Complaints
If you are unhappy with how we handle your data, contact us first at hello@novabid.co.uk. You also have the right to complain to the UK Information Commissioner (ico.org.uk) or, if you are in the EU, your local supervisory authority.
12. Changes
We may update this policy as the service evolves. If we start using data we already hold for a new purpose, or reduce your rights, we will tell you by email at least 14 days before the change takes effect. Smaller changes, such as describing a new way to reach NovaBid, are published here with a new "Last updated" date. 4 October 2026: added section 10 (using NovaBid from an AI assistant), log and source tag retention in section 6, browser storage in section 9. 25 October 2026: added pop-up alerts in sections 2, 4, 5 and 9. 1 November 2026: added online signing of the Hotel Partner Agreement in sections 2, 3 and 6.